Under SM&CR, UK capital markets firms can let AI agents triage market abuse alerts, search recorded communications, build fitness and propriety evidence packs and draft suspicious order reports, but named people keep every report, certification and attestation. The FCA and PRA supervise, and UK market abuse rules and UK GDPR set further limits.
What fills capital markets compliance in the UK?
Market abuse surveillance is constant. Firms arranging or executing transactions must have systems to detect and report suspicious orders and transactions to the FCA, and London's volume of trading across equities, fixed income, FX and commodities means alert queues are long. Most alerts are explained by news, index events or client flow; the hard work is finding the few that are not.
Communications surveillance runs alongside. Firms record calls and electronic communications relating to transactions, and compliance searches them for evidence that explains or deepens an alert. Off-channel communications, where staff use unapproved apps, are a recurring supervisory concern.
SM&CR adds an annual cycle. Firms must certify each year that staff in certification functions, such as traders and those dealing with clients, are fit and proper, and senior managers must be able to show they took reasonable steps in their areas. Conduct rule breaches must be recorded and, where relevant, notified. Firms serving retail investors also evidence good outcomes under the Consumer Duty.
Where can AI agents help?
- Market abuse alert triage (depth 2). The agent reconstructs order and trade timelines, links them to announcements, research distribution and client activity, and drafts a disposition with sources.
- Communications search (depth 1). For an escalated alert, the agent searches recorded communications of the people involved within the alert's time window, transcribes calls and surfaces relevant passages.
- Certification evidence packs (depth 2). For each certified person, the agent drafts an evidence pack from training records, conduct breaches, complaints, surveillance outcomes and line manager input, for the assessor to review.
- Off-channel indicators (depth 1). The agent flags signs that business moved to unapproved channels, such as recorded conversations that refer to messages compliance cannot see.
- Consumer Duty evidence for retail products (depth 2). The agent drafts outcome monitoring summaries for products sold to retail investors.
Certification packs are where the UK regime makes an agent useful. Gathering evidence across several systems for every certified person is slow, and a complete, cited pack lets the assessor spend time on judgement.
What stays with people?
Reporting a suspicious transaction or order to the FCA, deciding someone is not fit and proper, recording a conduct rule breach, and making an attestation to the regulator all stay with named individuals. These are acts SM&CR ties to people, and the individual signing must have formed their own view.
Attestations deserve a direct answer. Our piece on whether an AI agent can sign a compliance attestation concludes it cannot: the attestation is a personal statement by a senior manager. An agent can assemble the evidence and draft; the senior manager reads, tests and signs.
Disciplinary outcomes stay human for fairness and employment law reasons. The agent widens the view; the decision belongs to a person. That is the logic of AI compliance agents as second line, never the last word.
Which UK rules apply?
The UK takes a principles-based, regulator-led approach to AI rather than a single AI law. The FCA supervises conduct, market integrity and the UK market abuse regime, which requires firms to detect and report suspicious orders and transactions and to keep insider lists. FCA rules require recording of relevant communications. The PRA, part of the Bank of England, supervises banks and major investment firms prudentially, and its SS1/23 sets model risk management principles for banks, which reach surveillance models.
SM&CR names the senior manager responsible for each area, including compliance oversight, and requires annual certification of fitness and propriety for certification functions. The Consumer Duty applies where firms' products and services reach retail customers.
UK GDPR and the Data Protection Act 2018 apply to staff and client personal data, with the ICO as regulator. Communications surveillance must be necessary and proportionate, and staff must be told. See how AI agents are regulated in the United Kingdom for the wider picture.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a sensible 90-day start look like?
First month: map each proposed use to the senior manager responsible for it under SM&CR, and complete the data protection impact assessment for communications search.
Second month: run alert triage at depth 1 on closed alerts, including some that led to reports, and compare the agent's reconstructions with what analysts found. Score missed escalations separately from false alarms.
Third month: pilot certification evidence packs at depth 2 ahead of the annual certification cycle, with each pack reviewed by the assessor before use.
Questions people ask
Can an agent decide whether a trader is fit and proper?
No. It can assemble evidence, but the assessment is a judgement the firm must make through a person, and the certification is the firm's responsibility.
Does the Consumer Duty apply to wholesale trading desks?
Generally not to purely wholesale business, but it applies where products or services reach retail customers, including through distribution chains. Check scope product by product.
How does the UK compare with the US for capital markets compliance?
The US relies on SEC and FINRA rules on supervision and books and records rather than SM&CR. See our brief on compliance agents in US capital markets.