TL;DR

The Financial Conduct Authority has warned that AI risk assessment systems used by professional services supervisors are failing to improve anti-money laundering controls. The FCA highlighted a specific case where an AI model automatically assigned new law firms a “medium” risk rating due to insufficient data, making them unlikely to be reviewed.

The Problem

The FCA’s findings focus on the 25 bodies responsible for supervising AML controls across professional services including lawyers and accountants. The regulator said these organisations continue to perform poorly on enforcement, and their dual role as both membership organisations and supervisors can “hinder effective action.”

In one example, a legal sector body introduced an AI model to help identify AML risks at the firms it supervises. But because the model lacked sufficient data on newly registered law firms, it defaulted to assigning them a “medium” risk rating. That default meant new firms were unlikely to be flagged for review — the opposite of what a risk-based approach is supposed to achieve.

The FCA said this raised concerns about “potentially unidentified or unmanaged risks” and encouraged the legal sector body to sample new firms proportionately to validate the AI’s ratings.

Enforcement and Next Steps

The regulator has warned it could take further action against the 25 supervisory bodies if problems are not fixed. It censured the Institute of Certified Bookkeepers last year over AML supervision of its 3,000 members.

The Treasury announced last October that it would transfer AML supervision of professional services to the FCA after identifying the current system as a potential vulnerability to financial crime.

Why It Matters for UK Businesses

The case is a concrete example of AI systems introducing new risks when deployed without adequate data or oversight. For UK firms adopting AI-powered compliance tools, the FCA’s findings are a reminder that automated risk scoring is only as good as the data behind it — and that regulators will hold organisations accountable for gaps their AI creates.