Nobody in UK financial services seriously doubts that AI is changing things. The question that has been hanging in the air for the last couple of years is whether the regulator is keeping pace, or whether it is watching from a comfortable distance and hoping the existing rulebook holds.
On 27 January 2026, the FCA gave its clearest answer yet. Sheldon Mills, Executive Director for Consumers and Competition, launched what has quickly become known as the Mills Review: a strategic call for evidence into how advanced AI will reshape retail financial services by 2030 and beyond. What the FCA is doing, openly and on the record, is asking whether the current rulebook holds up at all.
For mortgage firms, that question is worth taking seriously.
What the Mills Review actually is
There is a temptation to file anything labelled a “call for input” as background noise. This one is different. The Mills Review was commissioned by the FCA Board, not a department, and Sheldon Mills is reporting directly back to the Board in summer 2026. The external publication that follows will inform future policy direction. Law firms, trade bodies, building societies, and banks have already submitted responses. If you have not engaged with the process yet, you have missed the formal window, but the implications are only just beginning to land.
The scope is retail financial services: consumers, retail markets, and the firms that serve them. Wholesale markets and broad societal questions about AI are explicitly out of scope, though the Review acknowledges that what happens upstream eventually reaches the retail customer. Mortgage brokers, lenders, networks, and advice firms sit squarely within the perimeter this Review is examining.
What Mills is really asking is whether Consumer Duty, SM&CR, operational resilience requirements, and the Critical Third Parties regime, taken together, are flexible and robust enough to manage the AI-enabled firm of 2030. The honest answer from most of the commentary I have read is: probably yes, but only if firms and supervisors apply them with real rigour to AI systems rather than treating technology as a special case where normal accountability does not quite reach.
The four things the Review is probing
The Mills Review organises itself around four interconnected themes, and each of them has a direct read-across to mortgage distribution and lending.
The first is the technology itself. The Review is not really about the AI that already exists inside fraud detection or credit scoring models. It is focused on generative and agentic AI, systems that can produce outputs and take actions without being specifically programmed for each task. The FCA acknowledges that these systems are qualitatively different from traditional machine learning, and that the risk profile changes significantly as they become more autonomous and interconnected.
The second theme is market structure. One of the more interesting questions the Review raises is whether AI creates new types of gatekeeper. If a platform or Big Tech player sits between a consumer and a mortgage firm, and routes that consumer to products using its own AI, who exactly is acting as the regulated intermediary? The current regulatory perimeter was drawn for a world where distribution meant a broker, a lender, and a network. That world is shifting.
Third is consumer impact. The Review sees genuine opportunity in personalisation, better value, and frictionless journeys. It also names the risks with unusual directness: bias and discrimination in automated decisions, hallucinations in AI-powered chatbots, reduced consumer agency as people increasingly rely on AI agents they do not fully understand, and the particular vulnerability of people who are already in difficult circumstances. For any firm using AI in client-facing journeys, that list is a compliance checklist waiting to happen.
Fourth is the regulator itself. One of the more candid threads running through the Mills Review is the FCA’s acknowledgement that it needs to modernise its own supervisory capability. Greater use of AI within the FCA for data-driven monitoring is explicitly on the table. Put simply, the regulator is preparing to supervise with AI. Firms that have been relying on limited supervisory bandwidth to paper over AI governance gaps should factor that into their planning.
No new rules, but the bar is rising
The FCA has been clear that it is not planning AI-specific regulation at this stage. It wants to use the existing principles-based framework, Consumer Duty, SM&CR, SYSC, to manage AI risk. Some commentators, including the Treasury Select Committee, have argued that this is not enough without clearer articulation of how those rules apply to AI systems in practice.
That tension will resolve itself over time, and not necessarily through a new rulebook. Supervisory expectations have a way of crystallising through enforcement action, portfolio letters, and Dear CEO letters long before formal rules are written. The Mills Review, by putting specific risks on the record, effectively sets a marker. Firms that have not thought seriously about AI governance will find it harder to argue ignorance when those expectations are tested.
For mortgage firms specifically, the practical implications cluster around a few areas. SM&CR accountability needs to extend clearly to AI systems and their outcomes, not just to the humans nominally in charge. Boards need demonstrable oversight of AI risk, and not just at the level of “we have a policy”. If a consumer is given unsuitable information by an AI chatbot, or a lending decision is influenced by a biased model, someone with a Senior Management Function needs to be able to explain what oversight existed and why it failed.
Explainability matters too. The emerging expectation in practitioner commentary is that firms should be able to reconstruct AI-driven decisions and explain their key logic within short timeframes. Model documentation, validation, ongoing monitoring and bias testing are being treated as baseline requirements, not aspirational good practice. Consumer Duty makes this more urgent still: AI-mediated journeys need to demonstrate good outcomes in the same way human-mediated ones do, and the documentation burden does not go away because a machine made the decision.
What is actually at stake for mortgage distribution
The most interesting long-term question for mortgage distribution is not about compliance. It is about where the regulated interface sits as AI becomes more embedded in consumer journeys.
If a consumer uses an AI personal finance agent to research mortgages, narrows their options, and arrives at a broker having already received something that looks a lot like advice from an unregulated tool, the broker’s Consumer Duty obligations do not disappear. They arguably become more complicated. The same question applies if a network’s CRM uses AI to triage leads, prioritise customers, or suggest products. The humans in the chain remain accountable, but the decisions being made upstream of those humans are increasingly automated.
The Mills Review does not resolve this. It raises it, which is the point of a call for evidence. But the direction of travel is visible enough: the FCA will expect firms to understand what their AI systems are doing, document why they were designed that way, demonstrate ongoing oversight, and show that consumers are getting genuinely good outcomes from automated processes, not just acceptable-looking ones.
The firms that will be best placed in the post-Mills environment are the ones that treat AI governance as a core business function rather than a compliance annexe. That means real accountability at senior level, documented and explainable models, integration of AI risk into operational resilience frameworks, and Consumer Duty applied consistently across human and automated touchpoints alike.
The regulator is not asking for perfection. It is asking for defensibility. Those are different things, but only one of them is achievable.
Paul Brett is the founder of BTS Consult and Coach and co-founder of mortgagelab.ai. He has held Managing Director roles at Landbay and Masthaven and has over 38 years of experience in UK mortgage lending and distribution.
Source: FCA Mills Review — Review into the long-term impact of AI on retail financial services
