The Financial Conduct Authority has published a sharper account of how AI governance is failing inside wholesale banks. Its autumn supervision insights describe an incident in which inaccurate AI-generated code recommendations passed human review and caused a loss of service. The firm responded with additional test cases and stronger feedback mechanisms. The FCA also reports staff using unapproved AI tools in ways that leaked sensitive information.
Internal audit findings were equally practical. The regulator saw committees fail to track conditional approvals, one case in which a conditional approval was recorded as complete, an AI use case entering production under an undocumented exception and inconsistent risk ratings for agents. Some banks lacked adequate training, testing and maintenance for kill switches or a documented list of authorised operators. Inventories were incomplete.
These examples undermine the comforting idea that a human reviewer automatically provides control. Oversight only works when the reviewer has the right evidence, authority and time, and when the approval being recorded matches the decision actually made. Banks should test the full control path: discovery of unapproved use, risk classification, conditional approval, production release, intervention and recovery. The FCA material reports supervisory observations, not a representative survey of every wholesale bank, so prevalence should not be inferred.
