When the Financial Conduct Authority (FCA) published its landmark report on AI and the future of retail financial services in July, the mainstream media zeroed in on a single narrative, the regulating of general-purpose AI tools like ChatGPT.
But if you are a mortgage lender, network, or broker, that headline misses the point. The Mills Review, named after FCA Executive Director Sheldon Mills, who led the initiative, is not a story about banning such models. It is a fundamental signal about the direction of travel for compliance, governance, and how you evidence your operations.
For the mortgage sector, the message is clear, as the regulator is not writing a new AI rulebook today, but the bar for proving you are meeting the rules you already follow is about to get significantly higher.
What exactly is the Mills Review?
The FCA describes the Mills Review as the first review of its kind by a financial regulator anywhere in the world. Drawing on 140 written submissions and a survey of more than 5,000 UK consumers, the report explores how AI will reshape retail financial services by 2030.
The review is anchored around three core frameworks:
An AI Autonomy Spectrum: A five-level model (spanning operator, collaborator, consultant, approver, and observer) that tracks how the human role changes as AI takes on more complex work.
Four System Shifts: The structural changes the FCA expects by 2030, including the transformation of firms, new consumer journeys, a reshaped competition landscape, and amplified cyber and financial crime risks.
Seven Priority Recommendations: Strategic advice directed to the FCA Board, ranging from monitoring autonomous models to scaling up the FCA’s AI Lab.
Crucially, the Mills Review concluded that our existing regulatory framework is sound. It requires “progressive adaptation, not wholesale replacement”. In other words, you won’t be handed a brand new AI rulebook to decipher.
The evidencing imperative
While a lack of new rules might sound like a relief, the reality is more demanding. The Consumer Duty, the Senior Managers and Certification Regime (SM&CR), and operational resilience standards still apply in full. What changes is how you prove you are adhering to them in an AI-augmented world.
The mortgage market already runs on evidence, from suitability rationales under MCOB and strict affordability assessments to Consumer Duty outcomes monitoring and financial promotions sign-offs.
However, the FCA is acutely aware of the risks as AI evolves and the Review explicitly notes that as AI moves from merely assisting a human to acting on their behalf, “firms may find it more difficult to evidence consumer understanding, demonstrate good outcomes, and maintain clear lines of accountability”.
Accountability stays with named individuals, but under the Senior Managers Regime, leaders will now need stronger pre-deployment and ongoing checks to evidence the “reasonable steps” they took to oversee AI models, especially third-party systems.
Furthermore, one-off consent or basic file sampling won’t cut it anymore. If an AI is making dynamic, highly personalised decisions continuously, you must be able to evidence what the AI did, and why, in every single case, not just a 10% sample.
Compliance as a competitive advantage
Historically, compliance has been viewed as a necessary cost centre, the Mills Review flips this dynamic.
Buried deep in the report is a sentence that should serve as a strategic North Star for lending businesses “governance is likely to become an enabler of capability”. The FCA suggests that firms capable of demonstrating robust auditability and explainability will ultimately win the business.
We are already seeing that 75% of UK financial services firms use AI. Consumers are also catching on with roughly 11 million UK adults open to AI acting autonomously on their finances. The trust gap isn’t about AI capability, it’s about reproducibility.
What should Mortgage Strategists do next?
A few months on from The Mills Review, it’s clear that this is a warning shot for firms relying on black-box AI solutions. Lenders and brokers need to look at their technology stack and ask one simple question: If the FCA asked us tomorrow to explain the exact rationale behind a decision our AI made on a specific mortgage application, could we do it?
The future of mortgage technology isn’t just about faster origination or automated case checking. It’s about building an unbroken chain of evidence and the firms that treat the Mills Review as an opportunity to build auditable, transparent AI processes will not only satisfy the regulator, they will set the new standard for trust in the mortgage market.
Dawid Kotur is CEO of Curvestone AI
