The UK’s financial watchdog has issued a warning that regulation is heading into an “arms race” as artificial intelligence becomes less of a novelty and more of the infrastructure behind everyday financial decisions.
In remarks attributed to the Financial Conduct Authority, the FCA’s concern is not simply that firms are using AI, but that the pace of adoption is outstripping the traditional rhythm of supervision. When models are updated frequently, when decision-making is distributed across multiple systems, and when customer-facing tools increasingly shape how people save, borrow, invest, or manage risk, regulators can no longer rely on periodic reviews and static documentation alone. The regulator’s challenge is to keep up with a moving target—one that can change its behaviour after deployment, sometimes in ways that are difficult to observe from the outside.
The warning lands at a moment when AI-enabled tools are becoming mainstream in personal finance. Millions of consumers now interact with technology that uses machine learning to personalise offers, assess affordability, detect fraud, recommend products, or guide budgeting decisions. Even when the user experience looks simple—an app suggesting a better deal, a chatbot answering questions, a platform flagging spending patterns—the underlying logic may be complex, probabilistic, and continuously refined. That complexity creates a new kind of regulatory problem: not only whether AI is being used, but how it is being governed once it is live.
What makes the FCA’s framing particularly striking is the emphasis on oversight capacity. The regulator is effectively arguing that the supervisory toolkit must evolve at the same speed as the technology. Otherwise, the system risks falling into a cycle where firms innovate faster than regulators can evaluate, and regulators respond only after harm has occurred—or after the market has already normalised practices that were never properly tested.
An “arms race” is a useful metaphor because it implies both sides are escalating. Firms deploy more sophisticated models, integrate them into more parts of the customer journey, and automate more decisions. Regulators, meanwhile, must develop new methods for testing, monitoring, and enforcing standards. If the regulator’s powers and resources do not expand, the imbalance grows. In that scenario, supervision becomes reactive rather than preventive, and the public interest is left to catch up with commercial momentum.
The FCA’s call for greater authority reflects a belief that the current framework may not be sufficient for the realities of AI in financial services. The argument is not that regulation should be looser; it is that it needs to be stronger and more agile. Stronger powers would allow the FCA to intervene earlier, demand clearer evidence of model performance and controls, and require firms to demonstrate that their AI systems remain safe and fair over time—not just at launch.
This is where the debate shifts from “AI risk” in the abstract to the practical mechanics of accountability. Traditional compliance often focuses on what a firm says it will do. AI compliance, by contrast, must grapple with what the system actually does under different conditions. Models can behave differently across customer segments, across time, and across changing economic environments. They can also be influenced by data quality issues, feedback loops, and operational changes that occur long after the initial build. A model that performs acceptably in one period may degrade in another if the world changes or if the data distribution drifts.
For consumers, these technical details can translate into very human outcomes: someone may be offered a product they cannot afford, denied credit without a clear explanation, steered toward higher-cost options, or exposed to marketing that is overly aggressive or insufficiently tailored. Even when no single decision is “wrong,” the cumulative effect of thousands or millions of automated choices can create systemic bias or unfairness. That is why the FCA’s concern about monitoring is central. Oversight must extend beyond documentation to ongoing assurance.
One reason AI supervision is so difficult is that AI systems are often embedded in workflows rather than standing alone. A customer might apply for credit through an interface that appears straightforward, but behind the scenes the decision could involve multiple models: identity checks, fraud scoring, affordability estimation, behavioural risk assessment, and pricing or offer selection. Each component may have its own assumptions and failure modes. A weakness in one part can cascade into the final outcome. Regulators therefore face a layered problem: they need visibility into the whole system, not just individual components.
Another challenge is explainability. In many cases, AI models—especially those based on complex machine learning techniques—do not produce neat, human-readable reasons for a decision. Yet financial services are built on the expectation that customers can understand key aspects of how decisions are made, and that firms can justify their actions to regulators. The FCA’s warning implicitly points to a gap between what regulators need to verify and what firms can easily provide. If the regulator’s powers are limited, firms may be able to comply with minimum requirements while still leaving regulators with insufficient insight into how models operate in practice.
This is where the “arms race” becomes more than a metaphor. If regulators lack the ability to demand deeper technical evidence, to test systems directly, or to require rapid remediation when issues emerge, then the market will naturally gravitate toward strategies that minimise scrutiny. Firms may invest in compliance theatre—producing reports that look robust but do not fully capture real-world behaviour. The result is a regulatory environment where the most important question—whether AI is safe and fair in operation—remains underanswered.
The FCA’s position also reflects a broader shift in how regulators view technology. For years, financial regulation has dealt with digital transformation, cybersecurity, outsourcing, and operational resilience. AI adds a new dimension: it can change decision-making patterns without a corresponding change in the user interface. It can also introduce uncertainty into outcomes that previously depended on deterministic rules. That means operational resilience is not only about system uptime; it is about decision integrity.
Decision integrity includes questions such as: How often are models retrained? What triggers updates? Are there guardrails to prevent harmful outputs? How are errors detected and corrected? What happens when the model encounters new types of customers or new economic conditions? How are third-party components managed? And crucially, who is accountable when something goes wrong—the model developer, the deploying firm, the vendor, or the internal team that approved the rollout?
The FCA’s call for greater powers can be read as an attempt to ensure that accountability is enforceable rather than merely contractual. In AI supply chains, responsibility can become diffuse. A firm may rely on a vendor’s model, a cloud provider’s infrastructure, and internal teams to integrate and monitor. If the regulator cannot compel meaningful information sharing or impose timely corrective actions, the chain of accountability can become too weak to protect consumers.
There is also a timing issue. AI systems can be updated quickly, sometimes through continuous improvement cycles. If regulatory processes are slow, firms may deploy changes before regulators can assess them. That creates a structural risk: the regulator is always behind. Stronger powers could enable more proactive supervision, including requirements for pre-deployment testing, ongoing performance reporting, and the ability to intervene when monitoring indicates drift or emerging harm.
But the FCA’s warning is not only about enforcement. It is also about the design of oversight itself. Keeping up with AI requires new supervisory methods. Regulators may need to develop technical expertise, establish testing frameworks, and coordinate with other authorities. They may also need to work with industry to define standards for model governance, documentation, and monitoring. Without that, the regulator’s role becomes purely punitive—reacting after failures rather than preventing them.
A unique angle in this debate is that AI in financial services is not just a risk; it is also a potential benefit. Better fraud detection can reduce losses and protect customers. Personalisation can help people find suitable products. Automation can improve accessibility and responsiveness. The challenge is ensuring that benefits do not come at the cost of fairness, transparency, and consumer protection.
That is why the FCA’s “arms race” framing matters. If regulators are forced into a constant chase, the system may end up prioritising speed over safety. Firms might optimise for performance metrics that are easy to measure—accuracy, conversion rates, or reduced default rates—while underweighting harder-to-quantify harms such as discrimination, explainability gaps, or the long-term effects of steering. Regulators, in turn, may struggle to evaluate these trade-offs without the authority and tools to do so.
The FCA’s warning also highlights a tension between innovation and oversight. Financial services are heavily regulated for good reason: mistakes can scale quickly, and the consequences can be severe. AI can accelerate scaling. A flawed model can affect millions of customers faster than a manual process ever could. That makes the cost of regulatory lag higher than it used to be.
In practice, the FCA’s concerns likely translate into expectations around three broad areas: governance, monitoring, and accountability.
Governance means firms must have clear ownership of AI systems, documented risk assessments, and controls that reflect the model’s purpose. It also means understanding the data used to train models, the assumptions embedded in them, and the limitations of the approach. Governance is not a one-time checklist; it is a living process that should evolve as the model evolves.
Monitoring means firms must track performance and behaviour after deployment. This includes detecting drift, monitoring outcomes across segments, and ensuring that the system remains within acceptable risk boundaries. Monitoring also requires mechanisms for escalation—what happens when metrics deteriorate or when anomalies appear.
Accountability means firms must be able to explain and justify their decisions to both customers and regulators. It also means that when problems occur, there must be a clear path to remediation and, where necessary, enforcement. Accountability is the bridge between technical systems and legal obligations.
The FCA’s push for greater powers can be seen as an attempt to strengthen each of these pillars. With stronger authority, the regulator can require more rigorous evidence, demand more frequent reporting, and impose faster corrective action. It can also reduce the incentive for firms to treat AI governance as a box-ticking exercise.
There is another subtle but important point: the FCA’s warning suggests that the regulator is thinking not only about AI models but about the broader ecosystem of AI use. Many financial services firms are experimenting with AI across