FCA SUP 15 and inbound AI mentions in UK financial services

SUP 15 of the FCA Handbook obliges authorised firms to notify the FCA of significant events. The notification triggers are deliberately broad: anything material that affects the firm's ability to meet its threshold conditions, anything that suggests potential breaches of regulatory requirements, anything that could affect the FCA's view of the firm.

Until recently, "an AI engine described our firm in a misleading way" was not on anyone's SUP 15 checklist. It should be. The standard is materiality, not intent — and an LLM that characterizes your firm in ways the FCA would consider misleading is, by the rule's own terms, reportable.

The reading: when AI-rendered content triggers SUP 15

SUP 15.3.1R requires immediate notification of "any matter which could have a significant adverse impact on the firm's reputation," and SUP 15.3.8R requires notification of "any material misstatement in the firm's published information."

Three patterns of AI-rendered content are reportable in our reading:

1. Inflated permissions. The model describes the firm as having permissions it does not have — e.g., stating an EMI license when the firm holds only an Article 4 permission.
2. Comparative claims. The model renders "leading" or "largest" or "most experienced" claims that the firm has not substantiated.
3. Past-performance implication. The model turns historical case-study language into forward-looking performance claims, in apparent breach of COBS 4.6.

Each of these, if material and if the firm becomes aware of them, triggers a SUP 15 notification analysis.

"Becomes aware" — the constructive notice problem

SUP 15 obligations attach when the firm becomes aware of a reportable matter. The FCA has not yet ruled on what "constructive awareness" means for AI-rendered content, but the direction of travel is clear: firms that do not monitor their AI presence will be treated as on constructive notice of anything they would have seen with reasonable monitoring.

This is the same direction the FCA went on social-media promotions in 2014 — firms could not avoid Financial Promotions liability by claiming they did not see the tweets. AI-rendered content is following the same pattern.

Operational pattern: the SUP 15 register

Firms with mature AI-search practices maintain a SUP 15 register of AI-rendered content concerns:

• The query that produced the content (with engine, date, and verbatim text).
• The compliance analysis (which SUP 15 trigger, if any, applies).
• The remediation (content correction, source update, FCA notification if required).
• The reviewer's sign-off (compliance officer or designated senior manager).

This register is what the FCA will ask for in a supervisory visit. It is also the firm's best defense if a SUP 15 matter is raised — documented good-faith monitoring with a clear remediation process.

The two adjacent rules that interact

COBS 4.6 — Past, simulated past, and future performance

COBS 4.6 has specific requirements for how past-performance information is presented — clear timeframes, comparable benchmarks, prominent risk warnings. AI re-renders of case-study content frequently drop these contextual elements. If the AI-rendered content materially fails COBS 4.6 standards and is foreseeable from the firm's published source, the firm carries the COBS 4.6 obligation.

SYSC 4 — Risk management for senior managers

Under the SMCR regime, the senior manager responsible for the compliance function carries a personal accountability for the risk-management framework, including how the firm manages AI-rendered content risk. The expectation we see emerging is that the SMF16 (Compliance Oversight) holder owns the AI-content monitoring policy, even if the actual monitoring is delegated to a marketing or technology function.

What this looks like for a buy-side firm

Asset managers and wealth advisers see the highest material exposure because their addressable market routinely uses AI engines to research counterparties before mandate selection. Cognoverge's data shows 64% of UK family offices have run an AI query about a prospective adviser in the last 12 months.

The practical implication: AI-search content monitoring is now part of the compliance baseline, not an optional marketing-team activity. Buy-side firms that treat it as marketing's problem are leaving regulatory risk on the table.

What this looks like for a sell-side firm

Sell-side firms (brokers, dealers, trading venues) see lower materiality on AI-rendered content because the customer-acquisition funnel runs through different channels. But the firm-reputation SUP 15 trigger still applies. The pattern we recommend: quarterly automated probe across the main engines, with documented escalation to compliance if material issues surface.

The end-state

Within 24 months, we expect the FCA to publish guidance making AI-content monitoring explicit in the SYSC framework. Firms that have already operationalized it will be ahead. Firms that wait for explicit guidance will be retrofitting under supervisory pressure — the more expensive path.