The regulator is building
to see risk earlier. Are you?

This is not an article about what the FCA wants firms to report. It is about what the FCA itself is becoming.

The regulator is investing in data, analytics, artificial intelligence and new supervisory methods to identify harm earlier, process evidence faster and make better-targeted decisions. At the same time, it is reducing lower-value reporting and explicitly trying to support growth. That combination matters.

The strategic question for firms is not whether they should copy the FCA’s technology. It is whether their own operating model can understand and explain their regulatory position at the speed at which supervision is evolving.

The regulatory model is changing in plain sight

The FCA’s 2026/27 work programme describes a regulator that wants its digital and data capabilities to enable smarter and faster decisions. It is integrating AI into regulatory workflows, using analytics to identify harm faster, testing data feeds with firms and strengthening data-led financial-crime detection by integrating multiple datasets. [2]

The signal is not that firms should collect more data. It is that regulatory effectiveness is increasingly being built around the ability to interpret evidence faster, connect context and target action.

The future of supervision is not another return

One of the most interesting features of the FCA’s current programme is the tension between two things that can look contradictory: it wants richer intelligence, but it also wants to reduce unnecessary administrative burden.

The 2026/27 work programme says the FCA will retire regular returns that are no longer needed, reduce the frequency of another, reduce nil-return requirements and test direct data feeds with participating firms. In parallel, it is investing in data analytics, digital tools and AI. [2] [3]

That matters because it points away from a model where regulatory confidence is created by asking for ever more information. The direction is towards making better use of the information that matters.

The regulator is joining signals

The strongest evidence of the shift is in the FCA’s own language about intelligence. Its 2025/26 enforcement reporting describes a data-led regulator using intelligence and analytics to identify emerging risks and prevent harm. Its 2026/27 programme commits to integrating multiple datasets to identify financial crime earlier and intervene more quickly. [2] [8]

A September 2026 FCA speech went further: the regulator said its financial-crime intelligence systems process more than 56 million records every day, combine data with partners and flag higher-risk firms earlier. It also said the FCA is exploring the potential for agentic supervision. [9]

Elsewhere, the FCA has published work showing how richer credit-file data and analytics can be used to track consumer journeys and understand financial distress earlier. [4]

Your regulator should not see your risk before you do

This is the uncomfortable implication. A regulator can legitimately build a wider external view of firms, markets, consumers and emerging harm. A firm, however, has something the regulator does not: the deepest access to its own customers, journeys, products, controls, services, incidents and evidence.

If that evidence remains fragmented across functions, the organisation can create an avoidable asymmetry: the regulator may be improving its ability to connect external and submitted signals while the firm is still reconciling its own position manually.

The answer is not to become adversarial or to build technology simply to “beat” supervision. The answer is much more basic: the enterprise should be capable of understanding its own position before somebody outside the enterprise has to explain it.

AI is changing supervision before it changes the rulebook

The FCA has been clear that it does not plan to introduce a separate body of AI regulation simply because AI is being adopted. It intends to rely on existing frameworks including the Consumer Duty, SM&CR and governance and control expectations. [5] [10]

At the same time, the FCA itself is using predictive AI, experimenting with large language models and rolling generative AI into parts of authorisation and supervision. In July 2026, the regulator also published the Mills Review on how AI could reshape retail financial services by 2030 and beyond. [6] [10]

That combination matters. Firms cannot wait for a future “AI rulebook” before deciding how they will evidence accountability, outcomes, controls and customer impact. The existing obligations remain; the technology and the pace of decision-making are changing around them.

AI does not remove the need for regulatory evidence. It raises the value of connected evidence.

The regulator is trying to rebalance risk. Firms need the evidence to do the same.

The FCA’s 2025–30 strategy puts four priorities side by side: being a smarter regulator, supporting growth, helping consumers and fighting financial crime. That is important because it rejects the idea that consumer protection, risk management and growth are separate conversations. [1]

The regulator has explicitly argued that financial services can become too focused on the risk of a decision and not enough on the lost opportunity of taking none. For Boards, that creates a more demanding standard. Growth cannot simply be waved through, but neither should weak evidence automatically produce delay.

The firm needs to distinguish a genuine regulatory constraint from an evidence gap, a control weakness or a risk that can be managed.

Regulatory intelligence is therefore not only about responding to scrutiny. It is part of the evidence base for making better strategic decisions.

This is not about copying the FCA’s technology stack

The useful lesson is architectural, not technological. The FCA is building capabilities to connect information, prioritise risk and make faster decisions. Firms need the equivalent capability inside their own business context, not the same systems.

That does not require one giant regulatory data warehouse. It requires a common map of what the evidence means and how it relates.

The source systems can stay where they are. The intelligence layer needs to know what the evidence represents, where it lives and how the relationships change risk.

The firm needs to see the position before it has to defend it

The operating model can be described simply. A signal says something changed. Triangulation tests whether independent evidence is converging around the same business context. Impact analysis establishes who and what is affected. Causal investigation tests why the outcome changed. Strategic resolution determines what the enterprise should do.

That sequence matters because faster supervision does not make Board judgement less important. It makes traceability, context and speed more important. The firm needs to be able to move from a regulatory question to an evidenced enterprise answer without reconstructing the position from separate functional packs.

The regulator is modernising how it sees risk. The enterprise needs to modernise how it understands itself.

Five questions that should now be asked