The FCA's Next Examiner Is an Agent.

On 6 July the FCA published the Mills Review, a Board commissioned examination of how AI could reshape retail financial services by 2030 and beyond. Sheldon Mills, the FCA executive director who led it, calls the transformation flatly. "Artificial intelligence will transform financial services by 2030."

The FCA describes it as the first work of its kind initiated by a regulator globally. The evidence base is real. An engagement exercise ran through the first quarter of the year, commissioned research surveyed more than 5,000 UK financial services consumers, and focus groups and international comparison sat behind it.

Most coverage this week will list the seven recommendations and move on. The review deserves a closer read, because two things inside it matter more than the list, and one thing the coverage implies is not there at all.

The perimeter, read it precisely

The scope is in the title. Retail financial services. That single word does two jobs.

It puts retail payments, consumer lending, savings, investments and insurance distribution squarely inside the review's frame. If you sell agents into those firms, or run agents inside one, this document describes your supervisor's direction of travel.

It leaves wholesale and capital markets outside. The live examination pressure there runs through a different instrument, the IOSCO Supervisory Toolkit, section 3.4, which hands every member authority a specific set of examination questions on AI recordkeeping, landing on UK firms through SYSC and existing model risk expectations. A capital markets firm waiting for Mills before reviewing its AI governance posture is reading the wrong publication.

Precision on the perimeter is not pedantry. It decides which document your next examination question comes from.

The findings, and one figure

The review identifies four AI driven shifts. The transformation of firm operations. The evolution of consumer journeys. The reshaping of competition and market power. The amplification of fraud and cyber risk.

The first finding carries the weight. Retail financial services are moving from human led towards AI enabled, continuous and delegated services. Delegated is the word to sit with. The FCA's own research found a fifth of UK adults, equivalent to 11 million people, are likely to use AI that can act autonomously within pre-set goals. Consumers are preparing to hand decisions to agents. Firms already are.

Seven recommendations, three that matter

The seven, in the review's order. Secure and adapt the regulatory perimeter. Strengthen system wide coordination and oversight. Monitor the transition to autonomous models and adapt regulatory frameworks. Scale up the FCA's AI Lab. Enable the foundations for agentic finance. Build and adopt an AI enabled agentic supervisory model. Develop a trusted public interest AI enabled financial capability service.

Three of them decide what the next five years feel like for anyone operating agents in this sector.

Recommendation 1 is the perimeter itself. The regulator is asking whether the boundary of regulation still sits in the right place when financial decisions are increasingly made by AI systems, some of them provided by firms outside the current perimeter. When a regulator opens the perimeter question, the answer eventually lands on someone who is currently outside it.

Recommendation 3 is the transition watch. Autonomous models are treated as a supervised migration, not a product launch. Frameworks adapt as autonomy deepens. The practical consequence for firms is that evidence expectations move with the autonomy of the system, and what passed review for a copilot will not pass for a delegated agent.

Recommendation 6 is the one worth reading twice. An AI enabled agentic supervisory model. The review describes the FCA deploying AI across authorisation, supervision and enforcement, with agent-to-agent workflows as the destination, supervisory agents triaging firm submissions, testing evidence against expectations and generating information requests. The limits are stated. The FCA would develop its own AI to consultant and approver levels only, with human supervisors keeping responsibility for judgement and intervention. And the model depends on firms providing timely, structured, high quality data, with reporting anticipated to move from periodic returns towards continuous, event driven flows.

What this means, followed through

Put the first finding and recommendation 6 together and the shape of the decade appears. Agents will transact, and agents will examine. The connective tissue between them is evidence. Machine readable, retained, reconstructable evidence. Not policies. Not attestations. Records.

For a vendor selling agents into regulated firms, the implication arrives before 2030 does. Your evidence will be triaged by a supervisory agent before a human ever sees it, which means the evidence pack that clears procurement is no longer a binder built for a human reviewer. It is structured data built to survive a machine reading it first and a sceptical human reading it second.

For a regulated firm running agents, continuous and event driven reporting is the end of the periodic scramble. An audit trail assembled quarterly for a return will not survive an examiner that queries it continuously. If you cannot reconstruct what your agent did, neither can they, and that absence is the finding.

What the review does not do

It creates no new rules. The seven recommendations go to the FCA Board and Executive for consideration. No compliance deadline moved this week, no obligation landed. The review's own position is that the existing framework needs evolution, not replacement, and the FCA chair's response points at the same continuity, the principles based, outcomes focused approach built on the Consumer Duty and the Senior Managers regime.

That is precisely why the direction matters more than the date. A recommendation adopted in 2027 is built into supervision by 2028 and examining your records by 2029. The firms and vendors who treat the absence of a deadline as the absence of a signal will meet the agentic examiner with an evidence base built for the previous one.

The clock

The review frames 2030 as the horizon. The work it implies starts earlier, because evidence is the one part of this that cannot be retrofitted. Observability you did not capture, records you did not retain, decisions you cannot trace and ownership you never assigned do not reappear when the information request arrives.

The perimeter work starts now, not in 2030. The review in full sits with the FCA, read it here.