SECTOR INTELLIGENCE BRIEFING, BASED ON DOCUMENTED PUBLIC EVIDENCE, RESEARCH DOCUMENT
01The Documented Picture
◈ This briefing draws exclusively on documented, publicly available evidence from UK regulators, parliamentary committees, and authoritative surveys. The predictive findings in Section 04 are inferences from this evidence base, not assertions of findings BreakPoint has made in this sector.
◈ SS1/23 · The central obligation, now in force
PRA Supervisory Statement SS1/23, effective May 2024, places model risk management on the same supervisory footing as credit risk. It requires: a named senior manager function for model risk; an independent model validation function that does not benefit from models performing well; explicit governance for third-party models including those sourced from vendors; and ongoing drift monitoring, not just point-in-time sign-off. Banks were the primary target of SS1/23. Every major UK bank has now had over a year to implement. The PRA's current supervisory focus is not whether the framework is in place, it is whether the independence is real.
75%
of UK financial services firms using AI
BoE/FCA Survey, Nov 2024
55%
of AI use cases involve automated decision-making
BoE/FCA Survey, Nov 2024
84%
have a named accountable person for their AI framework
BoE/FCA Survey, Nov 2024
>£50bn
AML fines issued globally to UK-connected banks 2012 to 2024
Published regulatory actions, multiple jurisdictions
AI is deployed across UK banking in four high-consequence roles: credit decisioning (retail and commercial lending), AML/KYC transaction monitoring and customer due diligence, fraud detection, and prudential model risk (IRB credit risk models, stress testing). Each carries a regulatory obligation for human authority at decision level, and in each, the documented governance assigns that authority to named individuals without specifying what evidence of its exercise looks like.
Banking is the sector where SS1/23 lands hardest. The PRA has been explicit that model validation functions must be independent of model development and use, not peer review within the same team, not oversight committee with representation from the using function. The question BreakPoint is designed to answer is whether the validation structure that exists in practice meets the independence standard the PRA has now specified.
02The Governance Gap, What the Evidence Shows
SS1/23 is the most specific governance instrument yet published for AI in UK financial services. It requires: (1) a Board-approved model risk appetite; (2) a named senior manager who is accountable for model risk as a function, not just as a named owner within the relevant business line; (3) a model validation function that is independent of the model development and use chain, meaning it cannot be the team that benefits from the model performing well; (4) explicit governance for third-party models, including vendor-supplied AI; (5) ongoing performance monitoring that would detect model drift before it causes material harm. The critical PRA expectation is not documentation of a framework, it is evidence that independent challenge has been exercised at model decision level.
The Treasury Select Committee's January 2026 report on AI in financial services identified the same gap across all regulated sectors: SM&CR assigns accountability to named individuals, but no published standard specifies what evidenced exercise of that accountability looks like for AI-influenced decisions. The Committee called for FCA guidance by end of 2026 and specifically highlighted the risk that senior managers certify accountability for AI-active processes without being able to demonstrate they have exercised it at decision level. In banking, where credit, AML, and fraud AI are all assigned to SMCR functions, this gap is acute, and it sits directly within the PRA's existing SS1/23 obligation.
FCA Consumer Duty applies to AI-assisted credit decisions affecting retail customers, including automated lending decisions, AI-driven affordability assessments, and AI-influenced arrears and collections workflows. The duty is outcomes-based: firms cannot discharge it by pointing to a governance framework that describes human oversight. They must be able to demonstrate from operational evidence that AI-influenced credit decisions produced good outcomes for the customers affected. This includes the ability to identify where AI systematically affected a class of customers differently, and to name who held decision-level authority over that effect.
UK AML obligations require firms to have transaction monitoring systems that are calibrated to detect the specific money laundering risks the firm faces. The JMLSG guidance is explicit that threshold-setting and rule calibration are regulatory obligations, not IT configuration decisions. Where AI sets or refines detection thresholds algorithmically, the human authority over that calibration must be named and exercised. The documented pattern across the sector, where compliance teams review AI-surfaced alerts but do not hold named authority over the thresholds and rules that determine what the AI surfaces, is a governance gap that AML regulators have begun to identify in enforcement proceedings in other jurisdictions.
The BoE/FCA survey finding that 84% of firms have a named accountable person for their AI framework is routinely cited by firms as evidence of strong governance. It is not. Framework-level accountability is not the same as decision-level accountability, and the same survey reports that 46% of firms only partially understand the AI they are using, primarily because a third of AI use cases involve third-party implementations. A named senior manager who holds accountability for a model they only partially understand, and whose validation has been performed by the team that uses the model, holds accountability in name only.
03The Regulatory Framework
PRA SS1/23 (May 2024)
Model risk at credit-risk level. Independent validation (not peer review). Named SMF for model risk. Third-party model governance required. Drift monitoring ongoing, not just initial sign-off.
IRB credit risk models. Fraud detection AI. Stress testing models. Vendor-supplied AI (scoring, analytics). Any third-party quant or ML tool shaping credit or risk decisions.
FCA SM&CR
Named senior managers accountable for AI-active processes. No published minimum standard for AI accountability exercise. Treasury Committee calls for FCA guidance by end 2026.
CRO (model risk, credit AI), MLRO (AML/transaction monitoring AI), CIO (fraud AI), Head of Retail Banking (credit decision AI). Framework certification vs. decision-level exercise is the gap.
FCA Consumer Duty (PS22/9)
Good outcomes demonstrable from operational evidence. AI-influenced credit, collections, and affordability decisions in scope. Systematic AI effect on consumer outcomes must be identifiable and accountable.
Retail credit decisions. AI-driven affordability assessments. Collections and arrears workflow AI. Any AI that shapes the terms or availability of financial products for retail customers.
JMLSG / AML Obligations
Transaction monitoring calibrated to firm-specific risk. Threshold-setting is a regulatory obligation, not IT configuration. Named human authority over calibration required.
Transaction monitoring AI. Customer risk-scoring AI. KYC/CDD AI. Sanctions screening AI. Any AI whose output determines which customer behaviour is escalated to a compliance officer.
04What BreakPoint Would Predict
Epistemic note: The following are indicative and predictive inferences from the documented evidence base above - not assertions of findings BreakPoint has made in this sector. Each prediction identifies a specific gap type that the evidence strongly suggests is present. BreakPoint's role is to determine, for a specific organisation, whether the gap exists and its severity. Note that BreakPoint is not limited to these factors however, and will often surface unexpected risks or risks that may not have been fully articulated.
Every major UK bank has a model validation function. In most, that function sits within the risk division or is represented on an oversight committee that includes members of the team whose models are being validated. SS1/23 specifies that the validation function must be independent, meaning it cannot benefit from the model performing well. A validation committee that includes risk managers, traders, or credit officers whose performance metrics depend on the model's outputs is not independent under SS1/23, regardless of whether it is labelled as an independent function. BreakPoint tests whether the independence standard is structural, not whether the governance document uses the word "independent."
Evidence basis: PRA SS1/23 (May 2024), independent validation function specification; BoE/FCA Survey 2024 (46% partial model understanding, consistent with validation by a team that uses, not independently challenges, the model); Treasury Select Committee Jan 2026 (SMCR decision-level accountability gap).
Credit policy, the parameters within which AI makes lending decisions, is set and reviewed by named committees with appropriate governance. Individual credit decisions are then made by AI within those parameters. The gap is between the two: there is no named individual whose authority covers the individual AI-shaped credit determination. The named accountability is for the policy, not the decision. When AI makes 80,000 credit decisions a month within approved parameters, and no named individual holds authority over individual determinations, the Consumer Duty obligation to demonstrate good consumer outcomes rests on a policy document rather than an evidenced authority structure. The FCA's question, when it comes, will not be about the policy.
Evidence basis: FCA Consumer Duty (outcome evidence required at customer level); FCA SM&CR (decision-level accountability vs. framework accountability); Treasury Select Committee Jan 2026; BoE/FCA Survey 2024 (55% automated decision-making).
In every UK bank with AI-assisted AML monitoring, compliance officers review alerts that the AI has generated. What they do not control, and in most cases are not positioned to challenge, is the threshold and rule calibration that determines what the AI surfaces. The AI decides what is suspicious enough to flag. Humans review what is flagged. This means the human authority in the AML process operates entirely within the AI's classification framework. The documented JMLSG obligation, that threshold-setting is a regulatory act, not a technical parameter, is not discharged by a human review of AI outputs. It requires named human authority over the model's own calibration decisions.
Evidence basis: JMLSG AML Guidance (threshold-setting as regulatory obligation); FCA SM&CR (MLRO accountability); PRA SS1/23 (model governance applies to compliance and surveillance models); BoE/FCA Survey 2024 (46% partial model understanding, relevant to threshold governance).
PRA stress testing models, used in ICAAP, ILAAP, and recovery and resolution planning, are subject to governance review. That review examines the model's outputs and the plausibility of scenarios. What it typically does not examine, because the validation function is not independent enough and the challenger model requirement is not met, is the embedded assumptions within the model that determine how losses cascade under stress. A stress testing model that is validated for output plausibility but not challenged at the assumption level has a governance structure that satisfies the form of SS1/23 without meeting its substance.
Evidence basis: PRA SS1/23 (model risk at credit-risk level; challenger model requirement; independent validation); PRA Supervisory Review and Evaluation Process; BoE Financial Stability Reports (documented model risk in stress scenarios).
Fraud detection AI is approved to identify fraudulent transactions. The condition is that the scope of AI behavioural profiling has, in most deployments, expanded to include customer-level risk scoring that influences account restrictions, payment limits, and, in some documented cases, account closures. Where fraud AI outputs inform decisions that affect a customer's access to their account or financial services, Consumer Duty applies. The governance sign-off for fraud AI covers its original scope. The operational scope is broader. BreakPoint tests the gap between approved and operational scope, a gap that in fraud AI has widened as the models have become more sophisticated.
Evidence basis: FCA Consumer Duty (access to financial services outcomes); FCA Dear CEO letters on account closures 2023/24; FCA Financial Lives Survey (documented consumer harm from account restrictions); PRA SS1/23 (scope creep as model risk).
05Source References
PRA SS1/23
PRA,
Supervisory Statement SS1/23: Model Risk Management Principles for Banks, effective May 2024. Independent validation, named SMF, third-party model risk, drift monitoring.
bankofengland.co.uk →BoE/FCA 2024
Bank of England / FCA,
Artificial Intelligence in UK Financial Services 2024, November 2024.
bankofengland.co.uk →Treasury Committee 2026
House of Commons Treasury Select Committee,
Artificial Intelligence in Financial Services, January 2026. SMCR AI accountability guidance recommendation; AI stress-testing recommendation.
parliament.uk →FCA Consumer Duty
FCA, Consumer Duty Final Rules and Guidance, PS22/9, July 2022. Effective July 2023. Applies to AI-influenced credit and financial access decisions affecting retail customers.
JMLSG Guidance
Joint Money Laundering Steering Group, Guidance for the UK Financial Sector (current edition). Transaction monitoring calibration as regulatory obligation. Threshold-setting is not IT configuration.
FCA AI Update 2024
FCA,
AI Update, 2024. No AI-specific rules; Consumer Duty, SM&CR, and existing conduct frameworks govern.
fca.org.uk →
Luminary Diagnostics · BreakPoint: AI Control Gap Assessment
SS1/23 requires independent model validation.
The question is whether "independent" means what the PRA means, or what the governance document says.
BreakPoint tests the independence of validation, the authority over calibration, and the evidence of decision-level oversight, from operational records, not policy documents.
Book a BreakPoint conversation →