AI agents for compliance teams in retail banking in the United Kingdom

Consumer Duty evidence is the heaviest lift for UK retail banking compliance, followed by fraud reimbursement and complaints. AI agents can sample customer journeys against Duty outcomes, test reimbursement decisions, find root causes in complaints and draft board reporting. Named people under the Senior Managers and Certification Regime keep the judgements. The FCA, PRA, PSR and ICO set the rules.

What do UK retail banking compliance teams spend their time on?

The Consumer Duty changed the question compliance has to answer. It is no longer enough to show that a disclosure was given; the bank must show that customers understood it, got fair value and received support when they needed it. That means outcome testing across current accounts, savings, overdrafts, cards and loans, with particular attention to customers in vulnerable circumstances.

Fraud is the second load. Customers tricked into sending money to fraudsters can claim reimbursement, and compliance checks that the bank's decisions follow the rules and its own policy, including where it refused on grounds of the customer's gross negligence.

Complaints, root cause analysis, financial promotions review and evidence for the board's annual review of outcomes fill the rest.

Where can AI agents help?

• Outcome testing (depth 1). The agent samples closed cases, such as savings customers left on a rate well below the bank's equivalent product, and checks whether the bank told them and when. It reports each case with the records it relied on. A tester confirms or rejects every flag.
• Fraud reimbursement review (depth 1). For refused claims, the agent reads the payment record, the warnings shown, the customer's account of events and the case handler's decision note, and flags refusals that do not match the bank's own criteria. It never decides the claim.
• Complaint root cause analysis (depth 2). The agent reads a quarter's complaints, groups them by cause and drafts the root cause report, citing the complaints behind each theme. A person edits and signs it off.
• Risk assessment drafting (depth 2). The agent drafts sections of the compliance risk assessment from incident, complaint and test data. Our answer on whether an AI agent can do a compliance risk assessment explains where its draft needs a person's challenge.

Outcome testing is where agents earn their place first. A team that once sampled thirty files a month can review hundreds, and the people can spend their time on the hard cases. The guide to AI compliance agents sets out why the agent works as a second line and never as the final word.

What stays with people?

Under the Senior Managers and Certification Regime, named individuals answer for the bank's conduct. The senior manager responsible for compliance cannot delegate that accountability to software, and the FCA will expect them to explain how agent findings were checked.

So people keep: the conclusion on whether an outcome was good or poor; decisions to remediate a group of customers; reimbursement outcomes; responses to the ombudsman; breach notifications to the FCA; and the board's Consumer Duty report. The agent's work makes those decisions better evidenced. It does not make them. Our answer to whether an AI agent can replace a compliance officer goes further.

Vulnerability judgements need particular care. An agent can spot signs in a case note, such as a mention of bereavement or a recent diagnosis, but deciding what support the customer needed is a human call.

Which rules apply in the United Kingdom?

The FCA supervises conduct and enforces the Consumer Duty, which requires good outcomes for retail customers. The PRA, part of the Bank of England, supervises banks prudentially; its SS1/23 sets model risk management principles for banks, and an agent that informs material decisions belongs in the model inventory. The PSR regulates payment systems, including the rules on reimbursing customers who fall victim to authorised push payment fraud.

The Senior Managers and Certification Regime puts named accountability on individuals. UK GDPR and the Data Protection Act 2018, enforced by the ICO, govern the customer data the agent reads; where an automated decision has a significant effect on a customer, Article 22 protections apply.

There is no single UK AI law. The government relies on existing regulators applying their rules to AI, which is why the Duty, SM&CR and SS1/23 do most of the work. Our guide to how AI agents are regulated in the United Kingdom covers the full set.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How to start in the first 90 days

First 30 days: pick one Duty outcome, such as consumer support, and one product. Write the test criteria the agent will apply, name the senior manager who owns the result, and record the agent in your model inventory.

Days 31 to 60: replay the agent against a quarter of already-tested cases. Measure agreement with your testers and read every disagreement; some will reveal gaps in the agent's brief, others gaps in the original testing.

Days 61 to 90: widen to fraud reimbursement refusals at depth 1. Report both uses to the compliance committee with the evidence of how they were certified. Business banking teams face different priorities; see our brief on compliance agents in UK business banking.

Where Pryme fits

Pryme certifies the outcome-testing agent on your own closed cases through Attest, so the evidence you show the FCA comes from your book, not a vendor's demonstration. Each flag is filed with the records it cited, and the certificate lapses after 90 days unless the agent is re-tested.