UK Watchdog Warns AI Is Outpacing the Rules Meant to Protect Your Money

Key points

• The UK's Financial Conduct Authority (FCA) published the Mills review in 2025, examining how artificial intelligence will change financial services from 2030 onwards.
• The review found that financial firms are already replacing human-led services with AI-driven ones for everyday customers.
• Ministers have been urged to expand the FCA's legal powers specifically to cover risks created by AI systems.
• The review warns that AI will amplify existing dangers, including cyber-crime and financial fraud targeting ordinary consumers.

The FCA, which is the government body responsible for making sure banks, insurers, and lenders treat customers fairly, has a problem. The rules it enforces were written for a world run by people. The world it is being asked to police is increasingly run by software.

The Mills review, a formal examination commissioned to look at how AI will change UK financial services, found that firms are already shifting. Customer decisions that a human adviser or a call-centre worker used to handle are now being handed to automated systems. That shift will accelerate sharply by the end of the decade.

Should ordinary bank customers be worried?

Yes, in a measured way. The review's core concern is that the rules protecting you when you apply for a loan, buy insurance, or get investment advice were designed assuming a person made the call. When an algorithm, meaning a set of automated instructions run by a computer, makes that call instead, gaps open up. Those gaps are where fraud and errors hide.

The failure mode here is familiar to anyone who has watched a new technology arrive faster than the paperwork. Firms deploy AI tools that cut costs and speed up services. Regulators have no clear authority to examine how those tools work, who trained them, or what data they used. By the time something goes wrong for a customer, the liability trail is cold.

The review also flags cyber-crime specifically. AI makes it cheaper for criminals to run scams at scale, generating fake documents, impersonating bank communications, and targeting people with personalised fraud attempts that look convincing. In practice, that means the phishing email, where a criminal sends a fake message to trick you into handing over your bank details, gets harder to spot.

The ask from the review is direct: give the FCA sharper tools, before the gap between what AI can do and what regulators can check gets any wider. First reported by The Guardian Technology, the review stops short of calling for a ban or a slowdown. It wants oversight, not obstruction.

If you use any online financial service, watch for unsolicited messages asking you to confirm account details, even ones that look official. Real banks do not ask for passwords by email or text.

One operational takeaway: if your organisation touches customer financial data, the question is no longer whether you use AI, it is whether you can explain to a regulator exactly what your AI decided and why.