The Rise of AI in UK Financial Services: FCA and PRA Strategy, Risks and Regulation

There are several benefits to the use of AI by financial services firms.

These include:

• Making markets more accessible and making it easier for firms to offer services tailored to customer needs, thus improving the customer experience;
• Improving efficiency, enhancing risk management controls and increasing revenue generation and profitability;
• Helping analyse complex cases more accurately; and
• Processing and analysing large volumes of data and detecting patterns in biometric data, etc. to identify cases of fraud or money laundering more accurately.

In March 2023, the government prepared a white paper setting out a proposed framework for regulating AI in the UK, which was intended to be “proportionate and pro-innovation” and outlined five cross-sectoral principles the regulators must implement to help ensure the safe, responsible and innovative use of AI. These include:

1. Safety, security and robustness
2. Appropriate transparency and explainability
3. Fairness
4. Accountability and governance
5. Contestability and redress

In alignment with the above, there is no specific AI regulation yet (although it is acknowledged that this will be necessary in the future) and following a review by the regulators in DP5/22, the regulators confirmed that the existing financial services regulatory regime is currently aligned with the government’s principles to support the safe use of AI in the Financial Services Sector.

The main regulations that FS firms using AI will need to consider include:

• FCA Handbook – Principle 2 (Skill, Care and Diligence), Principle 3 (Management and Control, Principle 6 (Customer’s Interests) and Principle 12 (Consumer Duty – acting to deliver good outcomes)
• Senior Managers and Certification Regime (SMCR), requiring firms to ensure clear accountability for AI systems and their risks under SMCR and requiring Senior Managers to oversee governance and controls around AI
• SYSC Rules (Senior Management Arrangements, Systems and Controls) requiring firms to have effective systems and controls in place with regards to AI
• FCA/PRA rules on Operational Resilience (PS21/3) which require AI systems to be mapped, properly managed and tested for resilience under disruption scenarios
• UK GDPR, in particular, Article 22 (in relation to automated decision-making and profiling) and requirements for transparency and lawful basis for data processing
• Consumer protection regulations, including Treating Customers Fairly

The FCA has created the AI Lab to provide a pathway for the FCA and financial services firms to engage in AI-related insights and to support innovators as they develop new AI models and solutions.

It is hoped that the AI Lab will support the FCA in furthering its understanding of the risks and opportunities the AI presents to UK consumers and markets and inform its regulatory approach.

The FCA lab currently includes:

1. AI Spotlight, which is intended to provide insight into how financial services firms are experimenting with AI;
2. AI Sprint, an event intended to help inform the FCA’s regulatory approach to AI and how it can create the right environment for growth innovation; and
3. AI Input Zone, which enabled stakeholders to have their say on the future of AI in UK financial services through an online feedback platform.