The Mills Review, published earlier this year, explored how AI could transform retail financial services. Its seven recommendations were aimed at the FCA itself: adapting the regulatory perimeter, strengthening oversight and laying the foundations for agentic finance. For the C-suite of banks the more important message is what it reveals about where banking is heading.
The review set out to ask how AI would reshape the sector by 2030. In practice, that era has already arrived. Mills described a shift “from human-led, episodic financial activity towards services that are AI-enabled, continuous and delegated”. The pace is striking: agentic AI, effectively absent from industry surveys two years ago, is now being piloted or deployed by more than half of respondents.
Go deeper with GlobalData
Access deeper industry intelligence
Experience unmatched clarity with a single platform that combines unique data, AI, and human expertise.
Governance as a competitive advantage
Mills made the commercial case plainly: “Governance is likely to become an enabler of capability.” Firms that can demonstrate auditability, robust testing, clear permissions and effective escalation will deploy AI with confidence. Those that cannot will move more slowly or expose customers and markets to greater risk.
As he stressed, keeping a human in the loop is not enough on its own. Firms must be clear what that person is expected to do, what information they receive and when they can intervene. This unsolved challenge is a big reason so few AI models reach production – by some estimates, only 5% make it out of the pilot stage.
Where I part company with Mills is on where that governance should sit. He suggests that managing AI-enabled systems will operate “continuously alongside the systems it [AI] is designed to control”. That holds for banks that have layered AI on top of legacy infrastructure, where the seams between policy, model development, decision execution and monitoring create control gaps that compound in a multi-model, agentic environment.
But AI is increasingly becoming the operating system. When decisioning is built API-first, with governance by design, policy can be codified into the system itself. Each decision references the policy behind it, human judgement goes on the record, and outcome monitoring runs inside production rather than beside it.
Governing the reasoning, not just the output
Agentic systems add a subtler problem. As Sean Baseman, FICO’s chief architect, puts it, governance applied only to outputs can make things worse: “A confident wrong answer gets caught. A governed, hedged, half-right one survives review.” The hallucination doesn’t disappear; it gets quieter.
The fix is governance that acts earlier, on the reasoning path itself. That starts with models built on carefully curated data, where bias is mitigated and decisions are auditable from the outset, rather than constraints bolted on afterwards.
A leader at a major UK high-street bank told me recently that 20-30% of his time is lost every month on a problem that results from having the governance sit outside the decisioning system. When they get a complaint, often related to how an edge case exceeded thresholds, they have the output (the decision), but have to reconstruct the reasoning to identify why that decisions was taken. This can be solved when the governance is built into the decisioning system itself.
Agents on both sides of the transaction
Mills expects many consumer journeys to begin with an AI agent by 2030. His own research found one in five UK adults already open to AI making decisions on their behalf. For every consumer agent seeking an outcome, there will be a bank agent on the other side.
That erodes the traditional moats of retail banking. Agents have no brand loyalty or inertia, and UK current account switching is already up 43% year on year. The question for every CEO becomes what it takes for an agent to prefer your bank. The answer is decisioning that can evaluate a request against live customer data and return a personalised, policy-compliant decision in milliseconds.
Financial crime is the darker side of the same shift. Mills warns AI will make attacks “faster, cheaper, more scalable and more persuasive”. Banks running fragmented point solutions will spot patterns only once exposures have scaled. Centralised decisioning across the whole customer base, reinforced by intelligence shared through industry consortia, gives a far better chance of keeping pace.
The C-suite is already moving
The banks furthest ahead already understand this. Georges Elhedery at HSBC is moving from shared ownership of KPIs to individual executive accountability. Jane Fraser has restructured Citi to shorten the distance between decision and accountability, and is redesigning processes around AI rather than using it to automate old ones. Ana Botín has committed Santander to more than €1bn a year in business value from data and AI.
Each is trying to collapse the gap between where strategy is set and where decisions are executed. As Mills puts it, AI-enabled transformation “will support growth only if firms can deploy systems that remain controlled, accountable and resilient”.
Banks that build governance into their decisioning, cascading KPIs and policy down the organisation with real-time visibility of outcomes, will close the control gaps that siloed operating models leave behind. In the agentic era, that is what will separate the winners from the rest.
