AI regulation in financial services is developing mainly through existing frameworks rather than a single new rulebook. The FCA, ICO, CMA and other regulators are clarifying how Consumer Duty, data protection, automated decision-making rules, accountability and consumer law apply to AI-enabled services. For payments firms, the most relevant issues include automated fraud and onboarding decisions, agentic payments, delegated authority, data access, human oversight and liability.
Developments covered
🟧 Important, uncertain timing/impact
ICO automated decision-making (ADM) regime
The UK’s updated automated decision-making regime permits wider use of automated decisions while strengthening individuals’ rights to human review and challenge.
The Data (Use and Access) Act 2025 reforms the UK’s automated decision-making framework, allowing broader use of ADM where appropriate while introducing safeguards for individuals. The ICO is expected to publish updated guidance on the new regime, with a statutory Code of Practice on AI and ADM to follow. For payments firms, the changes are particularly relevant to automated fraud detection, onboarding, transaction monitoring and credit decisions.
Key dates
- Summer 2026: Final ICO guidance on ADM expected
- 2027: Statutory AI and ADM Code of Practice expected
Legal issue/risk
Firms using solely automated decisions must ensure appropriate safeguards are in place, including meaningful human review where required and clear information for affected individuals. The use of special category data remains subject to stricter restrictions, and the future Code of Practice is expected to influence regulatory expectations and enforcement.
Next steps
- Review automated decision-making across customer journeys, including fraud, onboarding, transaction monitoring and credit.
- Ensure human review processes are genuinely meaningful and supported by appropriate governance.
- Update DPIAs and monitor the publication of the ICO’s guidance and Code of Practice.
đźź© Long-term/indicative
The Mills Review
The FCA’s forward-looking review examines how AI could reshape retail financial services by 2030 and identifies priorities for future regulatory and supervisory development.
Led by Sheldon Mills, the Review considers the implications of AI for consumers, firms, markets and regulators. It is an advisory document rather than a consultation or rule change, concluding that existing frameworks such as Consumer Duty, SM&CR and operational resilience remain appropriate but may require further guidance as AI adoption grows. For payments firms, the Review highlights emerging issues including agentic payments, delegated authority, liability and programmable money.
Key dates
- 6 July 2026: Mills Review published
- 2026 (expected): FCA “good and poor practice” publication on AI
- End-2026 (recommended): FCA guidance on consumer protection and SM&CR accountability for AI
Why it matters
The Review introduces no new obligations but signals the FCA’s future supervisory priorities. Firms deploying AI should expect continued focus on governance, consumer outcomes, senior management accountability, fraud and cyber resilience, and third-party model risk under the existing regulatory framework.
Next steps
- Review AI governance against existing Consumer Duty, SM&CR and operational resilience requirements.
- Consider how emerging issues such as agentic payments and delegated authority may affect your business.
- Monitor the FCA’s forthcoming AI guidance and good practice publications.
đźź© Long-term/indicative
DRCF Foresight Paper: The Future of Agentic AI
The Digital Regulation Cooperation Forum (DRCF) has published a foresight paper on agentic AI, highlighting how existing UK regulatory frameworks apply to its use across sectors, including financial services.
The paper is not a formal policy or consultation but provides an early indication of regulatory thinking. It confirms that existing requirements, including the FCA’s Consumer Duty, UK GDPR and consumer protection law, already apply to firms deploying agentic AI. It also identifies governance, human oversight, cybersecurity, data minimisation and algorithmic collusion as key areas of regulatory focus.
Key dates
- Summer 2026: FCA Mills Review published
- End-2026: FCA AI Live Testing Cohort 2
- 2026/27: FCA/Bank of England AI and machine learning survey expected
- Q1 2027: FCA AI Live Testing evaluation report
- Ongoing: ICO developing a statutory Code of Practice on AI and automated decision-making
Why it matters
The paper does not introduce new legal obligations but signals that regulators expect firms using agentic AI to comply with existing requirements, particularly Consumer Duty, data protection, consumer protection and cybersecurity obligations. Firms should ensure appropriate governance, meaningful human oversight and clear accountability for AI-driven decisions.
Next steps
- Review existing and planned agentic AI use against Consumer Duty, data protection and governance requirements.
- Assess data access, human oversight and accountability arrangements for AI systems.
- Monitor the Mills Review, AI Live Testing outputs and the ICO’s forthcoming Code of Practice for further regulatory direction.
đźź© Long-term/indicative
Agentic AI and consumers–CMA research and analysis
The CMA has published research on how agentic AI could reshape consumer markets, highlighting emerging issues for payments, consumer protection and competition.
The research examines how increasingly autonomous AI systems could change the way consumers search for, compare, and purchase products and services. For payments firms, it highlights the potential growth of agentic commerce, where AI systems initiate and execute transactions on a customer’s behalf, raising questions about authority, liability, and consumer protection. The report does not introduce new regulatory requirements but signals areas of future regulatory focus.
Key dates
- 2026: DSIT publication on the AI Growth Labs expected
- TBC: DRCF joint report on agentic AI expected
Why it matters
The report creates no new obligations, but firms deploying agentic AI remain subject to existing requirements under consumer protection, payments, data protection and FCA rules. Areas likely to attract regulatory scrutiny include delegated payment authority, customer outcomes, transparency, governance and accountability.
Next steps
- Review planned and existing AI-enabled customer journeys, particularly where AI may initiate or execute transactions.
- Assess governance, human oversight and accountability arrangements for agentic AI.
- Monitor forthcoming DRCF and DSIT publications for further regulatory direction.
đźź© Long-term/indicative
AI Growth Labs (DSIT)
The Department for Science, Innovation and Technology’s AI Growth Labs are regulatory sandboxes designed to support the development and testing of AI products and services.
The AI Growth Labs allow firms to test AI products in real-world settings under regulatory supervision, with temporary regulatory flexibilities where appropriate. The initiative signals the Government’s preference for a sector-by-sector approach to AI regulation rather than a single cross-economy AI regime. While payments and financial services are not part of the initial cohorts, the programme may provide a future model for testing AI-enabled payment services.
Key dates
- Summer 2026: Applications expected to open for the first legal services cohorts
- 2026-2027: Further sector sandboxes expected
Why it matters
The Growth Labs do not introduce new regulatory obligations, and participation is voluntary.
Next steps
- Monitor DSIT announcements for future financial services or payments-focused sandboxes.
- Review lessons from early cohorts to understand how regulators are approaching supervised AI innovation.