The GRC Navigator

Executive Summary

On 6 July 2026 the FCA published The Mills Review, a Board-commissioned study led by executive director Sheldon Mills into how artificial intelligence will reshape retail financial services by 2030 and beyond. Drawing on a survey of more than 5,000 consumers and making seven priority recommendations, it concludes that the current regulatory framework does not need replacing but does need to adapt, with the Consumer Duty and the Senior Managers Regime as its foundations. For fund managers, this points to AI governance becoming a supervised matter rather than an innovation-team topic.

The prudential regulators were busy in the same fortnight. On 7 July the Bank of England published its July Financial Stability Report, its first findings from the private markets stress exercise, and a Financial Policy Committee record flagging frontier AI as an emerging source of system-wide cyber risk. The FCA also moved to simplify consumer investment cost disclosures in CP26/24, and the second phase of its Senior Managers Regime reforms took effect on 10 July. In the market, hedge fund assets hit a record 5.22 trillion dollars while private credit split into two speeds, with institutions committing billions as retail investors pulled back. The common thread across the fortnight: regulators are setting supervisory expectations for AI and private markets before the risks fully materialise.

Top Story

The Mills Review Puts AI Governance Under Supervision

HIGH RISK · Sectors: Asset Management, All Regulated Firms, Wholesale Markets

On 6 July 2026 the FCA published The Mills Review, a study into the long-term impact of artificial intelligence on retail financial services commissioned by the FCA Board and led by executive director Sheldon Mills. The FCA describes it as the first work of its kind initiated by a regulator anywhere in the world. It looks toward 2030 and beyond, draws on a survey of more than 5,000 UK consumers and international comparison, and makes seven priority recommendations for the Board to consider.

The Review's central judgement is measured. It concludes that AI is likely to become central to retail financial services, but that the regulatory framework does not need to be replaced. Its foundations remain sound where AI supports human decisions. The framework was built for human-intermediated finance, where decisions are made by people, approved by people, with clear lines of accountability to named individuals. Agentic AI, systems that reason, decide and act for the consumer, changes that premise, and the Review sets out a spectrum of AI autonomy running from tools that assist to agents that execute.

Four system shifts: The Review anticipates the transformation of firms, new consumer journeys, reshaped competition, and amplified financial crime and cyber risk as AI capability advances.
The Duty and SM&CR hold: The FCA's principles-based, outcomes-focused approach, anchored on the Consumer Duty and the Senior Managers Regime, is presented as the reason the framework can adapt rather than break.
Progressive adaptation: The conclusion is explicit: progressive adaptation, not wholesale replacement, with the regulator itself expecting to deploy AI to supervise at the speed AI systems create risk.
A roadmap, not a rulebook: The seven recommendations are a roadmap for how industry, regulators and government prepare for the next phase, not a set of new rules firms must implement now.

Treat it as more than future-gazing. When a regulator publishes a formal review concluding that accountability to named individuals is central to AI safety, it points to where supervisory attention will fall. If an AI system recommends, initiates or executes a decision inside your firm, the Review's logic says a named person under SM&CR owns the outcome, and the Consumer Duty measures whether that outcome was good.

Fund boards should read The Mills Review as a supervisory preview. The question a CCO should put to the board this quarter: for every material use of AI in our firm, from client communications to portfolio tools, can we name the Senior Manager accountable and evidence the controls around it? If AI is already making or shaping decisions and no one owns them under SM&CR, that is what the next supervisory conversation will probe.

The Mills Review means every material use of AI in a firm needs a named Senior Manager who owns the outcome and can evidence the controls.

Asad Bukhory

Regulatory Updates

FCA Moves to Simplify Investment Cost Disclosures in CP26/24

MEDIUM RISK · Sectors: Asset Management, Wealth Management, Retail Distribution

In July 2026 the FCA published CP26/24, proposing to simplify how platforms, advisers and wealth managers disclose the cost of investing, with responses due by 21 August 2026. The paper aligns the cost disclosure rules inherited from MiFID with the new Consumer Composite Investments regime finalised in PS25/20, consolidating requirements across MiFID, the Insurance Distribution Directive and non-MiFID investment business.

Distributor costs in view: Distributors would present their own costs alongside product costs in the CCI format and account regularly for the total cost of investing.
The scale: More than 12.6 million UK adults, 23 percent of the population, hold an investment that falls within the CCI definition, so the readability of these documents is a mass-market issue.
Duty-led: The FCA leans on the Consumer Duty to reduce prescription, trusting outcomes rather than templates, with a policy statement expected by the end of 2026.

Lucy Castledine framed this as clearer information in plain English, and the FCA's own testing found disclosure documents pitched above GCSE reading level. For fund manufacturers the CCI transition is a Consumer Duty consumer-understanding obligation, not a formatting task. Firms should be testing whether a real retail investor can actually understand their cost disclosure, because that is the standard the Duty now sets.

Senior Managers Regime Reforms Enter Force on 10 July

MEDIUM RISK · Sectors: All Regulated Firms, Asset Management

The second phase of the FCA's Senior Managers and Certification Regime reforms, set out in PS26/6, came into force on 10 July 2026. The changes refine how firms are classified as enhanced-scope SMCR firms, update the financial qualification thresholds in SYSC 23, and simplify elements of the regime in parallel with the PRA's own Phase 1 reforms finalised earlier in the year.

Threshold recalibration: The financial qualification conditions that determine enhanced-scope status, including assets under management tests, are updated with effect from 10 July 2026.
Proportionate simplification: The reforms aim to make the regime more effective and proportionate without weakening individual accountability.

The timing matters. SM&CR reform lands in the same fortnight The Mills Review names the Senior Managers Regime as the mechanism that makes AI accountability workable. Firms should not treat these as separate developments. The regime is being refined just as the FCA looks set to rely on it more for emerging risks like agentic AI.

Investment Trust Disclosure Forbearance Continues Under CCI

LOW RISK · Sectors: Investment Trusts, Asset Management, Retail Distribution

The FCA's forbearance on investment trust cost disclosure remained in place through early July, with closed-ended UK-listed investment funds to be brought within the future Consumer Composite Investments regime rather than the legacy PRIIPs rules. The approach is designed to address long-standing complaints from the investment trust sector that inherited EU cost disclosure requirements distorted how their charges were presented.

Sector-specific fix: The CCI regime is intended to cater for closed-ended UK-listed investment funds while still giving consumers appropriate information.
Connected to CP26/24: The disclosure simplification and the investment trust forbearance are two arms of the same effort to rebuild UK retail disclosure after PRIIPs.

PRA Developments

The July Financial Stability Report Reads Across Housing, Leverage and Private Markets

MEDIUM RISK · Sectors: Banking, Private Credit, Asset Management

On 7 July 2026 the Bank of England published its July Financial Stability Report alongside the Financial Policy Committee record, a Financial Stability in Focus on the bank capital framework, and initial findings from its private markets system-wide exploratory scenario. The FPC reported that the share of high loan-to-income mortgage lending is moving closer to its aggregate 15 percent limit, evidence that its updated recommendation is working as intended.

Leverage ratio reform: The FPC and PRA intend to consult on a more proportionate, better-targeted leverage ratio framework, including a releasable general leverage ratio buffer that could be cut to zero in stress.
Bank capital framework: The accompanying Financial Stability in Focus sets out progress on making the UK bank capital framework more effective and proportionate, with an update on domestic-exposure capital interactions due in the Q4 2026 Report.
Private markets in scope: The Report carries the first read-out from the private markets stress exercise, keeping fund liquidity, leverage and valuation on the macroprudential agenda.

For asset managers the housing and leverage detail is background, but the private markets thread is not. The Bank has now put a severe but plausible private markets stress into the public record and will report interim findings later in 2026. Managers with private credit or private equity exposure should assume their liquidity and valuation assumptions will be benchmarked against the Bank's scenario, and prepare accordingly.

The FPC Names Frontier AI as an Emerging Cyber Risk

MEDIUM RISK · Sectors: Banking, All Regulated Firms, Wholesale Markets

The Financial Policy Committee record published on 7 July 2026 flagged frontier AI as a growing source of system-wide cyber risk. The Committee noted that the Cross Market Operational Resilience Group discussed the sector's response to emerging frontier AI models in May 2026 and issued guidance on frontier AI and cyber resilience in June, and that the Bank and PRA's upcoming consultation on Cyber and Information and Communication Technology risk management would consider frontier AI cyber risks.

A coordinated front: The FPC's AI cyber concern runs alongside the Financial Stability Board's consultation on the responsible adoption of AI, aligning UK and international work.
Consultation incoming: A Bank and PRA consultation on Cyber and ICT risk management is signalled, which will fold frontier AI into operational resilience expectations.

Fund Launches & Capital Raises

SEI Plans Two UK Long-Term Asset Funds in Private Markets Push

INFO · Sectors: Asset Management, Private Equity, Wealth Management

SEI announced plans to launch two Long-Term Asset Funds as part of a private markets expansion, reported on 2 July 2026, describing the move as aligned with the UK government's Mansion House ambition to widen access to private assets. The LTAF wrapper is the FCA-authorised vehicle designed to give defined contribution pensions and wealth channels access to illiquid private-market strategies within a governed structure.

Accelerating launches: LTAF launches are accelerating as UK policy channels long-term capital toward private markets and infrastructure.
DC and wealth reach: The vehicles are aimed at the pension and wealth channels that Mansion House reforms are trying to connect to private assets.

Aberdeen Adds £1.5bn of Closed-End Assets in MFS Transaction

INFO · Sectors: Investment Trusts, Asset Management

Aberdeen bolstered its closed-end fund assets under management through a transaction with MFS, adding assets totalling around 1.5 billion pounds, reported on 3 July 2026. The deal expands Aberdeen's investment trust platform at a moment when the closed-ended sector is under simultaneous pressure from activists and from the FCA's proposed listing-rule changes for investment funds.

Scale in a squeezed sector: Adding 1.5 billion pounds of closed-end AUM is a bet on the investment trust structure even as consolidation and activism reshape it.
Regulatory backdrop: The move lands weeks after the FCA's CP26/21 proposed targeted listing-rule changes for closed-ended investment funds.

Enforcement Watch

AI-Amplified Financial Crime Becomes the Next Enforcement Focus

HIGH RISK · Sectors: Financial Crime, All Regulated Firms

The fortnight produced no major fine, but it did sharpen where enforcement risk is heading. The Mills Review identified amplified financial crime and cyber risk as one of four system shifts AI will drive, and the Financial Policy Committee named frontier AI as an emerging source of system-wide cyber risk on 7 July 2026. Together they describe an enforcement environment where the threat is getting faster and more automated while firms' controls were built for a slower era.

This continues the theme Therese Chambers set out in June, that the FCA increasingly relies on the credible threat of enforcement and proactive detection rather than headline penalties alone. As AI makes financial crime cheaper and harder to see, the supervisory expectation on systems and controls under SYSC rises correspondingly.

Controls under strain: Financial crime frameworks designed for human-paced fraud face an AI-accelerated threat that can outrun periodic monitoring.
Cyber and resilience converge: The upcoming Bank and PRA Cyber and ICT consultation will pull frontier AI into operational resilience obligations, widening the enforcement surface.

A quiet month for fines does not mean the risk has eased. The FCA and the Bank have spent the fortnight describing an AI-driven threat their supervisory expectations are being rebuilt around. MLROs and Heads of Financial Crime should be asking whether their transaction monitoring and fraud controls have been tested against AI-enabled attacks, and whether a named Senior Manager could evidence that testing to a supervisor today.

Market Developments

Hedge Fund Assets Hit a Record as Launches and Closures Both Climb

INFO · Sectors: Asset Management, Wholesale Markets

Global hedge fund assets reached a record estimated 5.22 trillion dollars by the end of the first quarter of 2026, according to HFR, while both new launches and liquidations accelerated in a volatile start to the year. Equity Hedge strategies led new formation with an estimated 80 launches in the quarter, followed by Macro with 52, and the same two groups also recorded the most closures.

Volatility breeds churn: Geopolitical tension, AI-driven market concentration and macro uncertainty are driving both record capital and higher turnover among managers.
New benchmarks: HFR launched Tender Offer Funds Indices tracking the growing cohort of tender-offer hedge funds, with the asset-weighted version up 3.4 percent year to date through 10 July 2026.

Record industry assets alongside rising closures points to dispersion rather than a broad boom. Allocators are rewarding a narrow band of managers and cutting the rest, which raises the governance stakes on manager selection and monitoring for any fund board or allocator. That concentration of capital also concentrates operational and counterparty risk.

Private Credit Splits Into Two Speeds

MEDIUM RISK · Sectors: Private Credit, Asset Management

Large institutional investors continued to commit billions of dollars to private credit funds even as retail investors pulled back, reported by Private Equity Wire on 6 July 2026, exposing a widening divergence in how the two investor bases view the asset class. Institutions are leaning in on the expectation of attractive risk-adjusted returns while wealth-channel investors, unsettled by redemption headlines, grow cautious.

The split arrives as the Bank of England puts private markets through a severe but plausible stress scenario and reports its first findings in the July Financial Stability Report. The question underneath the two-speed market is whether retail liquidity expectations and the illiquid reality of private credit can coexist in the same vehicles.

Divergent conviction: Institutional commitment and retail caution are pulling in opposite directions, testing the retail democratisation thesis for private markets.
Liquidity mismatch: The core governance risk remains the gap between the liquidity retail investors expect and the illiquidity of the underlying assets.

Regulatory Calendar

July 2026

10 Jul Second phase of FCA Senior Managers Regime reforms (PS26/6) takes effect.
13 Jul FCA CP26/17 Quarterly Consultation No. 52, Chapters 2 to 7, closes; short selling aggregate net short position publication begins (PS26/5).
28 Jul FCA CP26/18 mortgage rule review closes.

August 2026

10 Aug FCA CP26/19, penalty and decision-making policy changes, closes.
14 Aug FCA CP26/21, listing rules for closed-ended investment funds, closes.
21 Aug FCA CP26/24, simplifying consumer investment disclosures, closes.
24 Aug FCA CP26/20, SIPP due diligence and asset protection, closes.

September 2026

1 Sep New non-financial misconduct guidance takes effect (PS25/23, COCON 1.1.7FR).
4 Sep FCA CP26/22, simplifying the insurance rules, closes.
18 Sep PRA CP9/26, Basel 3.1 internal model approach for market risk, closes.
19 Sep FCA CP26/23, Consumer Duty scope in wholesale markets, closes.

Key Dates Later in 2026 and Beyond

Sep 2026 Crypto firms can begin applying to the FCA for authorisation.
1 Jan 2027 Basel 3.1 standards take effect in the UK.
8 Jun 2027 Consumer Composite Investments regime comes into full force.
25 Oct 2027 New UK cryptoasset regulatory regime commences.

Question of the Week

The Mills Review concludes that accountability to a named individual is central to AI safety. For every material use of AI in your firm, from client communications to portfolio construction, can you name the Senior Manager who owns the outcome and evidence the controls around it? If an AI system is already shaping decisions and no one owns them under SM&CR, you already have a gap to close.

We'd welcome your perspective. The best responses may feature in a future edition.

Insight

The common feature of early July was pre-emption. The FCA's Mills Review, the Bank of England's private markets stress findings and the Financial Policy Committee's frontier-AI cyber warning all take the same approach: set supervisory expectations before the risk fully lands. These roadmaps address problems the regulators can see coming, before they have fully materialised.

For fund managers this shifts the compliance question from what the rules require today to what the supervisor will expect tomorrow. The Mills Review is explicit that the Consumer Duty and the Senior Managers Regime are the instruments through which AI will be governed. That means an AI control gap is an accountability matter that sits with a named Senior Manager and is measured against consumer outcomes, rather than a technology issue to hand to the CTO.

The practical move this fortnight is to inventory AI honestly. Ask where AI already recommends, initiates or executes decisions in your firm, name the Senior Manager accountable for each, and test whether you could evidence the controls to a supervisor from your records. Do the same for private-market liquidity and valuation against the Bank's stress scenario. Firms that map their AI and private-market risk to named owners now will be ready when the supervisor asks.

Asad Bukhory | Founder, Artizan Governance