AI Automation · 7 MIN
Choosing an AI agency for a UK fintech: the FCA questions to ask
What UK fintechs should ask an AI partner: FCA expectations, Consumer Duty, operational resilience, third-party reporting from 2027, and audit evidence.
A UK fintech should choose an AI partner that can show its work against rules the FCA already enforces: Consumer Duty outcomes, senior manager accountability, and operational resilience for third parties. The FCA says it is not writing new AI rules, so your AI system is judged by the existing framework. This guide turns that into vendor questions.
- The FCA has said it does not plan to introduce extra regulations for AI and relies on existing frameworks, including the Consumer Duty and SM&CR.
- Under the Consumer Duty, communications must meet customers' information needs, and the FCA has warned that AI producing worse outcomes for some groups may fall short unless the difference can be objectively justified.
- If an AI system supports an important business service, SYSC 15A applies, and firms must map the people, processes, technology, facilities and information that deliver that service.
- From 18 March 2027, in-scope firms must notify the FCA of material third-party arrangements and submit an annual register.
- A good AI partner provides evals, logs, human review paths, and an exit plan as standard deliverables.
- Nactore is an AI-native technology and growth company in Mumbai that builds AI automation with evals and audit trails, scoped to each regulated client.
This post explains the framework and is not regulatory advice. Your compliance team and, where relevant, your lawyers decide how the rules apply to you.
What does the FCA expect from firms using AI?
The FCA's AI approach page says its approach is principles-based and focused on outcomes, and that it does not plan to introduce extra regulations for AI. It relies on existing frameworks, naming the Consumer Duty and the Senior Managers and Certification Regime (SM&CR). Its 2024 AI Update adds operational resilience under SYSC 15A where AI supports an important business service.
For a buyer, that is useful. It means the questions you ask an AI partner are the same questions you would ask about any system that affects customers.
How do Consumer Duty and AI interact?
The Consumer Duty requires firms to communicate in a way that meets the information needs of customers, and where the Duty does not apply, Principle 7 requires communication that is clear, fair and not misleading. If an AI assistant explains a product, fee, or decision, those outputs are your communications.
The FCA's AI Update says the Duty requires firms to take account of the different needs of customers, including those with characteristics of vulnerability, and that firms using AI in a way that leads to worse outcomes for some groups might not be acting in good faith, unless the differences in outcome can be justified objectively. So your AI partner should be able to slice evaluation results by segment, not only report an overall score.
What does operational resilience mean for an AI vendor?
SYSC 15A in the FCA Handbook requires firms to set an impact tolerance for each important business service and to remain within it during a severe but plausible disruption. Under SYSC 15A.4, a firm must identify and document the people, processes, technology, facilities and information needed to deliver each important business service. If an AI vendor's system is part of that service, its dependencies belong in that map.
For an AI vendor, that translates into concrete asks.
- Dependencies map. Which model providers, clouds, and tools the system relies on.
- Fallback plan. What happens when a model provider is down or a model version changes.
- Testing. Whether the vendor will join your scenario tests.
- Recovery targets. How quickly service returns, in terms you can match to your impact tolerance.
What changes from 18 March 2027?
The FCA's page on reporting material third-party arrangements says that from 18 March 2027, in-scope firms must notify the FCA when they enter into, or significantly change, a material third-party arrangement, and submit an annual register of those arrangements. An arrangement is material if its disruption or failure could cause intolerable levels of harm to the firm's clients, pose a risk to the UK financial system, or cast serious doubt on the firm's ability to meet its threshold conditions or its obligations under the Principles or SYSC 15A. In-scope firms include enhanced scope SM&CR firms, banks, designated investment firms, Solvency II firms, CASS large firms, and authorized e-money and payment institutions. Other firms keep meeting their existing obligations, including Principle 11.
Whether your AI vendor falls within this depends on the service and on your own classification, so ask your compliance lead. The practical step is to keep a clean vendor record now: scope, data, sub-processors, and exit terms.
What evidence should an AI partner give you?
Ask for artifacts, not assurances. This table maps typical regulatory concerns to evidence you can request.
| Concern | Evidence to request |
|---|---|
| Output quality | Labeled test set, scores, and failure categories, with segment breakdowns |
| Customer outcomes | Sample reviews of outputs by your team before launch and on a schedule |
| Accountability | A named senior manager on your side and a named owner on the vendor side |
| Audit trail | Logs of inputs, outputs, model version, and human overrides, with retention you control |
| Resilience | Dependency map, fallback behavior, and recovery targets |
| Data protection | Processor contract, sub-processor list, and transfer terms if data leaves the UK |
| Exit | Documented handover so the service can be brought in-house or moved |
Our posts on AI evals before production, LLM observability, and human in the loop automation describe how each is built.
Which fintech workflows suit AI first?
Choose bounded workflows with a human check and clear data.
- Customer support triage. Categorize and draft, with an agent approving.
- Document extraction. Pull fields from statements and onboarding documents, and send low-confidence items to review.
- Reconciliation and ops. Match and explain exceptions for finance teams, as in AI automation for finance ops.
- Internal knowledge search. Answer staff questions over policies, with citations.
Keep AI out of unreviewed credit or eligibility decisions unless you have a full governance design with your compliance team in the room.
Ask your AI partner to show one failure on purpose. A team that can explain exactly how its system fails, and how that is caught, has done the work regulators will want to see.
What about data leaving the UK?
If a vendor outside the UK can access customer personal data, you need a lawful transfer route and a risk assessment. See UK GDPR and data transfers to India for the steps. For many fintech builds, development on masked data and production in a UK or EEA region keeps the question small.
Frequently asked questions
Does the FCA have specific rules for AI?
No. The FCA has said it does not plan to introduce extra regulations for AI and relies on existing frameworks, including the Consumer Duty and SM&CR, with operational resilience rules applying where AI supports an important business service. You are expected to meet those when you use AI.
Do I need to tell the FCA if I use an AI vendor?
It depends on whether the arrangement is material and on your firm type. From 18 March 2027, in-scope firms must notify the FCA of material third-party arrangements. Existing obligations, including Principle 11, continue to apply to other firms.
Can an AI chatbot give customers regulated advice?
That depends on what it says and your permissions. Treat any output that could influence a financial decision as a regulated communication and have compliance review the design and the guardrails.
What should an AI vendor contract include for a fintech?
Scope and acceptance tests, a processor contract, a sub-processor list, incident reporting terms, audit rights, exit and handover, and cooperation with your resilience testing. Your lawyers should draft the final form.
Ask for evidence your regulator would ask for
The best AI partner for a UK fintech is the one whose standard deliverables already look like your compliance file: evals, logs, resilience notes, and an exit plan.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.