compliance

FCA Regulations for AI in Fintech: What UK Founders Need to Know

The UK Financial Conduct Authority's rules governing AI use in regulated financial services, covering model risk, explainability, and consumer duty obligations.

The Financial Conduct Authority regulates the conduct of financial services firms in the UK, and its reach extends to fintech startups and technology providers whose products touch regulated financial activities. If your AI product assists with investment decisions, credit scoring, insurance underwriting, fraud detection, or any other regulated financial service, you are operating in FCA territory. The FCA has not yet produced a standalone AI regulation equivalent to the EU AI Act, but it has issued substantive guidance on model risk management, explainability, Consumer Duty, and the use of AI in regulated contexts. Navigating these requirements correctly is the difference between a product that can be sold to regulated financial services firms and one that fails their procurement review at the final hurdle. Consumer Duty, which took full effect in July 2024, has raised the bar significantly: regulated firms must now demonstrate that any AI used in retail customer journeys produces good outcomes, and they pass that requirement directly to their technology vendors through procurement. For UK fintech founders building in open banking, lending, or insurtech, FCA alignment is a commercial prerequisite before a single bank or broker will sign. SpeedMVPs has delivered AI products for fintech founders with explainability layers, model cards, and Consumer Duty outcome mapping included as standard deliverables, so the compliance documentation is ready at launch.

FCA Regulatory Perimeter and AI Products

The FCA regulates firms carrying out regulated activities under the Financial Services and Markets Act 2000. Regulated activities include accepting deposits, issuing electronic money, dealing in investments, providing investment advice, operating a payment system, providing consumer credit, and managing collective investment schemes. An AI product that performs or materially assists with these activities may itself require FCA authorisation, or may need to be sold only to FCA-authorised firms. Technology providers are increasingly scrutinised by the FCA not only directly but through their regulated firm customers. If a bank or insurance company uses your AI product for a regulated function, the FCA expects the regulated firm to maintain oversight of the AI system as if they had built it themselves. This places obligations on technology vendors through their customers' requirements, even if the vendor is not itself regulated. The FCA's 2024 guidance on the use of AI in financial services confirmed this dual liability structure.

Model Risk Management Expectations

The FCA and the Prudential Regulation Authority have aligned expectations on model risk management that apply to AI models used in regulated financial services. Model risk is the risk of adverse consequences arising from the use of models in decision-making. The FCA expects firms using AI models for credit decisions, fraud detection, or pricing to have a documented model inventory, model validation processes, ongoing monitoring, and clear ownership of each model. For AI products sold to regulated firms, this means your product documentation needs to support your customers' model risk management obligations. You should be able to provide model cards describing what your model does, what data it was trained on, its known limitations, and performance metrics across relevant demographic groups. The FCA has been explicit that black-box models used for consequential financial decisions must have explainability mechanisms. Firms cannot discharge their model risk obligations by simply saying the AI decided it.

Consumer Duty and AI

The FCA's Consumer Duty, which took effect in July 2023 and extended to legacy products in July 2024, requires firms to deliver good outcomes for retail customers across four areas: products and services, price and value, consumer understanding, and consumer support. AI products used in retail financial services contexts must be assessed against all four outcomes. An AI that recommends products must recommend products that are appropriate for the customer's needs and represent fair value. An AI that communicates with customers must produce communications that customers can actually understand, which has direct implications for how AI-generated text and automated advice are designed and tested. An AI that provides support must not create barriers to customers seeking help or redress. Consumer Duty does not prohibit AI in financial services, but it creates accountability requirements that mean firms using AI in retail contexts must be able to demonstrate the AI is producing good outcomes for customers, not just operationally efficient outcomes for the firm.

Explainability Requirements in Fintech AI

Explainability is the most technically demanding FCA requirement for AI in financial services. When an AI system makes or materially influences a consequential decision - declining a loan, flagging a transaction as fraudulent, determining an insurance premium - the FCA expects that the firm can explain to the affected individual why that outcome occurred. This requirement comes from both GDPR Article 22 (automated decision-making) and FCA Consumer Duty obligations. The challenge is that many high-performing AI models, particularly deep learning models and large ensemble methods, do not produce naturally interpretable outputs. Solutions include using inherently interpretable models such as logistic regression or decision trees for high-stakes decisions, adding post-hoc explanation layers using techniques such as SHAP values or LIME, implementing hybrid architectures where AI scores and factors are presented to a human for final decision, or limiting AI automation to low-stakes steps with human oversight at consequential decision points. For AI products targeting UK fintech customers, building explainability into the product from the beginning rather than retrofitting it is strongly recommended.

FCA Sandbox and AI Testing

The FCA operates an Innovation Hub and a regulatory sandbox (formerly Regulatory Sandbox, now part of the Digital Sandbox programme) that allow companies to test innovative financial services products with real consumers under modified regulatory conditions. For AI products that sit in regulatory grey areas - novel credit scoring approaches, AI-driven investment recommendations for retail users, AI-powered insurance pricing - the Digital Sandbox provides a structured environment to test and iterate with regulatory oversight before full market launch. The FCA has been broadly supportive of financial services innovation and has published a joint statement with the PRA on AI that explicitly encourages firms to engage with the FCA on AI use cases where the regulatory position is unclear. Engaging the FCA early through the Innovation Hub is generally better than discovering a regulatory problem after launch.

Practical Steps for AI Fintech Founders

Before building an AI product for financial services, determine whether your product performs or assists a regulated activity, and whether it requires FCA authorisation or can be provided to FCA-authorised firms as a technology service. Engage FCA-authorised firms who will be your customers early, as their compliance and procurement teams will specify exactly what documentation and design requirements they impose on AI vendors. Build your model documentation to support your customers' model risk management frameworks, including model cards, validation summaries, and performance monitoring capabilities. Design your explainability approach before choosing your model architecture, as the required level of explanation should drive technical choices. If your product involves retail consumer interaction with AI-driven financial advice or product recommendations, map your design against the four Consumer Duty outcomes. For NHS Digital-adjacent healthtech that overlaps with regulated financial services, such as insurance underwriting using health data, note that MHRA and FCA obligations may both apply.

Frequently Asked Questions

Does my fintech AI product need FCA authorisation?+

It depends on whether your product performs a regulated activity under FSMA 2000. If your product makes investment recommendations to retail consumers, provides credit decisions, operates a payment system, or manages client money, you likely need authorisation. If your product is a tool sold to FCA-authorised firms to assist their own regulated activities, and the firm retains decision-making authority, you may be providing a technology service that does not require separate authorisation. Take specialist legal advice if you are unsure. The FCA's Innovation Hub can also help clarify the regulatory position for novel AI products.

How does Consumer Duty affect AI-generated financial communications?+

Consumer Duty requires that communications from regulated firms are clear, fair, and not misleading, and that they support customer understanding. AI-generated financial communications must meet the same standard as human-drafted communications. This means AI-generated text that customers receive about financial products must be tested for clarity and comprehension, must not use complex jargon, must not exploit behavioural biases, and must give a balanced view of risks and benefits. Firms cannot use Consumer Duty vagueness as a defence for AI outputs that fail these standards.

What is the FCA's position on using AI for credit decisions?+

The FCA does not prohibit AI for credit decisions but expects firms to maintain appropriate oversight, validate models for accuracy and fairness across protected characteristics, provide explanations for adverse decisions, and monitor ongoing model performance. The Equality Act 2010 also applies: credit decisions cannot produce systematically different outcomes for protected groups without objective justification. AI models for credit must be assessed for proxy discrimination, where variables that correlate with protected characteristics are used without adequate justification.

Do I need to tell the FCA if I change my AI model?+

Directly notifying the FCA of model changes is not a standard requirement for most firms, but if you are an FCA-authorised firm or if a significant change to an AI model materially alters how you carry out a regulated activity, your obligations under the Senior Managers and Certification Regime may apply. Model changes that affect the risk profile of a regulated firm's activities may need to be documented and approved through the firm's internal governance process under SR&R requirements. For technology vendors, your customers' internal change management processes will typically require you to give notice of significant model updates.

Is there a difference between FCA requirements and EU AI Act requirements for fintech?+

Yes, significant differences exist. The EU AI Act classifies AI used in credit scoring, insurance pricing, and employment decisions as high risk, triggering full conformity assessment requirements. The FCA's framework is principles-based rather than prescriptive, focusing on model risk management, explainability, and Consumer Duty outcomes rather than specific technical standards. UK fintech AI products that also serve EU markets must satisfy both frameworks, which requires coordination but is achievable with early planning. The FCA has stated it does not intend to replicate the EU AI Act's prescriptive approach in the UK, preferring a sector-specific, risk-sensitive regulatory approach.

Building an AI product for financial services and need compliant architecture from day one? Get a free consultation at speedmvps.co.uk

Get a Free Quote