Eight days. Three regulatory signals. One message.
July 14: FCA Chief Executive Nikhil Rathi delivers the “Agents of Change” speech — explicitly naming agentic AI as the next regulatory frontier in financial services.
July 16: A joint regulatory taskforce cracks down on misleading financial ads. Enforcement, not guidance.
July 22: The FCA partners with Anthropic — makers of Claude — to support its Supercharged Sandbox. Twenty-one financial services firms are now testing AI agents in a regulator-monitored environment.
Three signals converging on a single question: accountability.
Not “can AI manage PPC campaigns?” — that question was answered the moment Synter and Supermetrics shipped campaign creation from Claude. The real question, the one the FCA is now actively testing inside its sandbox, is: can your AI prove every decision it made when a regulator asks?
If you’re a finance agency running Meta campaigns for forex brokers, crypto exchanges, iGaming affiliates, or prop firms — here are the four questions your platform needs to answer before you let AI touch a single campaign.
Question 1: Who Made This Campaign Change?
Not “when was the campaign modified.” Not “here’s the change history with generic timestamps.” Who. The individual operator. The specific person — or AI agent — that paused a campaign, adjusted a budget, or swapped a creative on a regulated forex broker’s account at 2:17 AM.
This matters because the FCA’s accountability framework — reinforced in Rathi’s speech — demands clear attribution for regulated activities and outcomes. If an AI agent modifies a campaign for an FCA-regulated client and you can’t identify the actor: you’ve already failed the accountability test.
Generalist platforms weren’t built for this. Supermetrics’ Claude campaign creation workflow tells you “Claude built this campaign.” It doesn’t tell you which team member reviewed it, approved it, or deployed it — and it doesn’t maintain an immutable ledger of every subsequent modification. Synter’s platform executes campaigns but attribution is agent-level, not person-level.
Ott’s Activity Logging records every campaign change with actor attribution — timestamped, person-attributed, and including before/after values. When the regulator asks “who changed this campaign budget?” the answer isn’t “the AI.” It’s a name, a timestamp, and a complete decision chain.
Question 2: When — and With What Approval?
Timestamps aren’t enough. The FCA’s sandbox firms are testing AI governance frameworks — and one of the core use cases is “compliance automation.” That means the regulator isn’t just checking if you tracked changes. They’re checking if you tracked the approval chain.
Did the campaign change go through an approval workflow? Was the creative reviewed against jurisdiction-specific compliance requirements before launch? Can you show the regulator the sign-off that happened between “AI proposed this budget adjustment” and “the budget was adjusted on Meta”?
A timestamp says “3:42 PM.” A compliance-grade audit trail says “3:42 PM — proposed by AI agent, reviewed by Sarah M. at 3:47 PM, approved by compliance lead at 4:02 PM, deployed at 4:05 PM.”
Ott’s Campaign Triage surfaces every change across all Business Managers with severity flags (Red/Amber/Green). Agency Hierarchy maps Client → Brand → Account, so compliance reviews are scoped to the regulated entity — not the entire agency. The approval context is built into the workflow: you’re not just tracking changes, you’re tracking the governance around them.
Question 3: Where’s the Immutable Audit Trail?
“Immutable” is the word that separates compliance infrastructure from change logs. A change log can be edited. A database row can be overwritten. A Claude chat transcript can be deleted. An immutable audit trail cannot be altered — and that’s what a regulator expects when they audit a financial services firm.
The FCA’s Critical Third Parties regime (effective July 10) extends the regulatory perimeter to include technology vendors serving financial firms. If your PPC platform stores campaign change history in a mutable database, you’re building your audit trail on a foundation that wasn’t designed for regulatory scrutiny.
Ott’s Activity Logging is architecturally immutable. Every campaign change — budget adjustments, creative swaps, status changes, targeting modifications — is recorded permanently with before/after values. It cannot be edited. It cannot be deleted. It exists as a single source of truth that a regulator can trust — because it was built for exactly this scenario.
Supermetrics and Synter are campaign creation platforms. Their logging exists to help you understand what happened. Ott’s logging exists to help a regulator verify what happened. The difference is structural — and it’s the difference between passing and failing an audit.
Question 4: Can You Export It in 90 Seconds?
This is the operational test. The first three questions establish what you track. This question determines whether you can produce it when it matters.
Here’s the scenario: a regulator contacts your agency on a Tuesday morning. They’re investigating misleading financial advertising — one of the exact enforcement priorities the FCA’s July 16 taskforce is actively pursuing. They want the complete campaign change history for a specific regulated client, covering the last 90 days, across all Business Managers.
Can you produce it in 90 seconds — or does it take three days, four spreadsheets, and a panicked call to your platform’s support team?
Ott’s audit export is a single operation: select the client, export the Activity Log, deliver to the regulator. Every campaign change — across every BM, every brand, every account — in one immutable report. Timestamped, person-attributed, with before/after values and jurisdiction context.
Generalist platforms weren’t designed for this. A Supermetrics report shows you data. A Synter log shows you agent activity. Neither produces a regulator-ready audit trail in seconds — because neither was built for regulated financial services.
The Pre-Adoption Readiness Score
Before you let AI touch a single campaign for a regulated client, score your platform against these four questions. One point per question:
- Actor attribution? Does every change identify who — not just when? (+1)
- Approval workflow? Is the governance chain (proposal → review → approval → deployment) tracked? (+1)
- Immutable records? Can the audit trail be edited or deleted — or is it architecturally permanent? (+1)
- 90-second export? Can you produce a regulator-ready report in under two minutes? (+1)
Score 4: Your platform was built for regulated financial services. You can answer every question a regulator asks — with evidence.
Score 2-3: You have some logging, but your audit trail has gaps. When the regulator asks the fourth question, you’ll be scrambling.
Score 0-1: Your platform tracks campaign performance — not compliance. You’re running AI-managed PPC in a regulated vertical without accountability infrastructure. The FCA’s sandbox firms are testing AI governance frameworks right now. When that sandbox graduates to enforcement, a score of 0 or 1 is regulatory exposure you can’t afford.
The Sandbox Is Running Now
The FCA’s partnership with Anthropic isn’t a pilot program. Twenty-one firms, 199 applicants (a 51% increase from the first cohort), and an Agentic Academy launched alongside it — this is institutional commitment. The FCA is provisioning Claude to sandbox firms and watching AI agents operate in financial services from inside the tent.
When the sandbox firms demonstrate that AI governance is both possible and expected — and they will — the regulatory expectation shifts. What’s tested in the sandbox becomes the compliance baseline for the industry. And the baseline includes: actor attribution, approval workflows, immutable audit trails, and regulator-ready export capability.
The agencies that can answer these four questions today will be the ones fielding regulatory inquiries with confidence. The ones that can’t will be the ones explaining to clients why their PPC operations failed an audit.
This is the compliance infrastructure the FCA is testing right now. Only Ott was built to pass it.