Regulatory Frameworks and Liability for Agentic Finance: AI Agent Governance, the FCA's Mills Review, and Live Testing Cohorts

Regulatory Frameworks and Liability for Agentic Finance: AI Agent Governance, the FCA's Mills Review, and Live Testing Cohorts

The regulatory landscape for agentic finance has reached a critical juncture in mid-2026. Rather than drafting a brand-new AI-specific rulebook, regulators in the UK and Europe are aggressively applying existing outcomes-based frameworks—such as the UK’s Consumer Duty and the Senior Managers and Certification Regime (SM&CR)—while piloting real-world deployments and establishing long-term strategic pathways.

The FCA's Mills Review: A Blueprint for Agentic Finance and Supervision

On July 6, 2026, the Financial Conduct Authority (FCA) published the landmark Mills Review (titled Artificial Intelligence (AI) and the future of retail financial services). Led by outgoing Executive Director Sheldon Mills, the 147-page report outlines four systemic shifts driven by AI by 2030 (including agent-led consumer journeys and a reshaped competitive landscape) and delivers seven core recommendations to the FCA Board:

1. Secure and Adapt the Regulatory Perimeter: Review the scale, nature, and impact of general-purpose LLMs operating outside the regulatory perimeter within three to six months, specifically analyzing how consumers use general-purpose AI tools for savings, investments, pensions, mortgages, and debt.
2. Strengthen System-Wide Coordination and Oversight: Enhance cross-sector intelligence sharing on fraud and cyber risks, and establish a coordinated incident response framework for AI-related systemic events.
3. Monitor the Transition to Autonomous Models: Clarify how SM&CR obligations and Consumer Duty apply where opacity, model drift, and distributed decision-making make it harder to evidence outcomes.
4. Scale Up the FCA's AI Lab: Establish a structured capability to assess AI models and systems, partnering with developers and researchers to address explainability and governance before models are embedded.
5. Enable the Foundations for Agentic Finance: Lead the development of a trusted framework for AI agent participation, establishing clear expectations for consent mandates, identity, control, and liability.
6. Build and Adopt an AI-Enabled Agentic Supervisory Model: Develop an AI-enabled agentic supervisory model to monitor Consumer Duty outcomes across firms and support human supervisors.
7. Develop a Trusted Public-Interest AI-Enabled Financial Capability Service: Explore a free, inclusively designed public-interest or sovereign-style guidance service.

As noted by Deloitte:

"Within three to six months, the FCA should review the scale, nature and impact of general-purpose large language models operating outside the regulatory perimeter, including how consumers use general-purpose AI tools for savings, investments, pensions, mortgages and debt. It should then decide whether to amend guidance, recommend perimeter changes to government or maintain the current approach."

Live-Market Testing: The FCA's AI Live Testing Second Cohort

To bridge the gap between regulatory theory and market reality, the FCA announced its second cohort for AI Live Testing on April 21, 2026. Working with its technical partner Advai (an automated AI assurance specialist), the FCA selected eight firms to test AI applications in live market conditions under regulatory oversight:

1. Barclays
2. Experian
3. Lloyds Banking Group (Scottish Widows)
4. UBS
5. Aereve
6. Coadjute
7. GoCardless
8. Palindrome

The use cases in this cohort represent a major shift toward agentic and autonomous systems, covering wholesale and retail applications, agentic payments, anti-money laundering detection, KYC, and credit scoring. Notably, Lloyds Banking Group is piloting an AI-driven investment guidance tool through its Scottish Widows arm. As reported by FStech:

"Separate reporting by Reuters highlights how Lloyds Banking Group is already piloting an AI-driven investment guidance tool through its Scottish Widows arm... Chira Barua, chief executive of Scottish Widows, told Reuters the tool acts 'like a satnav for investments', helping customers navigate options without making decisions on their behalf."

This testing phase concludes at the end of 2026, with a formal evaluation report expected in Q1 2027.

The Compliance Burden: Evidencing AI Agent Compliance

For financial institutions deploying AI agents, the lack of an AI-specific rulebook does not mean a lack of oversight. Compliance tech specialist Aveni (which completed its pilot of its Agent Assure platform in the FCA’s inaugural Supercharged Sandbox in early 2026) has detailed the rigorous evidence trail required to satisfy existing regulations.

Aveni outlines five core areas that firms must document and keep on file to meet the joint expectations of the FCA and the Bank of England:

1. Pre-deployment risk assessment: Outcome-specific Consumer Duty impact assessments.
2. Senior manager accountability: Documented proof of the specific controls relied on by the named senior manager who signs off on the deployment. Under SM&CR, liability cannot be delegated to an algorithm.
3. Real-time monitoring and intervention: Continuous monitoring with documented thresholds and intervention logs, moving away from legacy periodic sampling (e.g., reviewing 2-3% of files), which fails to detect systematic algorithmic errors.
4. Audit trail at the interaction level: 100% interaction review with reasoning traces preserved.
5. Third-party and operational resilience documentation: Evidence of exercised audit rights and tested incident reporting for vendor-provided AI.

As Aveni warns:

"The named senior manager signing off on an agentic deployment is personally accountable for the controls, in writing, in their own name. If the controls cannot be evidenced, the exposure sits with the individual, not the technology, and not the vendor. The model does not take the call from the FCA."

EU AI Act: The August 2026 High-Risk Deadline

Adding to the regulatory pressure, the binding compliance deadline for the EU AI Act's high-risk AI classifications fell on August 2, 2026. UK-based financial services firms with EU customers or exposure are now subject to strict requirements if their AI systems are used in credit scoring or insurance pricing. These requirements include full technical documentation, automatic decision logging, and robust human oversight provisions:

"For UK firms with EU customers or EU exposure, the EU AI Act adds another layer. AI systems used in credit scoring and insurance pricing are classified as high-risk under Annex III. That means full technical documentation, automatic logging of every decision, and human oversight provisions. The binding compliance deadline is 2 August 2026..."