Agentic AI and SM&CR Accountability

When an AI agent acts on a bank’s behalf, what is the senior manager accountable for?

From assistance to action

UK retail financial services are moving from AI that assists a colleague toward AI that recommends, prepares, and, within bounds a person has set, acts. The Mills Review, published by the FCA on 6 July 2026, describes that path as an autonomy spectrum. A person operates the tool, works with it, takes its recommendation, authorises what it has prepared, or monitors while it acts inside agreed limits.

The work being put on that path is already familiar. Client requests are routed. Customer questions are answered. Production code is written and modernised. A further step, as agents take on more of the work, is an agent that builds, tests, secures, and operates.

What the Review says the regime already covers

The Senior Managers and Certification Regime, SM&CR, is the UK’s personal-accountability regime for regulated firms. The Review’s finding is about the Senior Managers Regime within it. That regime names a senior manager, requires that person to take reasonable steps to prevent regulatory breaches in their area, and records the area in a Statement of Responsibilities.

The Review finds that the UK’s principles-based framework is a credible foundation. The Consumer Duty, the Senior Managers Regime, and operational resilience continue to apply. It does not recommend a new Senior Management Function. Its third recommendation is to watch the move toward autonomous models and to adapt the frameworks that already exist.

The Review says the Senior Managers Regime remains robust where the person is the operator, the collaborator, or the consultant. At the approver and observer end, it says that without guidance, the opacity of more autonomous systems, and model drift, make it harder to identify who is in fact responsible, and harder for that person to show meaningful human control.

Firms that responded asked for clearer guidance on the reasonable steps a senior manager must take. The Review records that request. The Review is not Handbook guidance. As of 12 October 2026, the FCA’s AI Lab still says it will publish examples of good and poor practice later in 2026. Dedicated guidance on reasonable steps for AI has not been issued.

The regime names the person

This is our reading of what the Review leaves open. The Senior Managers Regime names who is accountable. Reasonable steps in that area include the governance of the work. The regime does not prescribe a versioned object for the decision itself.

For a long time, firms have shown that governance by pointing to a process and to the policy on that process. Assurance then asks whether the case followed that policy. The policy is written against the steps. It says which checks happen, in which order, and which guidance those checks implement. The outcome is what those steps were expected to produce. The policy covers the process more closely than it covers the outcome. The Consumer Duty already asks about outcomes. The file many firms can produce is still the file of the steps.

That file is the shape of the explanation firms have often given for a poor outcome. A complaint is upheld, a credit decision is later found wanting, an onboarding lets through a case that should have stopped. The firm shows that the fixed steps were taken, and that those steps were the ones the policy and the guidance required. Process assurance was built for a path that stays the same from case to case. Showing the steps is not, by itself, an answer to the outcome.

When the agent chooses the path

An agent can choose a different path. It can select the evidence, the tools, the order of the steps, and whether to escalate. Two cases that look like the same journey can be different sequences. A designed workflow may still exist. Conformity to one fixed sequence no longer captures the path.

Governance that can still be shown then has to be able to say whether this trace met this goal. The senior manager still owns the governance of the area. The claim is that this trace meets this goal, relative to the assumptions the claim depends on, and that those assumptions cover the floor the institution required. That formulation is set out in Goal-Relative Assurance.

An agentic decision rests on more than its outcome. It rests on a governing goal, a floor, a trace, and a residue. The floor is what every acceptable action must satisfy. The trace is the path the agent was allowed to take. The residue is what is still trusted once everything that can be proved has been proved. The boundary is the set of assumptions that claim depends on. The gate is whatever allows or blocks the action before it runs. If the floor lives only in policy prose, and is interpreted during the run, there is nothing fixed to measure those reasonable steps against.

The file after an incident

The usual record is assembled afterwards from what the firm already keeps: logs, accuracy figures, and the fact that a person saw the file. That record is the old form of assurance. It shows the item passed the expected desks. Where the agent chose the path, passing those desks is the old process evidence. The file does not show that the decision met the floor the senior manager approved.

An object the senior manager owns

A firm can name that object before a new rule arrives. For each class of delegated action, a named senior manager owns the goal, the floor, and the acceptable residue as versioned artefacts. Changing one of them is a governance event, not only a deployment. Every gated action records which version governed it.

The agent does not define that object.

Owning a versioned floor does not show that the floor was the right reading of the rule. It is not a claim that an examiner has accepted the record.

When AI rolls out across the area

Where there is a material rollout of AI in the area a senior manager owns, reasonable steps depend on that person knowing what has changed. In our reading, those steps have to be able to point to a specific account.

That account says where an agent can act, and which records or decisions it can change. It says whether that agent still follows a fixed process, or can choose the path. For each class of delegated action, it names the goal, the floor, and the residue, and which version is in force. A change to any of those is a governance event the senior manager should see as it happens. A release note that only says a new tool was added does not record that event.

They also need to know the limit of what they then hold. A versioned floor shows what the gate was enforcing. It does not show that the floor was the right reading of the rule, and a file of the old process steps does not stand in for it.

The product owner informs that senior manager

Naming a senior manager does not move the work of informing them onto them alone. The people who own the AI product are the ones who can see what it can do. Reasonable steps are taken on the account those people give.

Where the conduct rules apply to a product owner, they require due skill, care and diligence. Applied to a material change in how the area decides, that care includes giving the responsible senior manager an account of where the agent acts, what it can change, whether it can choose its own steps, and which version of the goal and the floor it is running. Describing an agent that chooses its path as a tool that follows the existing process leaves the senior manager named for the area, and unable to show reasonable steps for a rollout they were not shown.

What we would want those examples to show

The FCA has said the examples of good and poor practice are still to come. Riley Betts would like the good examples to include the following. The senior manager can say where an agent in their area can act, and which records or decisions it can change. The senior manager can say whether that agent still follows a fixed process, or can choose the path. For each class of delegated action, the goal, the floor, and the residue are versioned, and that senior manager owns them. The floor is what every acceptable action must satisfy. The residue is what is still trusted after that. A change to any of them is brought to the senior manager as a governance event. The product owner gives that account. The senior manager is not left to discover the rollout from a release note.

Riley Betts would like the poor examples to include the following. A release note that only says a new tool was added, offered as the record of the change. An agent that can choose its path, described as a tool that follows the existing process. A file assembled afterwards from logs, accuracy figures, and the fact a person saw it, treated as proof that the decision met the floor the senior manager approved.

These are the examples Riley Betts would want published. They are not a statement that a firm which does the first list has taken reasonable steps, and they are not a forecast of what the FCA will write.

Where the argument is set out

The argument is developed in three papers: Trust and Proof, Goal-Relative Assurance, and Agentic Process Governance. The same question for the architecture of the action is Agentic AI in financial services. The gate on that action is Proof-gated architecture. A firm that wants to write the object for one workflow can start in the agentic governance and policy workshop.