Emma Banymandhub, CEO of The Payments Association, has spent more than 15 years in leadership, driving expansion and revenue growth. Now, she shapes The Payments Association’s strategic vision to supercharge its next phase of growth.
Would you let an AI agent do your weekly shopping? Many people would and far more will in the future as agentic commerce moves from novelty to default. The more difficult question for the investment sector is what happens when consumers ask the same agent to manage a slice of their savings, an ISA, or even a pension.
We are not there just yet. Today’s large language models are authorised to discuss portfolio diversification, explain tax-advantaged wrappers and help research individual stocks, but they must stop short of an actual recommendation. The constraint is regulatory rather than technical, and it may be temporary – specialist agents are already being built. Investment platforms should assume those agents will arrive on their interfaces before the regulatory rulebook catches up.
We are already seeing this happening in other sectors.
Research my organisation recently published into UK online retail found that 58 per cent of merchants believe AI agents have already transacted on their platforms, and 72 per cent are actively preparing or planning. Only 41 per cent feel confident in the liability frameworks surrounding those transactions. Retail is moving faster than its governance, and the card schemes are scrambling to keep up. Visa, Mastercard, American Express and UnionPay have all launched agent frameworks in the past twelve months. None of those frameworks currently extends to investment journeys, but the direction of travel is irrefutable
For investment platforms, the questions go considerably deeper than retail dispute resolution. Three regulatory obligations are about to be tested.
The first is suitability. If a consumer asks an agent to “invest £10,000 to maximise returns” and the agent selects and executes a portfolio, has a personal recommendation been made? If so, by whom? The agent’s developer is unlikely to be FCA-authorised. The platform that processes the trade may argue it was execution-only. Yet from the customer’s perspective, advice has plainly been given. The current advice boundary, drawn around human conversations and clearly framed disclaimers, does not work with a tool that interprets intent, weighs options and acts.
The second is Consumer Duty. Firms are required to deliver good outcomes for retail customers across products, value, understanding and support. When an agent sits between the customer and the platform, the consumer understanding outcome becomes particularly difficult. The customer may never see the risk warnings, key information documents or product disclosures the platform is required to show them. Their agent does. Can a platform demonstrate it has enabled the customer’s understanding when the agent is the actual reader? The cross-cutting rule on foreseeable harm, the one that bites hardest in disputes, asks whether firms could reasonably have anticipated a problem and acted on it. Agent-mediated journeys will fall squarely within that test.
The third is accountability under the Senior Managers and Certification Regime. SMCR makes individual senior managers personally responsible for the activities of their firm, and the FCA has been consistent that AI does not dilute that responsibility. If an agent-driven investment decision leads to consumer harm, a named senior manager will be expected to demonstrate the reasonable steps they took to prevent it. Few firms today have mapped agent oversight to a specific SMF role, and fewer still have the data and controls to evidence those steps.
This is precisely why the FCA’s Mills Review matters in practice rather than just in principle. Reporting to the FCA Board this summer, it is the most significant signal of how UK supervisors expect firms to govern, oversee and take accountability for AI-enabled activities in the absence of specific AI legislation. Firms waiting for a dedicated AI rulebook are waiting for the wrong thing. Existing rules already apply, and the Mills Review will set the supervisory expectations against which compliance is tested.
The practical takeaway is to start with what platforms control.
Terms of business written for a human user will not work for an agent acting on delegated instructions. Suitability frameworks need to address what happens when a user’s stated objective is mediated through an agent’s interpretation of it. Senior manager statements of responsibility need to name an owner for agent oversight. Audit trails need to capture the chain of intent from the customer’s original instruction through to the agent’s execution, in a form that can be tested under Consumer Duty.