8 min read

The FCA’s new rules on non-financial misconduct (NFM) come into force on 1 September 2026. This is the culmination of a process that began in September 2023 and was finalised in Policy Statement PS25/23 (December 2025).

The main change is the introduction of a new rule – COCON 1.1.7FR – which will extend the FCA’s conduct rules so that all SMCR firms (and not just banks) will have to consider the impact of “unwanted conduct” where it meets certain requirements, even where it is unrelated to a firm’s financial activities and regulatory activities.

With implementation now imminent, firms need to move from policy awareness to operational readiness. Below, we set out five practical points that firms – and their HR, Legal and Compliance teams – should be considering now.

What is changing?

  • New rule: COCON 1.1.7FR extends the scope of the individual conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues, where there is a sufficient work-related link. It aligns the position for non-banks more closely with that applying to banks, which have historically been within scope. Whilst the new guidance applies to non-banks, the FCA has been clear that banks should also consider it when assessing potential NFM.
  • Definition: NFM is defined as unwanted conduct that either: (i) has the purpose or effect of violating a colleague’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for that colleague; or (ii) is violent to that colleague. This is aligned with the test for harassment under the Equality Act 2010 except that, in the NFM context, there is no need for that unwanted conduct to be related to a protected characteristic such as age, race or sex.
  • Connection with work: For non-banks, it is no longer necessary for the misconduct to form part of, or be for the purpose of, the firm’s regulated activities. It is enough that the conduct occurs “in relation to the performance” of the individual’s role.
  • Seriousness threshold: Only “serious” misconduct will engage COCON. Seriousness is contextual: factors include repetition, duration, impact, seniority of the perpetrator, dishonesty, criminality and prior warnings. Not every act of unpleasantness is a regulatory matter.
  • Whistleblowing: The FCA is clear that NFM will capture negative conduct towards colleagues who have used a firm’s whistleblowing procedures. Firms should make sure their whistleblowing policies flag the potential negative individual implications if the policy is not followed properly by senior managers.
  • Not retrospective: The rule is not retrospective. Firms are not required to revisit past conduct rule breach decisions or historical fitness and propriety assessments.
  • Action point: Firms should, before 1 September 2026, issue communications and put in place training to ensure that all members of staff who are subject to the conduct rules are aware of the new rule and understand how it applies to them (to satisfy firms’ obligations under section 64B FSMA and COCON 2.3).

Investigating NFM allegations

  • Terms of reference: Investigations will need to be sufficiently robust to support regulatory decision-making, as well employment law outcomes. Terms of reference will need to reflect this dual purpose.
  • Cross-functional coordination: Early alignment between HR, Legal and Compliance teams is essential. Firms should consider establishing a cross-functional working group to identify and triage allegations so that there is an appropriate infrastructure in place before a live incident arises.
  • Evidence and findings: Findings should address not only “what happened” but also consider the context and impact of what happened. It will be relevant to consider the hierarchy between relevant persons, individuals’ own knowledge, and how issues have been escalated and addressed. Firms should be alive to any wider governance or cultural issues which may become apparent. Findings must be evidence-based and sufficiently reasoned to withstand both regulatory and tribunal scrutiny.
  • Procedural fairness: Individuals should be given clear particulars of the allegations against them and relevant evidence. Interviews should be carried out by an investigator with forensic interviewing skills, and transcribed verbatim, with individuals given copies of any transcripts and an opportunity to comment.
  • Early legal engagement: The legal function (including external lawyers where appropriate) should be engaged early to advise on the process, mitigate legal and regulatory risk, and ensure proportionality. If an individual is charged with a criminal offence, it may be appropriate for the firm to wait for the police investigation to conclude before deciding to take action; alternatively, the firm might decide to proceed with its internal investigations, if permitted, revising its findings if necessary to address new evidence or in the case of criminal conviction.
  • Action point: Firms should consider establishing (or refreshing) a cross-functional HR, Legal and Compliance working group and protocol now, so that it is in place and ready to respond when an incident arises.

Private life and social media – when does it become a regulatory matter?

  • COCON vs FIT: COCON applies to work-related conduct. The FIT regime is broader and addresses the wider question of whether an individual’s conduct calls their fitness and propriety into question. Private life conduct is relevant for COCON purposes only where it creates a “material regulatory concern”, i.e. one that is more than speculative.
  • When will be misconduct in private life create a sufficiently material concern? Examples of material concern include dishonesty, abuse or abuse of trust, exploitation of vulnerability, disregard for legal or ethical obligations, or serious risk to regulatory confidence.
  • No monitoring obligation: There is no general obligation for firms to monitor employees’ private lives or social media. Firms are not expected to investigate trivial, implausible or irrelevant allegations. Nor should they do anything contrary to privacy, employment or other relevant law. Investigation requires a “good reason” (e.g. a plausible allegation going to fitness and propriety).
  • Social media: Social media activity is assessed on the same “material risk” basis. The lawful expression of a controversial view will not automatically raise regulatory concerns. Only if the conduct indicates a material risk – e.g. threats of violence, criminal conduct, or bullying or harassment in professional settings – will it be relevant for COCON purposes (though even where conduct does not reach this level, the FCA acknowledges that it might be relevant for assessing fitness and propriety). In assessing this, it is important to consider context, including whether the extent to which the relevant conduct has been carried out repeatedly.
  • Balancing interests: Firms will need to assess whether their social media policy remains appropriate, balancing a need to ensure regulatory compliance with a need to avoid complaints regarding freedom of expression and protected beliefs, which may incur legal as well as reputational exposure.
  • Senior manager self-reporting: Senior managers are required to disclose personal or private life matters where they are material to their fitness and propriety (Senior Manager Conduct Rule 4). This is a high bar – the FCA’s guidance suggests that a disclosure under this Conduct Rule would only be necessary if the relevant conduct would lead to very material sanctions, or if there has been a formal finding (whether by an internal investigation or by a court or tribunal) of harassment, bullying, victimisation or discrimination.  Blanket self-reporting is not required for all staff.
  • Action point: Firms should review their social media and private life-related policies to check that they reflect the “material regulatory concern” threshold, and strike an appropriate balance between regulatory compliance and employees’ privacy and freedom of expression rights

Managerial accountability

  • What managers must do: When serious allegations arise, regulatory focus includes who knew about the allegations, when they knew it, what was escalated and what steps were taken. A manager who allows NFM to occur, or fails to take reasonable steps to prevent or address it, may be in breach of Conduct Rule 1 (integrity) and/or Conduct Rule 2 (skill, care and diligence). This rule will not just capture line managers, but potentially anyone in a managerial position who was aware of the underlying conduct.
  • Limits of accountability: The FCA has clarified that it does not expect managers to be held responsible for failing to stop NFM if they could not reasonably have known about it, or where they did not have authority to act. There will often be a range of reasonable responses.
  • Informal knowledge: Informal knowledge (e.g. overhearing a concern or receiving an off-the-record complaint) must be carefully documented and escalated through appropriate channels. Failure to act on information that should have prompted action is a key risk area.
  • Action point: Firms should roll out practical, scenario-based training for managers on their obligations, including when and how to escalate serious matters, what constitutes a “reasonable step”, and the consequences of inaction. Generic or tick-box training is unlikely to be sufficient. Managers will need to be trained to become capable of handling the difficult conversations that could arise.

Downstream consequences

  • Regulatory references: From 1 September 2026, firms will be formally required capture findings of serious, substantiated NFM in regulatory references where relevant to fitness and propriety.
  • Proportionality: Any decision to include NFM findings in a regulatory reference must be approached with sensitivity, proportionality and fairness, given the serious consequences for the individual’s future employment in the sector.
  • Litigation risk: Firms should be aware of the potential for claims in respect of negligent misstatement (in relation to references) and reputational or psychiatric harm arising from investigation processes, particularly in areas with uncapped compensation.
  • Remuneration: Consideration should also be given to how NFM findings interact with remuneration (including malus and clawback provisions). The Remuneration Codes have not changed following the FCA’s review, but many firms (such as investment firms) will already be required to take into account non-financial criteria such as “achieving targets relating to […] diversity and inclusion” and “performance in line with firm strategy or values”.
  • Action point: Firms should review their regulatory reference processes now to ensure they are robust, fair and capable of capturing NFM findings from September 2026.

We would be happy to discuss any of the above themes in more detail, including how they apply to your firm’s specific circumstances. Please do not hesitate to get in touch with your usual contact.