The Mills Review and agentic finance: who governs the AI that arrives?

Most firms spent years learning to govern the AI we build. The Mills Review points at the harder question: who governs the AI that arrives?

Our earlier pieces on the Review looked outward: at who owns the consumer's first financial decision, at the autonomy gap opening between attackers and defenders in financial crime, and at what retail banks need to mobilise now.

This one turns around and looks at your own front door.

Mills names four shifts in how AI reshapes retail finance. The quiet one, buried inside 'how firms operate', is this. As consumers hand more to AI, the thing logging into your systems stops being the customer. It becomes their agent, comparing, negotiating, initiating and acting on their behalf. Around one in five UK adults are already open to AI making financial decisions for them, and that share only moves one way.

Here's the awkward part. Everything you've built to govern AI points inward, at the models and copilots you deploy. An agent knocking at your boundary is something you didn't build, can't fully see, and may still answer for. Your inventory, your controls, your review gates, all of them face the wrong way.

Recommendation 5 asks the FCA to enable the foundations for agentic finance, a trusted framework for how agents are authorised, identified and held accountable, routed through Open Finance. That's the right ambition, and it's being built. It also won't arrive tomorrow. The question is what you do at your own boundary while you wait.

We'd start with three moves, and none of them need a new rule to begin:

1. Identify the agent. Know which agent is calling, on whose behalf, and with what mandate.
2. Constrain the mandate. Rate-limit, scope and contain what an external agent is allowed to do.
3. Attribute the action. Log every step, so you can show who did what, and when.

None of this is a compliance exercise. The Consumer Duty, the Senior Managers Regime and operational resilience all hold, but every one of them gets tested as delegation grows. So the honest task isn't to wait for guidance. It's to decide now who owns agent access, agent-enabled outcomes and customer redress, before an incident decides for you.

The prize isn't to keep agents out. It's to let the right ones in safely, and to make your firm easy for a trusted agent to deal with. The firms that come through this next phase best won't be the ones running the most agents. They'll be the ones a customer's AI learns it can rely on.

Contact our experts to explore what governing the agent boundary means for your firm.