# FCA: AI in financial services — good practice and areas for improvement: AI in Financial Services: Good Practice and Areas for Improvement

Source: https://www.bankingnewsai.com/ai-regulation/documents/fca-ai-good-poor-practice-2026
Last updated: Nov 2, 2026

On 19 October 2026 the FCA published illustrative good- and poor-practice examples — drawn from AI Live Testing, the Supercharged Sandbox and supervisory work — covering machine learning, generative AI and agentic AI. It creates no new rules: it maps existing requirements (Consumer Duty, SYSC governance, SM&CR, operational resilience, DISP) onto AI use, and says firms deploying more autonomous agentic systems should design governance — escalation routes, compliance controls, a central agent inventory — before deployment, not retrospectively.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [UK (BoE / PRA / FCA)](https://www.bankingnewsai.com/ai-regulation/uk) |
| Type | Guidance |
| Status | In force |
| Published | Oct 19, 2026 |
| Effective | Oct 19, 2026 |
| Applies to | FCA-regulated firms that develop, deploy, procure or use AI, including agentic AI, in UK financial services |
| Official text | https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services |

## Key points

- Defines agentic AI as AI that can take a sequence of actions towards a goal, and says it may need stronger controls because it can operate more independently than other AI.
- Good practice: designing a governance structure — escalation routes, compliance controls — before deploying autonomous agents, and keeping a central inventory of agents recording ownership, data access and controls.
- Poor practice: retrospective governance, informal approval processes, and tick-box human oversight that doesn't actually catch agent errors.
- Maps AI use onto existing rules rather than creating new ones: PRIN, SYSC governance, Consumer Duty, SM&CR, DISP and the SYSC 15A operational-resilience rules.
- Firms remain responsible for AI outcomes including AI bought from third parties/vendors.
- Published alongside a speech by Jessica Rusu, the FCA's Chief Data, Information and Intelligence Officer, 'Building the future of finance in the age of AI'; both follow through on the Mills Review.

## What changed for banks

The FCA's first guidance specifically naming agentic AI's governance demands — a central agent inventory and pre-deployment governance design — rather than leaving agents to generic AI expectations. It is illustrative, not a new rulebook: firms are still held to existing FCA requirements.

## Use cases it governs

- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)

## FAQ

### Does the FCA have AI-specific rules?

No. The October 19, 2026 good-practice publication maps existing FCA rules (Consumer Duty, SYSC, SM&CR, DISP, operational resilience) onto AI use rather than creating new ones.

### What does the FCA expect before a firm deploys an autonomous AI agent?

Governance designed up front — escalation routes and compliance controls — plus a central inventory of agents recording ownership, data access and controls, rather than governance added after the agent is already live.

## Related documents

- [2026 BoE/FCA AI survey](https://www.bankingnewsai.com/ai-regulation/documents/uk-ai-in-financial-services-survey-2026) — The Bank of England and FCA's 2026 AI Survey (Oct 26, 2026)
- [Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)
- [HM Treasury Financial Services AI Adoption Plan (Jul 2026)](https://www.bankingnewsai.com/ai-regulation/documents/hmt-financial-services-ai-adoption-plan-2026) — Financial Services AI Adoption Plan (Jul 14, 2026)
- [BoE/FCA/HMT joint statement on frontier AI and cyber resilience (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/uk-joint-statement-frontier-ai-cyber-resilience-2026) — The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience (May 15, 2026)
- [BoE response to Treasury Committee AI inquiry (Apr 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-pra-response-tsc-ai-inquiry-2026) — Response to TSC inquiry report on AI in financial services (Apr 1, 2026)
- [BoE/PRA plan for safe AI innovation (Apr 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-pra-safe-ai-innovation-plan-letter-2026) — Letter from Sarah Breeden and Sam Woods to the Chancellor and Secretaries of State on enabling safe AI innovation (Apr 1, 2026)
- [DSIT/DBT strategic letters to regulators (Jan 2026)](https://www.bankingnewsai.com/ai-regulation/documents/gov-uk-dsit-dbt-safe-ai-innovation-letter-2026) — How will regulators enable safe AI-powered innovation: joint letter from DSIT Secretary of State and DBT Secretary of State (Jan 28, 2026)

Last reviewed Nov 2, 2026. Cite the official text (https://www.fca.org.uk/publications/good-poor-practice/ai-financial-services) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fca-ai-good-poor-practice-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 267 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.