UK FCA good practice and areas for improvement in AI in financial services

The UK Financial Conduct Authority (FCA) has published a new webpage setting out examples of good practice and areas for improvement to support the safe and responsible adoption of AI in financial services. The examples are drawn from industry engagement and are illustrative and non-exhaustive, which will evolve as practice develops. They are relevant to a variety of AI use cases, such as those using machine learning, generative or agentic AI. They do not create new requirements, prescribe a single model or replace firms' responsibility for deciding what is appropriate and proportionate for their own AI use cases, risks and potential impact. While the FCA identified positive practices, it also identified key areas for improvement, including:

• Consumer duty and consumers in vulnerable circumstances: the FCA found that some firms built AI tools without establishing the consumer problem, target market or foreseeable harms. Some used guardrails that addressed one risk but created another. Some excluded consumers in vulnerable circumstances by default without providing another way for them to get support. The FCA reminds firms that they remain responsible for consumer outcomes where they deploy AI-supported tools and refers firms to its consumer duty guidance (FG22/5) and guidance on the fair treatment of vulnerable consumers (FG21/1).
• Governance and accountability: to govern effectively, firms need to have proportionate oversight, clear accountability and risk-based controls across the AI lifecycle. The FCA found that some firms had informal approval processes or generic governance arrangements, with control functions not involved enough. Some firms took a retrospective approach, designing and deploying AI use cases before considering how to govern them. Others had unclear responsibility for AI systems. Monitoring was sometimes narrow, reactive or static, and oversight functions sometimes lacked AI-specific capability. Further issues included poor documentation and delegating responsibility entirely to technical teams without sufficient understanding or effective challenge. The FCA states that firms remain responsible for the AI systems they develop, procure and deploy, including their outputs and outcomes.
• Operational resilience: the FCA found that some firms did not appropriately consider their use of AI, or their dependence on AI models, in their operational resilience plans. Others relied on vendors' assurances without challenging or testing them. Some relied too heavily on hard-to-replace AI providers and were dependent on a single platform without exit options. The FCA reminds firms that while they can outsource AI services, they remain responsible for them.

On the same date, the FCA also published a speech delivered by Jessica Rasu, chief data, information and intelligence officer at the FCA, on building the future of finance in the age of AI.

Return to main website.