Summary
What this article covers in 30 seconds
- AI is already creating practical governance and control challenges for firms
- Data and technology weaknesses can undermine otherwise established controls
- Effective oversight becomes increasingly important as firms adopt new technologies
- Firms should consider whether the FCA’s findings could expose similar weaknesses in their own arrangements.
Are your financial crime controls working in practice?
The FCA published its latest supervisory insights for wholesale banks on 2nd November 2026, bringing together issues identified through day-to-day supervision, incidents at firms and internal audit work. The findings cover operational resilience, AI, financial crime, client risk and conduct, giving firms an indication of where the regulator is seeing controls come under pressure.
This is the third set of insights from the FCA’s ongoing supervision of wholesale banks. The earlier findings still stand, making the latest publication part of a developing picture of the risks and weaknesses the regulator is seeing across the sector.
FCA findings on AI governance and technology controls
Technology features throughout the update, sometimes as an opportunity for firms and sometimes as the source of new risk. The FCA’s observations on AI are particularly relevant as the regulator reports it has seen an incident where an inaccurate AI-generated code passed human review and lead to a service outage. Also, the use of unapproved AI tools has resulted in sensitive information being leaked in another example cited.
As AI becomes part of everyday operations, this brings a more immediate question for firms to consider:
- where is AI being used
- what tasks is AI doing
- do the controls and human oversight around AI technology remain appropriate?
Good controls still depend on good data
Elsewhere in its findings, the FCA describes a coding defect that prevented data from reaching a financial crime control. The issue went undetected for an extended period, providing a practical example of how a control can be undermined by the technology and data sitting behind it.
It is an important distinction for firms to take note of – having a control in place does not necessarily mean that it is working as expected. As firms make greater use of technology and automation, their ability to monitor outcomes and identify gaps becomes increasingly important.
Fragmented information weakens risk oversight
Technology alone cannot provide effective oversight if relevant information remains fragmented across the business.
The FCA’s work on prime brokerage found instances where information was not reaching those responsible for client risk decisions, making it more difficult to understand how that risk was changing.
For firms investing in AI, analytics and automation, the opportunity is not simply to process more information. It is to make useful information more visible and help people make better-informed decisions when risks or outcomes begin to change.
What wholesale banks should take from the findings
The FCA is asking wholesale banks to consider its observations against their own activities and practices. Firms may therefore want to look beyond whether controls exist and consider how effectively the data, technology and human oversight around them work together.
Frequently asked questions
The FCA highlights inaccurate AI-generated code passing human review, staff using unauthorised AI tools and gaps in AI inventories, approvals, risk ratings and kill switches. These examples show why wholesale banks need clear accountability, effective human oversight and controls covering how AI is approved, monitored and used.
In the Wholesale banks supervision – Insights 3 (Autumn 2026) the FCA highlights examples where AI use has exposed weaknesses in governance and oversight, including AI-generated code, unauthorised tools and gaps identified through internal audit.
Controls rely on the information reaching them being complete and accurate. The FCA gives an example where a coding problem prevented data from reaching a financial crime control, allowing the resulting gap to remain undetected.
The findings provide an opportunity to look at how technology-enabled controls operate in practice, including the quality of the data supporting them and the oversight that sits around their use.