What Regulated Firms Should Take from It
The Financial Conduct Authority (FCA) has recently published its good and poor practice guide on AI in financial services. It covers 20 case studies that include a wide range of scenarios, but the supervisor’s core message is straightforward. Existing rules already apply to artificial intelligence (AI), and regulated businesses are responsible for the outcomes their AI systems produce, whether they use systems that have been developed in-house, bought from a third-party provider, or used informally by staff.
The guide does not create new requirements, but it clarifies, in practical terms, what the FCA considers good practice and where it has seen regulated firms fall short.
The Four Areas the FCA Focuses On
The FCA’s AI in financial services guide groups its expectations into four themes that will be familiar to most compliance officers and those with supervisory roles. However, the AI context raises the stakes, and the potential consequences of getting it wrong are growing.
- Consumer Duty and vulnerable consumers. Firms deploying AI-supported tools remain responsible for consumer outcomes. The FCA expects firms to define the consumer need before deploying AI, test outcomes across different consumer characteristics and vulnerability scenarios, and tell consumers how AI is being used and what its limitations are. Poor practice includes automatically excluding vulnerable consumers from AI journeys without offering an alternative route to support or overstating what the AI can do.
- Governance and accountability. The guide is clear that governance should be in place before AI is deployed, not retrofitted afterwards. That means assigning senior manager accountability from the design stage, setting a clear risk appetite, and designing human oversight that genuinely works rather than becoming a tick-box exercise. One of the more striking case studies describes human reviewers whose oversight had become so routine that they were effectively rubber-stamping AI decisions without meaningful challenge.
- Operational resilience. Firms should avoid dependence on a single AI model or provider, include AI dependencies in their resilience mapping and testing, and have credible exit plans. The FCA has seen cases where firms relied entirely on vendor assurances about accuracy and resilience without testing those claims independently.
- Fairness and transparency. Running through all of these areas is an expectation of transparency. Firms should be clear with consumers about whether they are interacting with AI or a person and should not present AI-generated outputs in a way that overstates their reliability.
Why This Matters Beyond Larger Firms
The FCA has made it clear that this guide is not just aimed at larger financial businesses such as banks and insurers with sophisticated AI programmes. The guide includes separate notes for smaller firms throughout, stressing that proportionate controls are expected regardless of business size. The regulator believes that sample testing, phased introduction, and structured review processes are all achievable without the resources of a major financial institution. The message from the regulator is clear: being a smaller business is not an excuse for not having the correct measures in place.
For any FCA-regulated firm that uses AI in its operations, even if that means staff using tools like ChatGPT to draft communications or summarise documents, the guide applies. The question is not whether you are using AI at scale, but whether you have thought about how it is being used, what the risks are, and whether your governance arrangements reflect how it is used in practice.
How RACO Can Help
For FCA-regulated firms, reviewing their compliance arrangements in light of this guide, RACO provides practical support and training solutions across the areas the FCA has highlighted.
Our services include structured compliance and risk management support to FCA-regulated firms, including policy and procedure reviews, governance assessments, complaints handling, and tailored staff training to help your team understand their obligations when AI tools are part of your working processes. We can help you identify gaps in your current arrangements and put proportionate controls in place before they become a regulatory concern.
Speak to Our Compliance Team
To discuss how this guide applies to your business, or to arrange a compliance review, call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
