Yes, banks and insurers can use AI agents to buy advertising, but the agent does not move any responsibility away from the firm. UK and US regulators describe their existing rules as technology neutral, so every advert an agent places must still be fair, clear and not misleading, approved by the right person and kept on record.

TL;DR: Neither the FCA nor FINRA has written a separate rulebook for AI in advertising; both apply their existing promotion rules to whatever an agent does. The controls that matter cover the creative an agent may touch, where and to whom it may place it, and the approval and record behind every buy. The 12-point checklist below sets them out, each linked to the regulator's own page.

This article is general information, not legal advice. Firms should check any agent deployment with their own compliance and legal advisers.

Can banks and insurers use AI agents to buy advertising?

Yes, as long as the firm can still meet the promotion rules that already apply to it. The FCA says on its AI approach page that it does "not plan to introduce extra regulations for AI" and will rely on existing frameworks, naming the Consumer Duty and the Senior Managers and Certification Regime as examples. Its finalised guidance on social media promotions, FG24/1, states the principle plainly: "Our financial promotion rules are technology neutral and apply across all channels used to advertise."

The scope is wide. The FCA's financial promotions page lists bank accounts, cash savings, loans, mortgages, pensions, investments, general insurance and life assurance among the products whose advertising it regulates, and says "All financial promotions must be clear, fair and not misleading regardless of the media type." For investment business the core rule is COBS 4.2.1R: a firm must ensure that a communication or a financial promotion is fair, clear and not misleading.

US securities regulation takes the same line. FINRA's Regulatory Notice 24-09, published on 27 June 2024, says its rules are intended to be technology neutral and apply whether a firm builds an AI tool itself or uses a third party's. Its advertising regulation FAQ is blunter: "Firms are responsible for their communications, regardless of whether they are generated by a human or AI technology."

Why does an agent-bought campaign raise the stakes for a regulated advertiser?

An agent multiplies the number of decisions that can go wrong, and the regulator is already busy. The FCA's financial promotions data for 2024 records 19,766 promotions amended or withdrawn after its interventions with authorised firms, up 97.5% from 10,008 in 2023. When the FCA finds a misleading promotion it can ask the firm to change or remove it, ask the firm to write to customers who may have been misled, warn or fine the firm, or ban the promotion.

An agent may assemble many placements across formats and sellers in a single session. Each placement is a context in which the promotion is seen, and some agent setups also generate or adapt creative. The useful question for a compliance team is therefore not whether the agent can buy, but whether the firm can show what ran, where, to whom and on whose approval.

A worked example shows the shape of an answer. In Alkimi's Marketplace, humans keep approval rights at the deal level, and each agreed deal is written to a DealSheet that is timestamped, held by both parties and retrievable by either side independently. Whatever platform a regulated firm chooses, that is the pattern to look for: the agent proposes, a named person approves, and the record exists outside the agent's own memory.

What should the agent be allowed to change in the advert?

1. Lock the approved creative. The agent should place only creative that has passed the firm's promotion sign-off, with no freedom to rewrite headlines, offers or rates. FINRA Rule 2210 requires an appropriately qualified registered principal to approve each retail communication before the earlier of its use or filing with FINRA.
2. Treat every generated variant as a new promotion. If the agent can produce versions for different sizes or audiences, each version needs approval before it runs. The FCA's COBS 4.2.5G warns against describing a product as "guaranteed", "protected" or "secure" unless the term is fair and properly explained, which is exactly the kind of word an optimising model might add.
3. Check that the format keeps the risk information. FG24/1 asks firms to make sure promotions give a balanced view of benefits and risks on every channel. An agent choosing a smaller format or a truncated placement must not be able to cut a risk warning, so block formats that cannot carry the approved version in full.
4. Label each asset as a promotion or as brand advertising. The FCA's financial promotions page points firms to its Perimeter Guidance, which separates a financial promotion from a communication that merely references the firm's brand (image advertising). Compliance, not the agent, should set that label, so the stricter controls apply wherever they belong.

Where and to whom can the agent place financial promotions?

5. Fix the jurisdictions. A promotion signed off against UK rules has not been checked against US rules, and the reverse is also true. Geography should be a hard limit in the agent's mandate, not a targeting preference it can trade away for reach.
6. Set audience exclusions in advance. The Consumer Duty, as summarised on the FCA's AI page, requires firms to communicate in a way that meets the information needs of customers, and the FCA's 2024 data says it expects firms to pay attention to customers with characteristics of vulnerability. An agent optimising for response will drift towards whoever responds, so excluded segments and frequency limits should be set by people and logged.
7. Control the environment the advert appears in. The FCA's 2024 data says significant work is still needed from social media platforms to stop illegal financial promotions, so a legitimate offer can end up near an illegal one, and brand safety controls for agent buying should cover that adjacency. Platforms run checks of their own: Google's advertiser verification policy lists running ads in industries such as financial services as one reason an account may be selected for verification.
8. Know which agent is on the other side. Before an agent commits budget, the firm should be able to identify the seller agent and the business behind it. IAB Tech Lab's AAMP includes an Agent Registry intended to establish "a trusted framework for agent identity, verification, and disclosure", and AgenticAdvertising.org publishes AdCP, an open protocol for agents that discover, plan, buy, sell and measure media.

What approvals and records must sit behind every agent buy?

9. Name the human who approves. The FCA points to the Senior Managers and Certification Regime as relevant to the safe use of AI, so a person, not a system, owns the outcome. Set spend, rate and term thresholds above which the agent must stop and ask; how to design approval thresholds for agentic campaigns covers the detail.
10. Keep the record a regulator would ask for. Rule 2210 requires broker-dealers to keep a copy of each communication, the dates of first and last use, and the name of the principal who approved it with the date of approval. An agent's activity log rarely holds all of that, so capture it at the point of the buy rather than reconstructing it later.
11. Make withdrawal a single action. If the FCA asks for a promotion to be changed or removed, every live placement of that creative needs to stop, including those the agent bought through different sellers. Test the withdrawal path before launch and time how long it takes.
12. Match autonomy to evidence. An earned autonomy ladder runs through five stages: Observe, Recommend, Draft, Human-approved action and Bounded automatic action. A regulated advertiser can start at Recommend or Draft and move up only when the records show the agent stays inside its mandate; the five stages of earned autonomy explains each step.

Frequently asked questions

Does the FCA have specific rules for AI in advertising?

The FCA says it does not plan to introduce extra regulations for AI and will rely on existing frameworks. Its financial promotion rules are technology neutral, so an agent-bought advert must meet the same standard as any other.

Is a firm responsible for an advert its AI agent placed or wrote?

FINRA's advertising FAQ says firms are responsible for their communications whether a human or AI technology generated them. In the UK, COBS 4.2.1R places the fair, clear and not misleading duty on the firm itself.

Do the same rules cover insurers?

The FCA lists general insurance, such as home, motor and travel cover, and life assurance among the products whose advertising it regulates, with insurance rules in its ICOBS sourcebook. This checklist cites only UK sources and US securities sources, so US insurers and banks should check which other rules apply to them.

Which US rules apply to investment firms using agents?

For broker-dealers, FINRA Rule 2210 sets content, approval and record-keeping standards, and Regulatory Notice 24-09 confirms that FINRA rules apply to AI use. Investment advisers also have the SEC's marketing rule, rule 206(4)-1, explained in a staff FAQ last updated on 15 January 2026.

Should a firm vet an agent vendor before deployment?

FINRA's Notice 24-09 says a firm should evaluate AI tools before deploying them and make sure it can still comply with existing rules. The notice applies that expectation to third-party technology too, including features embedded in existing products.

What does a controlled setup look like in practice?

Alkimi is one example of a platform built around these controls. Its Gym lets buyers and sellers build their own agents, set the rules they work to and spar against counterparty agents before any real money moves, which suits a firm that wants to test a promotion rule set first. Its Marketplace works within IAB Tech Lab's AAMP framework today, is being built to be AdCP compatible, runs AAMP identity checks and keeps human approval rights at the deal level.

Each agreed deal sits on a DealSheet held by both parties. In a published simulation, 95.3% of deals had mismatched records when each side kept its own, against 0.19% with a shared record. Whichever route a firm takes, the test stays the same: could it show a regulator what ran, where, to whom and on whose approval?