On 2 November the FCA published its third Wholesale banks supervision – Insights. One line stands out for anyone using AI in compliance:
“Inaccurate AI-generated code recommendations were not identified during the human review stage and resulted in a loss of service.”
Four incidents, one pattern
In each case a change went in, testing was too narrow, and the gap was found late.
AI-generated code.
Inaccurate AI code recommendations got past human review and caused a loss of service. The firm added test cases and stronger feedback loops. The FCA notes that human oversight gets harder as AI outputs become more autonomous.
Algorithm change.
A change made the algorithm interact badly with the order management system on a stop-loss order. The order was over-filled and the firm built up a very large intraday position. Testing had been simulation-only and missed near-simultaneous fills in different locations. The FCA expects firms to assess a change across the entire trading process, and points them back to RTS 6.
Our view: reconciling venue drop copies or broker trade files against risk systems would have flagged the position sooner.
Financial crime data.
A coding defect stopped data being ingested into a control. The gap went undetected for an extended period and was found by chance. The FCA expects firms to assess ingestion design and how well it works in practice, and to track data lineage.
Communications surveillance.
Incomplete ingestion and lexicon configuration errors, often during system changes or at third-party providers. Firms remain responsible even when a third party runs the system.
Why “human in the loop” failed
A human review step is only a control if the reviewer can tell right from wrong output.
The question for a CCO is not whether there is a human in the loop. It is what that human checks, and against what. An effective review step has:
Expected outputs written down before the change.
The reviewer compares results with a known answer, not with their impression of the code.
Test cases that include the awkward scenarios.
These are the edge cases the algorithm change missed: simultaneous events, partial fills, missing or late data.
The basis for each decision, recorded and verified.
Every output carries the source it relies on, quoted and presented to the reviewer, with a check that the source says what the output claims. Higher-risk changes and decisions get a second reviewer (four eyes) before they take effect.
Sampling of live output after release.
Testing that stops at sign-off cannot catch what only shows up in production.
A named owner and a record.
Who approved what, on what evidence, and when. That is also what the FCA will ask to see.
Does your surveillance see everything?
Buy-side firms are especially exposed here. Most rely on vendor surveillance and an order management system they did not build, with data passing through several hand-offs. The FCA’s point that firms remain responsible for third-party systems applies to them just as much as to banks.
What good looks like in practice:
Reconcile the full trade population.
Broker files and drop copies are an independent record of every order and fill. Reconcile them regularly against the order management, risk and surveillance systems, so a gap in any feed shows up in days, not months. Do the same for communications channels.
Monitor volumes, not just alerts.
A daily MI dashboard of order, trade and message counts by source, set against expected ranges, shows when a feed drops or spikes. A move outside the range prompts a review before anyone relies on an empty alert queue.
Re-test after every change.
Upgrades, new venues, new comms channels and vendor releases are where the gaps in the FCA’s examples opened.
Check configuration, not just whether the system is running.
Lexicons, thresholds and model scope need a documented owner and a periodic review.
Get evidence from the vendor.
Ask what completeness checks the provider runs, and get the results.
AI & algo trading: two frameworks, borrow the best
SYSC applies to both: a firm needs systems and controls proportionate to the change, whether it is to an algorithm or an AI tool. Beyond that, each risk has a cleaner framework to lean on.
Algorithm changes: lean on RTS 6
RTS 6 sets the organisational requirements for investment firms that trade algorithmically. It covers testing before an algorithm is deployed or materially changed, governance and sign-off, pre-trade controls, real-time monitoring and a kill functionality. For firms in scope, the FCA’s over-fill example is a reminder of what RTS 6 already requires. For firms outside it, it is a sound model for algorithm change management.
AI: lean on the FCA’s October 2026 good practice
For AI, the FCA’s AI in financial services: good practice and areas for improvement (19 October 2026) creates no new rules; it shows how existing ones, including SYSC and SM&CR, apply to AI. In proportionate form, it points to four things:
- An inventory with named owners. Every AI use case, the model behind it, its owner and the data it touches, including staff use of public tools.
- Testing before deployment and after change. Test against defined scenarios, and pilot lower-risk uses first.
- Human oversight set by risk. Reviewers need the information and authority to intervene, so review does not become box-ticking.
- A risk appetite with thresholds. Governance and monitoring scaled to the use: a tool drafting a policy summary needs lighter controls than one that closes surveillance alerts.
None of this needs a large team. It needs the controls designed in at the start, not added after an incident.
How we approach it
We build algorithmic trading governance and controls for trading firms, designed to SYSC and RTS 6. We also build AI systems, for our own compliance work and for clients. For AI, we apply the FCA’s October 2026 good practice and established SYSC principles, and borrow from RTS 6 where appropriate and proportionate.
The model is rarely the weak point; the inputs, the changes and the review are. That is why the AI systems Reg Advantage builds have these controls designed in from the start, each mapped to the FCA’s good practice:
A human in the loop, set by risk:
a named person approves what matters, against test cases and expected outputs. The FCA treats human review as a risk-based control and warns against it becoming box-ticking.
A mapped AI inventory:
every use case, the model behind it, its owner and the data it touches. This mirrors the central inventories and owner mapping the FCA describes as good practice.
Logs of AI activity and decisions:
inputs, outputs, model versions, and who approved or overrode each result. The FCA points to auditable records of outputs, model versions and escalation decisions.
Dashboards:
volumes, exceptions, overrides and input completeness against set thresholds, for the compliance committee and board. This matches the FCA’s examples of monitoring against thresholds and turning risk appetite into metrics.
Quoted basis, independently verified:
to control hallucination risk, the AI model must match the basis for its logic to the source and quote both back to the human reviewer to show they exist. An independent AI agent then checks, for good measure, that the match exists in both underlying sources.
The FCA’s paper sets out good practice, not new rules. Mapping to it gives a firm a clear record of how its AI controls meet existing obligations, including SYSC and SM&CR.
Five questions for your next compliance committee
When AI produces code, analysis or a recommendation, can the reviewer see the source it relied on, and do we record who approved it and why?
Before our last algorithm change went live, which scenarios were tested beyond simulation, and who signed it off?
How quickly would we spot an unintended position: intraday through our own position monitoring, and by T+1 at the latest through reconciliation to drop copies and broker files?
Can we show that every trade and every communication reached surveillance and risk last month, and would our MI tell us if a feed dropped?
What evidence do our surveillance and data vendors give us that their feeds and configuration are complete, and when did we last test it?
If any of these are hard to answer, we would be glad to talk it through.
Sources
- FCA, Wholesale banks supervision – Insights 3 (Autumn 2026), published 2 November 2026
- FCA, AI in financial services: good practice and areas for improvement, published 19 October 2026