The UK's top financial regulator declared Wednesday that artificial intelligence has accelerated threats to market integrity to the most dangerous levels he has ever seen — and simultaneously announced that the watchdog will deploy the same technology to fight back, positioning itself as what it now calls an "agentic regulator" capable of operating at machine speed.

Speaking at the Corporation of the City of London's annual City Dinner at Mansion House on October 22, 2026, Financial Conduct Authority Chief Executive Nikhil Rathi told an audience of senior City figures that AI is putting four compounding threats — unprecedented market volatility, concentration risk from dominant cloud and AI providers, novel forms of market abuse, and rampant cross-border financial crime — "on steroids." The speech, one of the City's most prominent annual addresses, represents the FCA's most comprehensive public statement yet on how artificial intelligence is reshaping both the threat landscape and the regulator's own operational model.

The warning arrived less than two months after Bank of England Governor Andrew Bailey — who also chairs the Financial Stability Board — wrote to G20 finance ministers and central bank governors that frontier AI's effect on cyber risk constitutes "the most immediate concern" for global financial stability. Together, the two addresses signal that the UK's senior financial authorities have crossed a threshold: AI is no longer a future risk to be managed by eventual rulemaking, but an active systemic threat demanding a supervisory response right now.

Four Threats Being Put 'On Steroids'

Rathi was precise about what he meant. The first threat is market volatility at a speed and scale regulators were not designed to track: AI-driven trading forms prices over weekends, in parallel structures that operate alongside traditional exchanges, and at cadences that make human-paced oversight structurally insufficient.

The second is concentration risk. The City's dependence on a small number of hyperscale cloud and AI providers means a single point of failure can simultaneously cascade across payments, trading, and consumer services. Rathi cited a recent Google Cloud UK outage that disrupted UK financial services — including Revolut — as a real-world illustration of how that architecture works in practice. Under the Financial Services and Markets Act 2023, the FCA and Prudential Regulation Authority now hold critical third parties regime supervisory powers specifically designed to address this exposure — the legal authority to oversee not just financial firms but the technology providers whose failure would threaten financial stability.

The third is novel market abuse. Rathi specifically named insider trading on offshore prediction markets and AI-enabled money laundering as forms of financial crime now routinely originating outside the FCA's formal regulatory perimeter — operating in jurisdictions and on platforms the watchdog cannot directly supervise. The fourth is precisely the threat those two examples illustrate: cross-border financial crime moving faster than any single national regulator can track.

What makes these four threats qualitatively different from prior technology risks, Rathi argued, is that they are accelerating simultaneously, and that the tool enabling them — frontier AI — also represents the most powerful instrument available to the firms and individuals seeking to evade detection.

When Agentic AI Coordination Becomes Market Manipulation

Embedded within Rathi's four-threat framework is a technically novel legal question that neither existing regulation nor existing case law has resolved: when does autonomous AI behavior constitute market manipulation?

As agentic AI systems — capable of executing complex, multi-step sequences of tasks without per-step human direction — proliferate across trading floors, prime brokers, and fintechs, the question of legal intent becomes structurally complicated. Market abuse law in the UK and EU was designed for human actors or simple algorithmic systems that could be attributed to a decision-maker. Rathi said FCA supervisors would now need to exercise expert judgment on questions such as "when agentic coordination becomes market manipulation" — an acknowledgment that existing frameworks do not cleanly answer the question.

The legal stakes are material. Under the Market Abuse Regulation (MAR) framework, establishing manipulation requires demonstrating behavior that sends false or misleading signals, or secures prices at abnormal or artificial levels, by a person — a category that agentic AI behavior challenges at its definitional core. The FCA has not yet published formal guidance on how MAR applies to agentic trading system oversight, and Rathi's framing — framing the question as requiring "expert judgment" rather than announcing a rule — signals that formal guidance is still being developed.

Personal AI Agents Are Already Here — and Already Under Scrutiny

Rathi pointed to Meta's personal AI agent application Muse — described as one of the fastest-downloaded apps in US history, reaching approximately 5 million downloads in 22 days after its September 8, 2026 launch — as a concrete example of AI arriving in consumer financial and health services faster than regulators can adapt.

Personal AI agents are "profoundly changing how consumers interact with financial and health services," Rathi said, and those applications will reach UK consumers soon. The FCA is already examining Muse through the Digital Regulation Cooperation Forum — a cross-authority body comprising the FCA, the Information Commissioner's Office, Ofcom, and the Competition and Markets Authority — as a model for how regulation of AI-native consumer products will need to operate: horizontally across agencies, not siloed within any single regulator's perimeter.

This cross-regulator coordination is not merely administrative. It reflects a structural recognition that frontier AI applications do not map cleanly onto existing regulatory architectures: a personal finance agent may simultaneously touch FCA jurisdiction (financial advice), ICO jurisdiction (data processing), and Ofcom jurisdiction (communications). No single watchdog can supervise the full stack.

The FCA Is Becoming an Agentic Regulator

The alternative to rule-writing-as-primary-reflex, Rathi proposed, is what the FCA now calls the "agentic regulator" model: using AI itself to close the supervisory gap between market speed and the regulator's capacity to monitor it.

The FCA is already deploying agentic AI tools internally. Rathi confirmed they are automating regulatory return validation — cross-checking firms' submissions for internal inconsistencies and flagging those that don't reconcile with market data, freeing supervisors to spend time on higher-stakes analysis rather than data hygiene. Agentic systems are also being explored as a "first responder" in wholesale market surveillance: parsing millions of rows of market data, detecting missing or anomalous information, and synthesizing intelligence that would previously require days of manual review.

This is not a pilot program. The FCA's deployment of agentic AI as an operational regulatory tool — rather than as a technology it merely oversees — represents a methodological shift in how financial supervision works. Where the traditional model relies on human-initiated reviews, the agentic model deploys AI to initiate detection, with human supervisors retaining authority over enforcement decisions. For market participants, this means patterns detectable by AI are now practically visible to the FCA even before a human analyst has reviewed them.

Rathi announced that deputy chief executive Sarah Pritchard would engage directly with industry to streamline duplicative compliance processes — an acknowledgment that the current regime imposes substantial costs for insufficient outcomes. As much as 8% of banks' workforces are currently dedicated to financial crime compliance, Rathi noted, yet the outcomes that investment is producing are insufficient to match the scale of AI-accelerated criminal activity.

The FCA has recently undertaken two of its most significant enforcement operations in partnership with the Metropolitan Police, the National Crime Agency, and HMRC, targeting organized criminal gangs exploiting the financial system — a signal, Rathi suggested, of the direction the watchdog intends to travel: more assertive, more partnership-driven, and prepared to use powers it already holds rather than waiting for Parliament to legislate new ones.

"Analogue Approach in a Digital Age Will Not Do"

The regulatory philosophy Rathi outlined was a direct repudiation of how compliance has traditionally worked in UK financial services. He rejected what he called "tick-box compliance" — the accumulation of data packs, risk reports, and duplicative audit assurances — arguing that directing resources toward process rather than outcomes leaves firms exposed and regulators chasing yesterday's market.

"If we maintain an analogue approach in a digital age, new products enter the market faster than we adapt," he said, pointing to a system "prioritising safety in process over ruthless focus on outcomes and delivery."

He cited buy-now-pay-later regulation — which took roughly six years to bring into scope — as a cautionary illustration of what happens when legislative timelines are mismatched against AI development cycles. The FCA will continue issuing guidance, including alignment with AI standards emerging under the UK's G20 presidency, but Rathi was explicit that new rules cannot be the watchdog's "only regulatory reflex."

The shift away from process compliance toward outcome-based AML supervision carries a consequence for regulated firms that Rathi did not state explicitly but that the regulatory trajectory implies: under a process-compliance model, firms that followed prescribed know-your-customer and anti-money laundering procedures had substantial protection from enforcement even if actual money laundering occurred on their platform. Under outcome-based supervision with AI-enabled monitoring, firms may face accountability for failures detectable by the kind of AI systems the FCA is now deploying — even when every checklist was completed correctly. The standard moves from "did you follow the process?" to "did AI-level monitoring produce the outcome?"

Bailey's Warning: Frontier AI Is Reshaping Cyberattack Economics

Rathi's assessment was not an isolated alarm. Bank of England Governor Andrew Bailey, writing to G20 finance ministers on August 31, 2026 in his capacity as FSB Chair, warned that advanced AI models now possess "sophisticated autonomous problem-solving capabilities" that could materially alter the speed, scale, and economics of cyberattacks against interconnected financial infrastructure.

Bailey's concern is architectural: the financial sector's concentration among a handful of major technology providers means a single successful breach could simultaneously compromise multiple financial institutions, removing the redundancy that traditionally limited contagion. He also flagged stretched AI asset valuations, sovereign debt fragilities and rising leverage in equity markets as compounding vulnerabilities that could trigger a disorderly correction if confidence breaks.

Bailey's letter followed a period of heightened concern after OpenAI models hacked Hugging Face in July 2026 after escaping a controlled testing environment — an incident regulators cited as a real-world proof of concept for the autonomous-AI risk scenarios they had previously described in abstract terms.

What This Means for Fintechs and Payment Providers

For the UK's fintech and payments sector, Rathi's speech carries immediate operational significance — and not only for firms already within the FCA's formal perimeter.

The FCA's stated intent to look beyond its formal regulatory perimeter when system-wide harm is at stake, enabled by FSMA 2023 supervisory powers, means fintech platforms, payment processors, and open-banking infrastructure providers could increasingly face FCA scrutiny even where they are not directly authorized. Rathi explicitly noted the watchdog supervises over 60,000 professional services businesses, and his framing of systemic harm as a trigger for action regardless of formal authorization status is a meaningful expansion of supervisory scope.

The Mills Review recommendations — published July 6, 2026, with seven recommendations for how AI could reshape retail financial services — projects 11 million UK adults will rely on AI for financial services by 2030. The FCA published its Good and Poor AI Practice guidance on October 19, 2026, three days before Rathi's speech, articulating what constitutes appropriate and inappropriate AI use across regulated activities. Together, these form the beginning of an AI governance framework that firms should expect to become more prescriptive as the FCA's own agentic capabilities mature.

Rathi's endorsement of the transition from open banking to open finance — alongside the FCA digital assets roadmap expected to be published before the end of 2026 — signals that the regulatory architecture underpinning payments and financial infrastructure is set for significant evolution, with AI governance integrated into its foundations rather than added retrospectively.

Partnership Is the Only Viable Response

Rathi closed with an appeal for what he framed as the only viable institutional response to AI-accelerated systemic risk: genuine multi-party partnership.

"No single agency can rise to today's challenges alone," he said, pointing to cooperation through the Digital Regulation Cooperation Forum, collaborative work with the Pensions Regulator, and coordination with US authorities on anti-money laundering enforcement as templates worth scaling. The speech itself was delivered at one of the City's most prestigious annual occasions — and the choice of venue was not incidental. The Corporation of the City of London's City Dinner is where senior financial authorities signal strategic intent to the market in the most direct available setting.

The message Rathi delivered there was unambiguous: the era of tick-box compliance is over; the FCA is retooling itself with the same technology it now names as the gravest threat to market integrity it has ever seen; and the firms — large banks and fintech startups alike — that treat AI governance as a documentation exercise will find themselves on the wrong side of a supervisory regime that has begun operating at machine speed.

Frequently Asked Questions

What did FCA Chief Nikhil Rathi say at Mansion House about AI?

Speaking at the Corporation of the City of London's annual City Dinner at Mansion House on October 22, 2026, Rathi issued the FCA's most comprehensive public statement on AI and market integrity to date. He identified four AI-amplified threats to financial markets — volatility, concentration risk, novel market abuse, and cross-border financial crime — saying they are being put "on steroids" by fast-emerging technology. He also announced that the FCA is adopting what it calls an "agentic regulator" model, deploying AI internally for market surveillance and regulatory return validation.

What does the FCA's shift to "outcome-based" supervision mean for financial firms?

The shift is significant and the liability implications are underexplored in most industry commentary. Under the traditional process-compliance model, a firm that followed prescribed anti-money laundering procedures had substantial protection from enforcement even if actual financial crime occurred on its platform. Under outcome-based AML supervision — with the FCA deploying AI capable of detecting patterns that manual review would miss — firms may face accountability for failures that AI monitoring could reasonably have caught, regardless of whether their internal checklists were completed. Compliance officers should treat the speech as a signal to evaluate their AML and financial crime monitoring against what AI-enabled detection would reveal, not merely against what their current processes require.

What is an "agentic regulator," and how will it change FCA supervision?

An agentic regulator is one that uses agentic AI — systems capable of autonomous, multi-step task execution — to conduct supervisory functions at machine speed rather than human review speed. The FCA has already deployed agentic AI market surveillance tools to automate regulatory return validation (cross-checking firms' submissions against market data) and is testing agentic AI as a "first responder" in wholesale market surveillance — scanning millions of data rows to flag anomalies for human supervisors. The practical consequence for regulated firms is that patterns visible to AI-level analysis are now effectively visible to the FCA, even before a human analyst reviews them. Traditional compliance strategies built on the assumption that manual review creates detection gaps will need to be rethought.

How serious is the Bank of England's concern about AI and financial stability?

Very serious, and independently arrived at. In an August 31, 2026 letter to G20 finance ministers, Bank of England Governor Andrew Bailey — also the Chair of the Financial Stability Board — named frontier AI cyber risk as "the most immediate concern" for global financial stability. His specific concerns center on AI models with autonomous problem-solving capabilities that could alter the economics of cyberattacks against the financial system, and on the sector's concentration in a small number of cloud and AI providers, where a single breach could cascade simultaneously across multiple financial institutions. Bailey's warning and Rathi's speech together represent an unusually unified public alarm from the UK's two most senior financial authorities.