On 19 October 2026 the Financial Conduct Authority published AI in financial services: good practice and areas for improvement. On the same day, Jessica Rusu, the FCA's chief data, information and intelligence officer, set out the regulator's plans for agentic finance in a speech at the Bloomberg UK Policy Series.

The review creates no new rules. The FCA says so explicitly. Its examples are illustrative and non-exhaustive. But it does offer a practical picture of the governance, accountability and monitoring practices the FCA has observed in firms deploying AI. Read closely, it describes a gap that neither the model nor the orchestration layer can close on its own.

What the FCA published

The good and poor practice review is organised around Consumer Duty, governance under SM&CR, and third-party risk. Three expectations stand out.

Accountability starts at design. The FCA highlights firms where "senior managers were accountable and owned risks from the design stage onwards for each AI use case." It flags as poor practice senior managers who "delegated responsibility for AI development entirely to technical teams." It does not expect senior managers to be technical specialists. It does expect them to own the outcome.

Outsourcing does not move responsibility. "Firms can outsource AI services, but remain responsible for them." Good practice includes getting notice of significant changes to vendor models, avoiding dependence on a single vendor, and treating AI dependencies as part of operational resilience planning.

Outcomes, not outputs. "Where firms are deploying AI-supported tools, they remain responsible for consumer outcomes." The FCA wants firms to define the consumer need before deployment, test outcomes across consumer groups, and monitor live outcomes. It warns against excluding consumers in vulnerable circumstances by default, and notes that "effective oversight is not simply about reviewing AI outputs."

On agents specifically, the review says agentic AI needs stronger controls because it "can operate more independently." It points to firms that keep a central inventory of their agents and design escalation routes before deployment.

Rusu's speech goes further. She describes a move from "technology that helps us understand and decide, to technology that can increasingly act on our behalf," and notes that greater autonomy changes the risk. On incidents: "Our rules already require firms to report major incidents, and that must extend to significant AI failures and near-misses." On assurance, she observes that a system safe at deployment "may behave differently at scale, under stress or as the models beneath it change," and concludes: "Agentic systems therefore require continuous, conditional assurance." The FCA plans to work with industry, other regulators and frontier labs to "develop a trusted framework for agentic finance," with "clear approaches to agent identity, delegated authority, accountability and execution."

The problem: three gaps the FCA named

Each expectation maps to one part of the AI Cognition Gap: the distance between what models can do and what a regulated enterprise needs them to do.

Context. Testing outcomes across consumer groups, and protecting vulnerable customers, requires the enterprise's own knowledge: its products, its policies, its customer segments, its suitability rules. A general-purpose model does not carry that context. An agent grounded in partial or ungoverned context cannot show that it treated a vulnerable customer appropriately.

Learning. The FCA expects firms to know when a vendor changes its model and to avoid lock-in to one provider. That matters more as agents improve through use. If what an agent has learned about the firm's work sits inside a vendor's system, a model change can quietly change behaviour, and a vendor exit means losing that learning.

Governance. Accountability from design onwards, an inventory of agents, incident and near-miss reporting, and ongoing assurance all depend on evidence. Firms need to be able to show what an agent drew on, what it was permitted to do, what it did and what followed, not only at sign-off.

The objective: continuous, conditional assurance

“Agentic systems therefore require continuous, conditional assurance.”

Jessica Rusu, Chief Data, Information and Intelligence Officer, FCA · 19 October 2026

The phrase that matters most in the FCA's agentic-finance remarks is "continuous, conditional assurance."

Continuous means assurance cannot end at deployment. Systems need ongoing monitoring, evidence of their behaviour and mechanisms to detect when outcomes or risks change. For higher-risk agentic workflows, that may mean producing evidence for every material action.

Conditional means assurance depends on the conditions under which a system operates. Changes to a model, data source, permissions, policy or operating environment may invalidate earlier assessments and trigger renewed checks.

The implication is significant: enterprises need more than a pre-deployment approval and a dashboard of model metrics. They need a way to connect each material AI action to the context, authority, controls and outcome surrounding it.

Why orchestration cannot assure itself

Agent orchestration platforms are improving quickly. They route tasks, call tools and coordinate multiple agents. They are not designed to be the independent check on those agents.

The point is architectural rather than about any single model or vendor: a control that sits inside the agent's reach is not an independent control. The FCA's own framing points the same way. If systems "may behave differently at scale, under stress or as the models beneath it change," the evidence of that behaviour cannot depend solely on the system being assessed.

Regulated firms already apply this principle elsewhere. Risk and compliance functions are independent of the business lines they oversee. AI needs the same separation. One way to address this challenge is to separate three functions: discovery, which finds enterprise information; orchestration, which runs agents; and an independent policy and evidence layer, which governs what agents may know and do and records what happens. To be effective, that layer has to cover third-party agents as well as the firm's own.

The solution: knowledge, memory and governance as one system

This is the layer NeoSapients is building with its Enterprise Cognition Platform. It addresses the AI Cognition Gap through three pillars designed to work as one system. None of them replaces a firm's own governance, accountability or judgement; they give the firm better material to exercise it with.

Knowledge Mesh

Knowledge Mesh connects agents to the firm's own context, such as product information, policies and rules, under the firm's access controls. Better-grounded context supports the outcome testing and vulnerable-customer considerations the FCA describes, though firms still need to design and run that testing themselves.

Cortex Engine

Cortex Engine holds what agents learn from the work as institutional memory that the firm can inspect, edit and export. That helps a firm understand what its agents have learned, and reduces how much of that learning is tied to a single model vendor.

Outcome Ledger

Outcome Ledger records agent actions alongside the context, permissions and policy they ran under, and the outcomes that followed. That record can support a firm's assurance, incident and near-miss reporting and agent inventory. It does not, by itself, constitute assurance; firms decide what evidence is material and how it is reviewed.

Context → Memory → Governance: designed to work as one system

The pillars are designed to work together because each is weaker alone. Knowledge without memory is brittle. Memory without governance is dangerous. Governance without knowledge is hollow. The FCA's expectations touch all three.

What to do before the framework arrives

The FCA's agentic-finance framework is still being designed. Firms do not need to wait for it to act on what the regulator has already said.

The FCA has made the challenge clear: as AI moves from generating answers to taking action, enterprises need to demonstrate not just what their systems can do, but how those systems are governed in practice.

The firms that prepare now will be better positioned to deploy agentic AI with the accountability, evidence and control that regulated environments demand.

The next layer of enterprise AI isn't just about making agents more capable. It's about making their actions governable.