AI in financial services: good practice and areas for improvement

Key dates

2026-10-19

The FCA publication was issued as part of its wider AI supervisory and industry-engagement work.

Suggested considerations

• Firms should consider maintaining an inventory of AI use cases, including internally developed, embedded and outsourced tools, with a named accountable senior manager and documented risk classification for each use case.
• Compliance teams may wish to map each consumer-facing AI use case to Consumer Duty outcomes, the target market, foreseeable harms, vulnerable-customer considerations, fair value where relevant, complaints handling and available redress.
• Firms should consider documenting why AI is appropriate for the identified consumer need, which activities remain staff-led, where the system must abstain or escalate, and how those controls have been tested in practice.
• Model and risk functions may wish to test accuracy, bias, error rates, explainability, data quality, drift and robustness across relevant consumer characteristics, including vulnerability, accessibility, digital capability and financial capability.
• Firms should consider testing consumer understanding of AI disclosures and outputs with representative user groups, rather than relying solely on technical model explanations or generic disclaimers.
• Operations and technology teams may wish to implement proportionate live monitoring, clear escalation thresholds, sample-based human review, incident and near-miss processes, fallback arrangements and channel continuity where an AI system fails or produces harmful outputs.
• Firms should consider retaining auditable records of prompts, inputs, outputs, model and vendor versions, filters, approvals, overrides, escalations, complaints and remediation decisions for a period consistent with the applicable record-keeping requirements.
• Outsourcing and third-party risk assessments may wish to address concentration and dependency risks, access to testing and performance information, change control, data use, subcontracting, service continuity and the firm’s ability to challenge or replace an AI provider.

What changed

The publication consolidates the FCA’s expectations under the existing framework, including the Principles for Businesses, Threshold Conditions, SYSC, operational resilience, outsourcing and critical third-party requirements, Consumer Duty, vulnerable-customer guidance, SM&CR and DISP. It identifies good practice such as defining the consumer need and target market before deployment, testing outcomes across consumer characteristics and vulnerability scenarios, setting human escalation and abstention controls, maintaining auditable records of prompts, outputs, model versions and decisions, and monitoring live outcomes for bias, drift and harm. It also identifies weaknesses including deploying AI without a defined consumer problem, excluding vulnerable consumers without alternative support,

Who is affected

• UK-authorised banks and building societies using AI in customer service, credit, fraud, communications or internal operations
• UK-authorised consumer credit, mortgage and lending firms using AI in eligibility, affordability, collections or support journeys
• UK-authorised insurers and insurance intermediaries using AI in underwriting, claims, customer support or communications
• UK-authorised investment firms, asset managers and wealth managers using generative or agentic AI in advice, research, portfolio management, trading support or client communications
• UK-authorised payment providers and fintech firms using AI in customer journeys, fraud monitoring or operational processes
• Smaller FCA-authorised firms and appointed representatives whose AI services or providers affect regulated activities and consumer outcomes

Related regulations

• FCA Principles for Businesses
• FCA Threshold Conditions
• FCA Senior Management Arrangements, Systems and Controls (SYSC)
• Consumer Duty
• FG22/5: Guidance for firms on the Consumer Duty
• FG21/1: Guidance for firms on the fair treatment of vulnerable customers
• Senior Managers and Certification Regime
• FCA operational resilience requirements
• FCA outsourcing and critical third parties regime
• FCA Dispute Resolution: Complaints sourcebook (DISP)