Every customer message needs a record. Every decision needs a name.
Banks, lenders and payments firms already use AI in customer letters, complaints and fraud checks. The Financial Conduct Authority (FCA) is not writing a separate AI rule book. It expects you to meet the duties you already have, and to show the evidence.
of UK financial firms use AI; the median firm runs nine use cases
Bank of England and FCA survey, 2024only partly understand the AI they use
Bank of England and FCA survey, 2024AI use cases are built by a third party
Bank of England and FCA survey, 2024No new rule book. The same duties, now applied to AI.
The FCA has said it will rely on existing rules, chiefly the Consumer Duty (the duty to deliver good outcomes for retail customers) and the Senior Managers and Certification Regime (named people answer for their area). It plans to share examples of good and poor AI practice later in 2026. The Mills Review (6 July 2026) judged that framework sound but asked for clearer guidance. The Treasury Committee (January 2026) asked the FCA for practical guidance by the end of 2026. For banks and building societies, the Prudential Regulation Authority (PRA) expects model risk to be managed under its supervisory statement SS1/23, and has discussed AI under it with firms.
Summarised from FCA, HM Treasury, Treasury Committee and PRA publications. This supports compliance; it is not legal advice.
Six problems that keep coming back.
Each of these comes from the regulator's own expectations or from public surveys. None needs a new rule to become a finding.
Half of financial firms only partly understand what they run, and a third of use cases come from suppliers. A regulator's first question is a list. Most firms cannot give one in a day.
Collections, arrears and complaint letters now draft faster than anyone reads them. Fair treatment of customers in vulnerable circumstances must be shown, not assumed.
A final response is due within eight weeks. AI that triages or drafts complaints speeds the work, but a missed theme or a wrong category is still your breach.
Under the Senior Managers regime a named person answers for each area. When AI sits across several teams, no one can say who owns the outcome.
Customer data in a public chatbot is a data protection problem and a conduct problem. A policy alone does not stop it.
Core systems, fraud tools and call platforms now ship AI features. They need an owner, a data record and a review, like any outsourced service.
Without a record, you answer the regulator from memory.
A supervisory review, a complaint that reaches the Financial Ombudsman, or a customer's data request all arrive on someone else's timetable. If the answer to 'which AI touched this customer, and who checked it?' takes weeks to assemble, the cost is staff time, senior manager exposure and a harder conversation than the facts deserve. Boards also lose the ability to say yes to new AI use with confidence.
The regulator is asking for evidence, not new policy.
Because the FCA is applying existing rules, writing another AI policy does not close the gap. What closes it is a live list of use cases, rules that act when data is about to move, a named owner for each, and a record that shows the check happened. That is a control, and it can be built around the AI you already run.
- Collections and arrears communications
- Complaints handling and triage
- Know-your-customer onboarding and fraud checks
- Credit and affordability analysis (decision support only, people decide)
- Automated outcomes with no documented human check
- Customer data in unmanaged tools
- Third-party AI features nobody has assessed
GenWA keeps a register of AI use cases with an owner and a data classification. Guard rules name where AI must not decide, and Evidence keeps the record of checks and sign-off. Controls apply to connected, routed tools; the audit shows what else is in use.
Four agents, trained for this sector.
The rules, as controls.
- FCA Consumer Duty
- Senior Managers and Certification Regime
- FCA complaints rules (DISP) and consumer credit rules (CONC)
- PRA SS1/23 model risk (banks and building societies)
- Money Laundering Regulations 2017
- UK GDPR and the Data (Use and Access) Act 2025
Advice, product, incubator and accelerator, for a regulated firm.
Pick the route that matches your authorisation, your size and your appetite. Consequential actions stay with a named person on every route.
An independent AI audit with first findings in 48 hours, then a 90-day plan written for your senior managers and board.
Start the health checkAdvice: policy and controlsPolicy, controls and training that fit a regulated entity: who answers for what, written against Consumer Duty and Senior Managers duties.
See advisoryProduct: control toolkitGuard and Evidence on the AI you run: register, rules, log and evidence packs, hosted in your AWS or Azure account, or GenWA AWS as agreed.
Find the right productProduct: agents at workCollections letters, complaints triage and adviser assist, each with a named owner, a rule set and a record.
Meet the teamIncubator: one function, twelve weeksWe define, build and run one controlled function, such as complaints triage. You keep the intellectual property, prompts and record.
See the incubatorAccelerator: for founder-led fintechsBy application only, ten places a year. Senior AI leadership time, advisory and platform access, paid for by equity, project, retainer or licence, with controls from day one.
See the acceleratorWhat Guard and Evidence typically hold for this sector.
Control-mapped, not certified. We map your controls to these and prepare the evidence. Regulators and accredited bodies decide what is sufficient.
The FCA's duty to deliver good outcomes for retail customers. Mapped to customer communications, complaints and vulnerability controls.
Named accountability. Mapped to the owner recorded against each AI use.
FCA rules on complaint handling (DISP) and consumer credit conduct (CONC), mapped to triage and letter checks.
Model risk expectations for banks and building societies.
Data protection and the new rules on automated decisions. Redaction and review evidence.
International AI management and service-controls standards. Readiness evidence; accredited bodies certify.
Three role holders, three different problems.
Needs a current list of AI use cases, the controls on each, and an exception log. GenWA gives a register, rules and a log the second line can test, and evidence packs ready for a supervisor's request.
Owns the letters, calls and complaints where AI is already working. GenWA puts named owners, approval steps and a stop switch on those workflows, so speed does not outrun control.
Is personally accountable for outcomes. GenWA gives a board-readable view of what AI does, who owns it and what it costs, so you can approve more use with confidence.
From this sector.
What is AI governance for a lender or financial firm?
A live list of AI use cases, each with its data, its accountable person and the rules it must follow, plus a record of checks and sign-off. GenWA's Register, Guard rules and Log do this on connected tools. Evidence Packs turn the record into something a regulator or auditor can read.
Our regulator regulates outcomes, not tools. Why do we need this?
Agreed. The FCA is applying the Consumer Duty and the Senior Managers regime to AI, not writing a new rule book. That makes evidence of outcomes and ownership the thing that counts. We prepare that evidence and make no claim about what the FCA will accept.
Does GenWA help evidence the Consumer Duty for AI?
It helps you show each AI use case, its data, its owner and its checks in a record the board can read. Mapping supports your own Consumer Duty evidence and is not legal advice. The FCA has said it will publish AI examples later in 2026, so we check current sources with you.
Will GenWA tell us we are compliant?
No. Our work is control-mapped to the rules you name, not certified. The regulator decides what is sufficient and you decide what meets your duties. We prepare the evidence.
Does AI decide credit or affordability?
No. GenWA does not use AI for decisions on credit. AI can prepare analysis, but people decide, and the record shows who did.
Where does customer data go?
Hosting is your AWS or Azure account, or GenWA AWS as agreed. Personal data is redacted before approved external model calls. Outsourcing and data terms are confirmed in the security review, and are not legal advice.
How do we start?
Take the AI health check and name your priority uses, such as collections letters or complaints. First findings arrive within 48 hours and the audit with a 90-day plan within ten working days. The audit fee is credited in full against year one of a platform plan.
Could you show your regulator every AI use case by Friday?
First findings within 48 hours of the health check. Audit fee credited in full against year one of a platform plan.