Four years after ChatGPT first appeared, AI has become part of everyday working life, and financial services is no exception.
According to Leo RegTech, the Bank of England and FCA’s 2026 survey found that 86% of UK financial services firms now use AI, up from 75% in 2024. As adoption grows, one question matters most: are firms making better compliance decisions, or simply faster ones?
On 19 October 2026, FCA chief data, information and intelligence officer Jessica Rusu spoke at Bloomberg’s UK Policy Series. Alongside the speech, the regulator published guidance on good practice and areas for improvement in AI use across financial services. The document introduces no new rules.
Instead, it shows how the existing framework applies when firms build, buy or deploy AI, offering the clearest view yet of supervisory expectations. Rusu also revealed the FCA is developing its own AI tools to oversee the 60,000 AML firms entering its remit in 2028, so firms should expect searching questions about their own AI use.
The core risk is confusing efficiency with effectiveness. AI can spot unusual transaction patterns, summarise customer data and draft investigation reports at speed. Yet a report produced in seconds says nothing about whether its evidence is complete or its conclusion justified. A firm that clears twice as many alerts while catching less genuine financial crime has not improved its compliance function. It has simply sped up a weak process.
This tension is sharpest in anti-money laundering. A well-written AI report may overlook a material piece of client information that changes the whole picture, yet still look complete. Under pressure to clear backlogs, reviewers may approve it without proper scrutiny. Generative tools can also produce different conclusions when asked to rewrite the same report, raising an uncomfortable question about which output to trust.
The deciding factor cannot be the most confident tone or the newest model; it must be the underlying evidence.
Accountability cannot be outsourced either. The FCA’s good practice includes assigning clear senior manager ownership of AI risks, and firms remain responsible for third-party tools they adopt. However, the regulator also flags excessive reliance on human review as a weakness, warning it can mask model flaws and become a box-ticking exercise. Automation bias is real: after ten accurate outputs, the eleventh gets less attention.
Meaningful oversight must therefore be designed into workflows. Reviewers need the evidence, training and authority to challenge AI, and for higher-risk decisions they could form their own view before seeing the machine’s recommendation. Oversight should scale with the impact of the decision.
The way forward is not to slow every project. Firms should set clear boundaries, test outcomes rather than speed, name an owner and keep defensible records. Smaller firms can adapt existing processes, and the FCA’s publication includes a smaller-firm focus for that reason.
Read the full Leo RegTech post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
