The FCA Spoke on AI This Week. Every Other Regulator Will Be Watching.

The FCA’s chief executive Nikhil Rathi recently gave a speech that I think every compliance professional in the UK should read.

The speech was titled “Rethinking regulation for the age of AI.” The core argument was AI is evolving faster than any rulebook can keep up with, so the FCA is moving away from prescriptive, detailed rules, toward flexible, outcomes-focused oversight. The question regulators are now asking is not whether firms followed the rules, it is whether firms achieved the right outcomes.

The FCA is also already exploring using agentic AI in its own supervision and trialling it as a first responder to detect market abuse across a billion rows of data per day.

The FCA does not currently supervise law firms for AML. But I would expect other regulators to follow in exactly the same direction.

Outcomes-Based Oversight is a Harder Standard

The move from rules-based to outcomes-based regulation sounds like regulatory theory. In practice, it is a meaningful shift in what firms are expected to demonstrate.

Under a rules-based approach, the question is: did you follow the procedure? Do you have the policy? Did the box get ticked? And it is a relatively easy question to answer and to demonstrate. A relatively easy standard to meet on paper, even if the underlying practice is weak.

Under an outcomes-based approach, the question is harder. Did your AML framework actually reduce the risk of money laundering in your firm? Did your client risk assessments identify the right clients as higher risk? Those are questions that a well-written policy document cannot answer on its own and requires genuine understanding of the firm and its framework.

This is the direction I see regulation moving. And it is the direction the SRA’s own proactive supervision has already been moving in, even if it has not framed it in those terms. The consistent finding from SRA inspections is not that firms lack policies, it is that the policies do not reflect what is actually happening on files. That is an outcomes gap, not a documentation gap.

AI Changes What Regulators Can See

The other thing that struck me about the Rathi speech is what AI means for the regulator’s own capability.

A regulator using AI to process supervision data can identify patterns across hundreds or thousands of firms simultaneously. Inconsistencies between what a firm reports and what its files show, anomalies in transaction patterns, gaps between stated policies and apparent practice. What previously required a manual inspection and was easier to miss can now be identified at scale.

The SRA is already moving in this direction. It has confirmed a shift toward data-led supervision and is rolling out tools to give its teams a single view of risk across the firms it regulates. The capability gap between what regulators could see five years ago and what they can see now is significant and it is only going to grow.

For firms whose AML framework looks compliant on paper but does not reflect how they actually operate, that matters. The gaps that went undetected for years — like Rooks Rider Solicitors — are becoming easier to find.

Accountability Stays With the Firm

One of the clearest points in the FCA’s speech was regardless of what technology a firm uses, accountability remains with the firm. Firms cannot delegate its compliance responsibilities to a platform.

That principle applies directly to AML. Firms rely heavily on their screening tools as their AML solutions and don’t get me wrong, those tools do an important job and they certainly have their place, but they are not a solution, they do not document reasoning.

Ultimately the technology handles part of the process but the firm is still responsible for the outcome. And as regulation moves toward asking whether the outcome was achieved, that distinction becomes more important, not less.

What I Think This Means for Law Firms

The FCA’s speech was aimed at financial services but the direction it describes, outcomes-focused oversight, AI-assisted supervision, accountability firmly with the firm, is where I believe all serious regulation is heading.

Law firms have operated in an environment where conforming to the rules and having the policies, completing the training, ticking the boxes has broadly been enough to satisfy the regulator. That environment is changing. The SRA is already asking harder questions. The tools it has to find the answers are improving.

The firms that will be best placed are not the ones that update their policy documents in response to each regulatory development. They are the ones that take an honest look at whether their AML framework actually works and whether it reflects how they operate.

That is not a future problem. It is the question being asked right now.

Shannon Grinnell
AML & Compliance Operations
shannon@haloaml.ai
Quadrant Court 49 Calthorpe Road, Edgbaston, Birmingham, England, B15 1TH