Governance Is Becoming a Capability: What the Mills Review Means for AI in Lending
| Key takeaways 1. Governance is becoming a capability, not overhead. The Mills Review (FCA, July 2026) finds the regulatory framework does not need rewriting. What changes is the burden of proof: as AI moves from recommending actions to taking them, the firms that pull ahead will be those that can evidence what their systems did and why. 2. The lender must stay in control. The Review is clear that delegation does not transfer accountability. A firm remains responsible for its outcomes even when it relies on third-party models, and the Review names concentration, lock-in and loss of sovereignty as systemic risks. 3. Where the human sits should be a deliberate choice. The Review's “autonomy spectrum” runs from operator to observer, and it uses SME and specialist lending as its worked example of AI recommending decisions while underwriters guide the edge cases. |
On 6 July 2026 the Financial Conduct Authority published the Mills Review, AI and the future of retail financial services, led by executive director Sheldon Mills and commissioned by the FCA Board. It is the first review of its kind initiated by any regulator globally, and the most complete official picture yet of how artificial intelligence is likely to reshape lending, insurance, payments and advice between now and 2030. For anyone building or buying lending technology, it repays close reading.
That is because, underneath the forecasting, sits a single practical argument. As AI moves from recommending actions to taking them, the firms that pull ahead will be the ones that can evidence what their systems did and why. The Review is blunt that the framework itself does not need rewriting: the Consumer Duty, the Senior Managers Regime and operational resilience were designed to flex across changing business models. What changes is the burden of proof. Governance, model risk management, explainability and auditability stop being compliance overhead and start being the thing that lets a firm deploy AI with confidence.
In the Review's own words, governance becomes a key enabler of capability and competitive advantage. We think that is exactly right. And it happens to describe the principle ezbob has built its platform around from the start.
The Mills Review by the numbers
The lender stays in control
The Mills Review is careful to point out that delegation does not transfer accountability. A firm remains responsible for the outcomes it produces even when it relies on third-party models, external agents or infrastructure it did not build. The Review also flags the systemic risk of everyone depending on the same handful of upstream providers, and it names cost, concentration, vendor lock-in and sovereignty as factors that could become critical to resilience.
ezbob was designed around one governing principle: the lender must always be in control of the process. Credit policy, product design and the customer experience are competitive differentiators that belong to the client, not defaults imposed by a vendor. In practice that means credit rules, scoring models, cut-offs, affordability thresholds and product eligibility are all configurable by the client's own credit and operations teams. No support ticket, no release cycle, no dependency on us to change a policy.
Clients retain full control of their data and their decisions, with documented data portability and orderly exit rather than a captive ecosystem. Where the Review warns about accountability becoming harder to trace, and about firms becoming dependent on providers they cannot steer, it is describing the failure mode our architecture is specifically meant to avoid.
Explainable by design, not after the fact
One of the Review's clearest signals is the shift toward architectures that can show their reasoning, combining machine-learned models with rules and formal logic so a firm can demonstrate how an output was reached and that the relevant requirements were applied. It singles out this kind of explainable AI as the property that lets firms evidence fairness, consistency and compliance. In regulated activity, the Review argues, a useful answer is not enough if the basis for it cannot be reconstructed.
This is native to how ezbob decisions work. Decisioning logic lives in client-owned configuration rather than being hardcoded, and every change to a credit rule, scoring band or workflow is version-controlled, stamped with author, timestamp and prior state, so there is a reconstructable audit trail behind every decision. Explainability is not a report we generate after a decision; it is a property of how the decision was made: this is key to the requirement of the application of AI in financial services.
Where the human sits is a setting, not an accident
Much of the Review is organised around an autonomy spectrum: the human moving from operator, to collaborator, to consultant, to approver, to observer as systems take on more. Its central insight is that the right level of automation depends on the risk and reversibility of the action, and that firms must be explicit about where a person intervenes, what they see and how challenge is recorded.
The Review even uses SME and specialist lending as its worked example of the consultant stage: AI recommending the decision while underwriters guide the edge cases. That is precisely the model ezbob supports. Routine, low-risk applications can be decisioned straight through. In comparable deployments the platform has achieved straight-through-processing rates above 60%, with full approval decisions in under four minutes, while exceptions route to configurable underwriting queues owned and managed by the client's credit team.
Workflow steps, routing logic, affordability thresholds and escalation paths are all configurable, so a lender decides deliberately where the human approves, supervises or reviews by exception, rather than having that boundary fixed by the software. As the Review argues, being in the loop is not a control unless the firm can say what the person is actually expected to do, what they see and when they can intervene. Our platform is built to make that an explicit, auditable choice. It is one route to genuinely automated credit decisioning that a firm can still stand behind.
Governance as the enabler
| From the Review “To operate safely at scale, the Review argues, firms need clear permissions, effective monitoring and auditability, supported by robust escalation. These are not additional safeguards bolted on at the end; they are the conditions that make it possible to deploy AI in a regulated environment at all. As systems move from supporting decisions towards executing them, governance becomes a key enabler of capability, and a source of competitive advantage.” Source: FCA, The Mills Review (July 2026), System shift 1: The transformation of firms. |
Built by people who have run the loan book
The Review notes that this shift demands a new kind of capability inside firms: people who understand both AI-enabled workflows and the underlying credit and regulatory rationale, and who can evidence reasonable steps in an automated environment. ezbob is unusually well placed here. Founded in 2011, the company was originally a regulated balance-sheet lender before pivoting to become a pure B2B lending technology partner. The team combines technologists with credit risk professionals, regulatory specialists and operations experts, with decades of direct experience of both consumer and commercial lending, credit modelling using AI and machine learning and PRA / ECB and Basel-aligned risk frameworks. Design decisions are grounded in the lending rationale, not simply a technical ingestion of a regulatory requirements document.
That experience is backed by delivery at scale. ezbob has completed implementations for institutions including NatWest, Santander and the Intesa Sanpaolo Group, spanning multi-language and multi-regulatory environments, with more than £2 billion and roughly 75,000 loans processed across reference deployments. Delivery runs on a three-tier governance model with formal change control and full client visibility, underpinned by an ISO 27001-aligned information security management system and structured incident-response SLAs, the kind of operational resilience the Review treats as foundational to trusted AI adoption.
Frequently asked questions
- What is the Mills Review?
It is a review commissioned by the FCA Board and led by executive director Sheldon Mills, published on 6 July 2026. It sets out how AI could reshape retail financial services by 2030 and beyond, identifies four systemic shifts, and makes seven priority recommendations to the regulator. The FCA describes it as the first review of its kind initiated by any regulator globally.
- Does the Review call for new AI rules for lenders?
No. Its central finding is that the existing framework remains sound. The Consumer Duty, the Senior Managers Regime and operational resilience were designed to flex across changing business models, and respondents did not ask for them to be replaced. What firms wanted was clarity on how to interpret and govern increasing use of AI within the existing regime.
- What is the “autonomy spectrum”?
It is the Review's way of describing how the human role changes as AI takes on more. It runs through five stages: operator, collaborator, consultant, approver and observer. The point is not that everything becomes fully autonomous, but that benefits and risks change depending on where the human sits, and that the right level of automation depends on the risk and reversibility of the action.
- What does the Review mean by governance becoming a capability?
It means that clear permissions, monitoring, auditability and escalation stop being compliance overhead and start being the conditions that let a firm deploy AI with confidence. Firms that can demonstrate these will adopt AI faster and more safely; firms that cannot may be slower to move or may expose customers and markets to greater risk. In that sense, good governance becomes a source of competitive advantage.
- What does this mean for a lender choosing origination and credit-decisioning technology?
It raises the premium on control, explainability and auditability. A lender should be able to configure its own credit policy, reconstruct the basis for any decision, decide deliberately where a human approves or reviews, and retain its data and the ability to exit. These are the properties the Review treats as central, and the properties ezbob is built to provide across SME, commercial, corporate and consumer lending.
The takeaway
The Mills Review's message to lenders is that the winners of the AI transition will be defined less by how much they automate and more by how well they can govern, explain and stand behind what they automate. That is not a constraint on ambition. It is what makes ambition safe. It is also, in our view, the whole point of building the way we have.
If you are working through what responsible, explainable, lender-controlled AI looks like in your own origination and credit decisioning, whether in SME, commercial, corporate or consumer lending, we would welcome the conversation.
Sources and further reading
- FCA (2026). The Mills Review: AI and the future of retail financial services. Financial Conduct Authority. fca.org.uk/publications/corporate-documents/mills-review
- FCA (2026). FCA publishes landmark review into impact of AI on retail financial services. Press release, 6 July 2026. fca.org.uk
- FCA (2022). A new Consumer Duty — Final rules and guidance, PS22/9. fca.org.uk
- The Senior Managers and Certification Regime (SM&CR). fca.org.uk
- Bank of England, PRA and FCA. Operational resilience and the Critical Third Parties regime. bankofengland.co.uk
- European Parliament (2024). EU Artificial Intelligence Act, Regulation 2024/1689. artificialintelligenceact.eu
- ezbob platform data (reference deployments), 2026.
