Agents of change: the FCA builds an AI supervisory roadmap as the SEC flags "super intelligence" risk

Financial regulators on both sides of the Atlantic set out their thinking on AI in the same week. The Financial Conduct Authority used a 19 October speech to lay out a supervisory roadmap for AI in UK retail and wholesale finance, including plans for an "agentic finance" framework. Four days later, the SEC's Division of Examinations published its Fiscal Year 2027 examination priorities, using President Trump's preferred term for AI: "super intelligence" and treating it as an emerging risk across broker-dealers, advisers, exchanges and clearing agencies. Both regulators say existing obligations must now be read through an AI lens, and the FCA goes further with AI-specific policy.

The FCA: from review to roadmap

Jessica Rusu, the FCA's chief data, information and intelligence officer, delivered an AI speech at Bloomberg's UK Policy Series with adoption as her starting point: a joint FCA and Bank of England survey finding that 86% of firms now use AI. The roadmap builds on the Mills Review, the FCA Board-commissioned review into AI's long-term impact on retail financial services, published in July. The FCA says it is embedding six of the review's seven priority recommendations into live work rather than further consultation: securing and adapting the regulatory perimeter; strengthening system-wide coordination and oversight; monitoring the move to autonomous models and adapting regulatory frameworks; scaling up the FCA's AI Lab; laying the foundations for agentic finance; and building an AI-enabled agentic supervisory model. Rather than create the seventh, a public-interest AI-enabled financial capability service, the FCA will build on existing work, including IOSCO's first TechSprint. Alongside the speech, the FCA published examples of good and poor practice from its own firm testing, grouped under three themes:

• Consumer outcomes: poor practice includes excluding vulnerable customers from AI-driven processes and overstating what a tool can deliver. "AI should improve consumer outcomes, not simply automate existing processes," Rusu said.

• Accountability and governance: firms need defined ownership, human oversight and escalation triggers, with senior managers personally accountable. The FCA was critical of firms that bolt on governance after deployment. "That is the wrong way around," Rusu said.

• Operational resilience: firms should stress-test AI systems, maintain fallback options and avoid over-reliance on a single model or vendor.

The FCA was explicit that it does not intend to expand its jurisdiction to capture general-purpose AI providers. Instead, as Rusu put it, "our answer is not simply to expand our remit, but to make the existing boundary clearer." The FCA is calling on providers of general-purpose large language models to add clear, consistent disclaimers at the point consumers receive financial information, after finding that only 40% of consumers realise they have no route to redress if that information turns out to be wrong. Disclaimers may not work if consumers skip them, or if they use AI tools in ways that never display them.

Agentic finance and an agentic regulator

The more structural shift is the FCA's framing of "agentic finance": AI systems moving from advising consumers to acting for them, searching for products, managing payments and transacting directly with other agents.

The FCA wants firms to report significant AI failures and near-misses, and says agentic systems need "continuous, conditional assurance" rather than one-off sign-off at deployment, since a system judged safe on day one can behave differently later. It plans to work with industry, other regulators and frontier AI labs on a framework covering agent identity, delegated authority, accountability and execution, with no date yet attached.

The FCA is also turning the technology on itself. It is building supervisory tools ahead of roughly 60,000 anti-money laundering firms entering its scope of supervision in 2028, including a "market first responder" agent for around 9,000 small wholesale transaction reporting firms. Its Handbook API, launched in August, already gives firms machine-readable access to FCA rules; the regulator is now extending that machine-readability to its own data collection. The announcement follows the FCA's broader push on the UK's cryptoasset perimeter, on which it is separately consulting.

The SEC: AI by another name

Where the FCA built a standalone narrative around AI, the SEC's approach is quieter: AI appears throughout its FY2027 exam priorities as a cross-cutting theme. The Division of Examinations notes that registrants increasingly use what the agency terms "super intelligence" (SI) in research, drafting, trading, advisory work, client communications and compliance monitoring, and says examiners will test whether firms still meet their existing, technology-neutral obligations regardless of the tooling behind them. Examiners will focus on SI-related risks in:

• cybersecurity, given threat actors' use of SI to generate phishing messages and deepfake audio or video in social engineering attacks;

• automated investment tools and trading algorithms, tested for whether a firm's representations about its AI match what the tool actually does, and whether its outputs align with disclosed strategies and client profiles; and

• Regulation S-ID identity theft prevention programs, which the SEC expects firms to update for SI-related risks to stolen credentials.

Examinations under Regulation SCI, which covers the core technology systems of exchanges, clearing agencies and other market infrastructure, will focus on emerging trends including tokenisation, quantum computing and SI, though the document gives these far less detail than the AI sections. Tokenisation also appears as a high-risk area for clearing agency examinations. The SEC did not set separate examination priorities for crypto assets, stablecoins or decentralised finance in this document, despite continued rulemaking in that space, including its proposed crypto custody framework for advisers and funds. The exam priorities sit alongside the SEC's own internal "Super Intelligence" programme, led by a Chief SI Officer appointed in 2025 to oversee the agency's own AI adoption and governance.

What now?

Firms operating in UK retail or wholesale financial services, or registered with the SEC as broker-dealers, investment advisers or clearing agencies in the US, should:

• map where AI already sits in advice, trading, compliance monitoring and client-facing functions, including tools procured from third parties rather than built in-house;

• assign clear internal ownership and escalation paths for AI-driven decisions, and document that oversight before deployment rather than after;

• review marketing and client-facing statements about AI capabilities against what the tools can demonstrate, particularly for automated advice or trading tools subject to SEC examination;

• update identity theft prevention and cybersecurity programs to address AI-enabled social engineering and credential theft; and

• watch for the FCA's agentic finance framework and the FCA/Bank of England AI adoption survey, both likely to shape UK supervisory expectations well before any formal rule change.

The two regulators are converging on substance while diverging sharply on form. The FCA has built a dedicated, public AI supervisory narrative, though without the codified rules the EU has adopted under the AI Act. The SEC, by contrast, is folding AI into its existing examination architecture without a parallel AI-specific regime, closer to the posture some other countries have taken, including Australia, where ASIC relies on the existing Corporations Act framework.

In a year or two, we may be asking our own AI agents which approach held up better: a dedicated agentic finance framework, or technology-neutral examination.

By Michael Bacina