Advice Without an Adviser

Eleven million British adults are ready to let an AI make financial decisions for them. Not look things up. Decide — move money, pick the product, act inside pre-set goals. The tool they'd hand that to holds no license, owes them no duty of care, and answers to no complaints process. And the regulator that just documented all of this, in the most thorough study any financial watchdog has attempted, has decided not to rush.

That combination is the story. Not that people ask chatbots about money — they've done that for two years. The story is that the trust is forming faster than anyone can attach a rule to it, and the institution whose job is to attach the rule can see exactly what's happening and is choosing patience.

The FCA-commissioned Mills Review, published on July 6, is worth reading closely for what it refuses to do as much as for what it warns about. It does not call for AI-specific regulation. It does not propose to rewrite the perimeter. It says the existing machinery — the Consumer Duty, the Senior Managers Regime, operational resilience — was built to flex, and should. Then it asks one pointed question: what happens when the thing shaping a financial decision sits entirely outside the boundary where financial duties apply?

Advice became a behavior before it became a category

Financial advice is a legal term with consequences attached. Authorization, suitability standards, disclosure, redress when it goes wrong. That architecture assumes an identifiable actor — a firm, a representative, a regulated journey — sitting inside a perimeter where duties bind conduct.

A general-purpose model doesn't sit anywhere. It asks about your income, your age, your goals, your anxiety. It narrows. It ranks the options and explains the consequences and hands you the confidence to act. Then, sometimes, it suggests you speak to a professional — after it has already framed the decision.

A disclaimer may be legally load-bearing. It does nothing to the influence that came before it. And that's the shift the review takes seriously: advice is no longer only a category assigned by a provider. It's becoming a behavior produced by an interface. The model can insist it isn't an adviser while doing everything an adviser does except carry the liability.

Trust is arriving before the license

Regulation assumes trust follows authorization. A firm gets permission; you can check its status; rules govern its conduct; redress exists if it fails. The market isn't safe because everyone is honest. It's safer because everyone is inside a structure.

AI reverses the order. People trust the answer because it's clear, patient, free, and available at the exact moment they need it — before they've formed any view of the institution behind it, if there even is one. And in a market where regulated advice is expensive and scarce, that isn't foolish. It's rational. Only about 9% of consumers ever receive traditional regulated advice. Roughly £300 billion sits idle in low-interest accounts because deciding what to do with it is hard and help costs money. Mills makes the upside concrete: AI could give someone on £20,000 a year the kind of guidance normally reserved for someone with £10 million. That is a real democratization, and it's the reason a blanket "don't trust the chatbot" is the wrong answer.

The danger isn't access. It's access wearing the costume of accountability.

Only about 40% of people correctly understand that when they rely on a general-purpose tool, there is no formal route to recourse. The other 60% are operating inside a safety net they assume exists and don't have. The harm from a bad recommendation is recoverable. The harm from believing you were protected when you weren't compounds quietly, and shows up only when something has already gone wrong.

Where the journey starts now

For decades, firms controlled the path. You walked into a branch, opened an app, read the materials, spoke to someone. Even when you used outside information, the firm still owned the official route to the product.

Now the route often begins with a chatbot. By the time you reach a regulated firm, the framing has already happened — categories explained, fees flagged, providers compared, a product type recommended, sometimes an interpretation of an exclusion that the firm would dispute. The firm inherits a customer whose expectations were set by a system it neither built nor can correct, and it may inherit the complaint too.

This is the part that should worry incumbents more than it seems to. If the approved journey feels slower or more cautious than the assistant the customer already prefers, they drift back to the assistant. So firms build their own AI advisers to compete, and the line between a bank's model, a vendor layer, a cloud provider, and a foundation model gets harder for anyone — including the customer — to see. Accountability still has to land somewhere. It's just no longer obvious where.

From cloud concentration to cognitive concentration

The review's second warning may matter more to the system than the first. Financial firms are leaning on a small number of technology providers for the models, the cloud, and the infrastructure underneath both.

Regulators already understand cloud concentration — if everyone depends on the same provider, one outage becomes a sector event. AI adds a second layer to that dependency, and it's a stranger one.

The provider is no longer just hosting the system. It's shaping the judgment inside it.

If many banks, insurers, and asset managers run similar models trained in similar ways under similar safety policies, they may develop the same blind spots. Not a dramatic failure — a quiet convergence. Models that read a market signal the same way, flag the same customers, recommend the same response under stress. In finance, that's a recipe for synthetic herding: no malice required, just a shared dependency pushing many actors the same direction at the same moment.

The review notes something useful here — the UK's Critical Third Parties regime is technology-agnostic and could already capture major AI and cloud providers where the criteria are met, and its longer-term recommendation is to ask government to strengthen those powers. Which reframes the whole thing. A chatbot giving one person shaky savings advice is a conduct problem. A handful of model providers shaping decision logic across the industry is a stability problem. Same technology, different order of magnitude.

The uncomfortable part is that accountability without control is fragile. A bank remains answerable for outcomes produced by a model it can't fully inspect, running on infrastructure it can't easily leave. Supervisory expectations built for a world of controllable systems get harder to enforce the moment the system belongs to someone else.

What the review actually says

Here's the tension the headlines flattened. The review isn't a crackdown, and it's careful to say so. Respondents didn't want new AI rules, and the FCA didn't propose them. The perimeter is based on the activity, not the technology, and the position is that it "generally still works."

So the interesting thing isn't that the regulator is alarmed. It's that the regulator sees the interface problem in full and is deliberately not moving fast on it — betting that Consumer Duty and senior-manager accountability can stretch to cover AI-mediated decisions without a new rulebook. That's a defensible bet. It's also a wager with a deadline attached: the review asked the FCA to examine, within three to six months, whether the perimeter needs to be secured and adapted for the general-purpose models sitting outside it.

That clock is nearly out. As of now, the perimeter review hasn't reported, the promised good-and-poor-practice guidance hasn't landed, and the Board is still deciding what to adopt. Meanwhile, Mills has said the quiet part — that keeping up will require the regulator to run on AI itself, an "arms race" in which the supervisor has to become as computational as the market it watches. You can hold both ideas at once: the framework may genuinely be sufficient, and the pace of adoption may make "sufficient but slow" indistinguishable from "absent" for the people acting on a chatbot's answer today.

Whoever owns the layer

Strip it back, and this was never really about chatbots giving bad tips.

For decades, financial regulation governed firms, products, disclosures, incentives, and advice channels. AI inserts a new layer between the consumer and the market — one that interprets, ranks, personalizes, persuades, and increasingly acts. It might be owned by a bank, a fintech, a general-purpose AI provider, a cloud platform, or some tangle of all four. It might sit inside a regulated app or entirely outside the sector.

Whoever owns that layer influences which options you see, which risks you register, which trade-offs feel acceptable, which firms reach you at all. That's market power. It's also governance power, and the two have quietly become the same thing.

This is why consumer-advice risk and concentration risk aren't separate chapters in the review — they're one problem viewed from two ends. The system that walks an individual through a pension is the same shared infrastructure the whole industry is coming to depend on. The dependency that creates operational fragility also creates distribution power.

The chatbot is not your financial adviser. No license, no duty, no compensation scheme behind it. But millions already treat it as one, and a majority of them don't know what they're missing until it's too late to matter. The moment regulators have to take seriously was never going to be the day an AI declares itself an adviser. It's now — while people use it as one, and the institutions meant to protect them are still deciding how fast to move. The review is the clearest map anyone has drawn of that gap. What happens in the next few months is whether the map gets used.