FCA Sets Out AI Good Practice for Finance Firms

The UK’s Financial Conduct Authority has published examples of good and poor practice in how financial firms use AI, and signalled that firms’ incident reporting should reach further. “Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses,” Jessica Rusu, the FCA’s chief data, information and intelligence officer, said in a speech published by the FCA on 19 October 2026.

For banks, insurers and investment firms, this is a direction of travel rather than a new rule. The FCA has not set a threshold, a format or a deadline for reporting AI near-misses, and its good and poor practice publication states plainly that its examples “do not create new requirements”. What it does show is what supervisors will look for when they examine a firm’s AI.

In brief

The FCA has published examples of good and poor AI practice, grouped under consumer outcomes, governance and operational resilience; it says they “do not create new requirements”.
In a speech published by the FCA, Jessica Rusu said incident reporting “must extend to significant AI failures and near-misses”, a stated direction rather than a rule.
How and when any near-miss reporting would work is not yet set out, and the joint FCA and Bank of England AI survey she cited is still to be published.

What good and poor practice looks like

The publication draws on the FCA’s work with firms, its AI Live Testing and Supercharged Sandbox schemes, and the Mills Review. It is organised around three themes, each with examples of what firms did well and where they fell short.

Theme	Good practice seen	Area for improvement
Consumers	Defining the need first	Excluding vulnerable users by default
Governance	Named senior owners per use case	Governance added after deployment
Resilience	Ability to switch models	Single-provider lock-in

Source: FCA, “AI in financial services: good practice and areas for improvement”, 19 October 2026.

On consumers, the FCA ties its examples to the Consumer Duty. One firm built a “live” list of terms that its chatbot flags to staff as possible signs of vulnerability. Weaker practice included assuming AI outputs were clear without testing them, and “overstating what an AI system can do”.

Governance gets the sharpest language. Firms are responsible for the AI systems they “develop, procure and deploy”, the FCA says, and good practice included mapping each use case to an accountable senior manager and registering AI agents “in a central inventory”. In one case study, a firm that deployed AI before setting up governance found that “multiple teams thought oversight sat elsewhere”.

On resilience, the FCA warns against “overreliance on hard-to-replace AI providers”. One firm built a product around a single model with no exit plan; when the model was retired, it had to redesign the product.

The speech went further

Rusu’s speech set the publication in a wider agenda. “Our joint AI survey with the Bank of England, published next week, shows 86% of firms now use AI,” she said. That survey has not yet been released, so the figure is the FCA’s preview of it.

She also turned to consumers using general chatbots for money questions. “Four in five less-experienced investors aged 18-40 have used AI to help with investing, but only 40% of consumers correctly recognise that there is no recourse if something goes wrong after acting on advice from a general-purpose AI tool,” she said. The FCA is “calling on AI providers” to use “clear, proportionate and consistent disclaimers”.

On agents, she said that “the FCA will work with industry, fellow regulators and frontier labs to develop a trusted framework for agentic finance”, covering agent identity, delegated authority, accountability and execution. On near-misses, she linked the push to government policy: “As the AI Minister has recognised, near-miss reporting for agentic AI is becoming a national security priority. It is a regulatory priority too.”

The regulator is also using AI itself. Rusu said the FCA is building AI tools to oversee the “60,000 anti-money laundering (AML) firms coming into the FCA’s remit in 2028”, and an agent to help supervise about 9,000 small wholesale-market transaction reporting firms.

Our read

For compliance teams, the near-miss line is the one to plan around. Major-incident reporting already exists, so the practical question is whether firms can even detect an AI near-miss today, which needs the logging, thresholds and named owners the good-practice examples describe. The AML oversight plans are worth noting too: a regulator using AI to supervise tens of thousands of AML firms will expect those firms’ own controls to be just as data-ready.

Next comes the joint survey, which Rusu said is due next week. Any consultation that turns the near-miss expectation into a rule, with definitions and thresholds, would be the real change.