Skip to content
Regulayer™Human Control for AI
Book a live demo

The law library · United Kingdom · Regulator good practice

FCA: AI in financial services, good practice and areas for improvement

Financial Conduct Authority · published 19 October 2026, updated 20 October 2026 · illustrative good practice, agentic AI included

Illustrative good practice, not a rule. The FCA states that these practices are illustrative and non-exhaustive, and that they create no new requirements. Every point on this page comes from the FCA’s published text.

On 19 October 2026 the Financial Conduct Authority published what it found good, and what it found wanting, in how firms use AI, agentic AI included. Firms named accountable individuals for their AI, kept an inventory of their agents with owner and access, recorded whether outputs were approved, overridden or escalated, and set thresholds that lead to enhanced monitoring or temporary shutdown. The FCA lists the risk that human review becomes a box-ticking exercise. It describes these as illustrative practices that create no new requirements.

Status

  • 19 Oct 2026Published by the FCA; updated 20 October 2026 with an editorial amendment.
  • StandingIllustrative and non-exhaustive. It creates no new requirements, prescribes no single model and leaves each firm responsible for what is appropriate and proportionate to its own AI use.

What the FCA describes, and what the record supplies

  • OwnershipNamed accountable individuals: one firm mapped every material AI use case to a named senior manager, with clear decision ownership and sign-off. What the record supplies: the named person whose authority each agent action ran under, on every record.
  • InventoryA central inventory of agents: which agents are live, who owns them, and what systems and data they can access. What the record supplies: each record names the agent, the action and the system it acted on.
  • DecisionsA record of whether staff needed to review AI outputs, whether they did, and whether they approved, overrode or escalated. What the record supplies: every decision sealed as it happens, allowed, sent back, held or stopped, with the person who decided.
  • LogsRecords of prompts, outputs, model versions, applied filters and escalation decisions. What the record supplies: the decision record sits beside your own logs; it carries the outcome and the authority, and can carry a fingerprint instead of the content.
  • ThresholdsThresholds that inform next steps, such as enhanced monitoring or temporary shutdown. What the record supplies: outside the authority, the action stops before it takes effect; tripped, the stop stays tripped until a named person re-arms it.

The area for improvement

The FCA names the risk of human review of AI outputs becoming a ‘box-ticking’ exercise rather than meaningful oversight. In one firm, the reviewer’s role was unclear and became a tick-box exercise over time.

Agentic finance, next

On the same day the FCA’s Jessica Rusu described a framework for agentic finance covering agent identity, delegated authority, accountability and execution, and said incident reporting must extend to significant AI failures and near misses.

Why it is on this list

A regulator has written down what good oversight of AI looks like, agents included, as practice rather than rule. Its examples ask the questions this library keeps returning to: who owns each agent, what it can reach, and what was approved, overridden or escalated, by whom.

What the record supplies

The FCA asks who owns each agent and what was approved. The record names the person, action by action.

Regulayer™ checks each agent action against the named person’s current authority before it takes effect, so actions inside that standing authority need no step-by-step sign-off. Where a particular output requires human review, that review still happens. Every decision is sealed as it happens. Regulayer™ supplies the evidence; the firm and its regulator make the determination.

Regulayer™ for financial services →

See also the law library and AI rules for insurers.

Sources

Related

Checked against the source: the FCA’s published text. Information, not legal advice.

Information, not legal advice. Every entry is verified against the issuing body’s own document; where a source is reporting rather than the document, we say so.