The Mills Review: what retail banks need to mobilise now

A customer deciding what to do with a maturing savings pot, an ISA allowance, or a mortgage renewal doesn't necessarily open a banking app first anymore. Increasingly, they ask a generative AI tool for rate comparisons, savings nudges, mortgage pricing tailored to their circumstances. This isn't a 2030 scenario, it's already shaping decisions banks have no visibility into today.

Part of what's driving this is simple convenience. The old model put the effort on the consumer: read a comparison site, search a best-buy table, or manually search savings or mortgage rates. AI inverts that, pushing an answer and increasingly a recommendation, with almost no effort. That convenience is building trust faster than most firms' planning assumes. The bank that isn't part of that conversation isn't losing a sale. It's no longer in the market for that decision at all.

That's the precondition for everything that follows. Governance and accountability only matter if there's still a customer relationship and a product book to govern, which is the real gap the Mills Review, published by the FCA in July 2026, is pointing at, even though it's written for the regulator, not the firm.

What the Review says, and where it stops

Led by Sheldon Mills at the FCA Board's request, the Review sets out how AI could reshape retail financial services by 2030, drawing on over 140 submissions and a 5,000-person consumer survey. It maps the change across four shifts: 1) firm operations, 2) consumer journeys, 3) competition and market power, and 4) financial crime and cyber risk. It is underpinned by a five-level "autonomy spectrum" running from AI as a tool a human operates through to AI initiating decisions with a human simply monitoring for drift.

It's a strong diagnosis. It's also not a contested one; every bank already believes AI will reshape retail financial services this decade, but the question is how? The Review says the existing framework, SM&CR, Consumer Duty, model risk management under SS1/23, remains "broadly sound" but may come under strain as autonomy increases. That's a more debatable claim than it's given credit for: a regime built for a human decision-maker at every step doesn't bend. The Review names that tension and makes seven recommendations, all addressed to the FCA Board, none aimed at a Retail Bank. The Review is clear that enabling competition and AI-driven innovation across the industry is part of the goal, but doing that through the existing framework, rather than new rules, leaves open exactly how a regime built to slow decisions down is meant to speed innovation up.

How does retail banking move at pace this time?

The sharper question for a bank isn't which of the four shifts matters most, it's whether the industry can move at pace, whilst maintaining consistency. The precedent isn't encouraging: open banking was mandated in 2018 and it still took the better part of a decade to move from regulatory requirement to everyday consumer behaviour. AI won't grant that runway. So against the same four shifts, the real internal test is less what to change than how to change it fast, and in a coordinated way across the bank to gain a competitive edge, starting now rather than waiting for the FCA Board to work through its own list first.

AI influencing change is already visible across the domain. In the customer journey, using AI tools to identify rate comparisons, savings nudges and personalised mortgage pricing, are increasingly being used with customers looking to receive instant recommendations, impacting the contest for the customer’s first financial decision: The Mills Review helps to reframe what AGBR is really about | Baringa. In operations, contact centres already show the autonomy spectrum in action, moving from AI-assisted service toward AI-led resolution with human oversight. And in financial crime, the risk is the widening gap between attacker and defender autonomy: criminals already operate at the high end of the spectrum while most firms’ defences sit at the low end: The Mills Review and financial crime: mind the autonomy gap | Baringa. The through-line is speed: the faster banks can realise the efficiencies through AI e.g. lower cost-to-serve, the greater this capacity can be repivoted to drive future growth.

There is a high correlation between Retail Banks moving at pace and partnering with frontier models like OpenAI's and Anthropic, or cloud hyperscalers, for example Natwest & Open AI, Barclays & Microsoft. But a dichotomy is emerging. Pace and sovereignty pull against each other: feed those partners your golden asset, customer data, you risk the provider becoming a competitor for the same decision, or a dependency too deep to unwind. The discipline is to partner for speed while keeping ownership of the data, the customer relationship, and the flexibility to switch.

Six conditions to work through now

Getting to the position above, didn’t wait for the FCA, and the Review is explicit it isn't proposing any yet. That's not licence to wait; it's licence to move before the rulebook forces a slower, more defensive version of the same change.

1. Product ownership of AI autonomy in the customer journey. How much an AI recommends versus decides in a savings nudge, a pricing offer, or a mortgage renewal journey is often set today by whoever built the model, not by the product owner accountable for the relationship and the outcome. Map each major customer journey against the autonomy spectrum, agree explicitly what the AI may recommend versus decide, and route that as a standing product decision into Consumer Duty and pricing governance, not a technology configuration nobody in product signed off.
   
   
2. Accountability under SM&CR when an AI system, operating inside a delegated mandate, makes the call. SM&CR assumes a named human took the decision; once an AI initiates it within a delegated mandate, "reasonable steps" becomes hard to evidence unless defined up front. Extend existing SMF accountability statements now, naming who owns each material AI-assisted decision type (fraud, KYC, pricing, collections), via the next Model Risk Committee.
   
   
3. A Consumer Duty test that works for systems that adapt their own behaviour in production. Quarterly sampling assumes a static journey; a system that adjusts weekly can pass Monday's test and fail Thursday's for reasons the sample never catches. Replace it with standing outcomes-monitoring, reported weekly, not annually.
   
   
4. Model risk management that treats continuous retraining as the default. SS1/23 assumes scheduled revalidation; a model that retrains itself can drift between checks while the dashboard still looks clean. Extend the SS1/23-aligned framework, funded from the existing model risk budget, to set drift-monitoring thresholds with automatic escalation.
   
   
5. A controlled environment to test higher autonomy safely. Without a sanctioned way to test it, the rational move is to sit at the bottom of the spectrum and let a competitor take the risk of going first, ceding the twelve-month window to whoever doesn't wait. Stand up a ring-fenced 90-day sandbox for one customer journey or one financial crime control, with a fixed budget, named executive sponsor, and exit criteria to drive innovation internally in a controlled environment.
   
   
6. A view on concentration risk in the AI supply chain. If much of the sector delegates decisions to the same handful of providers, that's systemic risk sitting inside a technology stack, and nobody currently owns it. Commission a supply-chain mapping exercise, owned by operational resilience or third-party risk, reported to the Board Risk Committee.

What to put on the board agenda

The Review is right and large scale changes are coming and already happening. The harder question is sequencing: what has to move first, who owns moving it, and what it costs to lead rather than follow:

1. Where does our AI autonomy actually sit today, across service, financial crime and customer-facing journeys, if we can't answer that clearly, we've already made the default choice, we just haven't admitted it.
2. If a customer's first financial decision increasingly happens inside someone else's AI, what's the plan to be part of that moment, not to pick up the relationship afterwards?
3. Do we have twelve months, or five years, to get this right, and does our current investment portfolio reflect the answer we just gave?

Contact us to explore what the Mills Review means for your Retail Banking, AI and technology strategy.