The FCA’s new rules and final guidance on non-financial misconduct take effect today, 1 September 2026. Around 37,000 non-bank regulated firms are now subject to clearer Conduct Rules covering serious bullying, harassment and violence, alongside new guidance on fitness and propriety.
From today, non-financial misconduct has a clearer place within the FCA regulatory framework.
The changes extend the scope of the Code of Conduct, or COCON, for non-bank firms and introduce detailed guidance explaining how non-financial misconduct can affect both Conduct Rules breaches and assessments of whether an individual remains fit and proper.
The FCA says the purpose is to create greater consistency across financial services and give firms greater confidence to act against serious misconduct. The rules bring non-banks more closely into line with the position already applying to banks. Around 37,000 regulated firms are affected by the extension.
Join our webinar on Wednesday, 16 September for the latest informatin in how to comply with NFM, plus the latest in SM&CR reform.
Here is what firms need to know.
What is non-financial misconduct?
The FCA uses non-financial misconduct, or NFM, to describe misconduct that is not clearly financial in nature.
The new COCON framework focuses particularly on serious:
- bullying
- harassment, including sexual harassment
- violence
- offensive, insulting or distressing behaviour that meets the relevant regulatory threshold
The FCA’s concern is wider than the immediate harm caused to an employee. Serious misconduct can indicate weaknesses in culture, discourage people from speaking up and undermine confidence in financial services.
What changes from 1 September?
The main rule change is COCON 1.1.7FR.
For non-bank SM&CR firms, the Conduct Rules can now apply to serious bullying, harassment or violence towards members of the workforce where there is a sufficient connection with the individual’s work.
Previously, the scope of COCON in non-banks created uncertainty over whether this type of behaviour fell within the Conduct Rules. The new provision more closely aligns the treatment of NFM between banks and non-banks.
A serious incident can therefore become an FCA Conduct Rules matter as well as an HR or employment issue.
The FCA has also introduced detailed Handbook guidance explaining how firms should decide whether behaviour is sufficiently serious and whether it breaches Individual Conduct Rule 1, which requires integrity, or Individual Conduct Rule 2, which requires due skill, care and diligence.
A single incident can be serious enough. Firms should consider factors including the impact of the conduct, whether it formed part of a pattern, its duration, the seniority of those involved and any power imbalance.
There must be a work-related connection
COCON does not generally regulate employees’ private lives.
For the new non-bank rule to apply, there must be a sufficient work-related link. Misconduct against a colleague at the office, while working remotely or during work-related activities may fall within scope.
Purely private conduct will generally fall outside COCON.
This distinction matters because COCON and the Fit and Proper test operate differently.
Private life can still matter under FIT
The FCA’s Fit and Proper test, known as FIT, is broader than COCON.
Firms assessing fitness and propriety already consider honesty, integrity and reputation, competence and capability, and financial soundness. The new guidance explains more clearly when behaviour outside work may affect that assessment.
Private conduct may be relevant where it demonstrates a material risk that the individual will breach regulatory standards in their regulated role.
The FCA specifically warns firms against assuming that private behaviour will automatically be repeated at work. A remote or speculative possibility is insufficient.
Some conduct can still be relevant because of its nature or seriousness. Examples include dishonesty, serious violence, sexual misconduct, abuse of a position of trust or conduct demonstrating a willingness to disregard legal obligations.
Each case requires an assessment of the facts, evidence and regulatory relevance.
What about social media?
Firms do not have to monitor employees’ social media accounts.
If relevant social media activity comes to a firm’s attention, it should be assessed under the same fitness and propriety principles as other private conduct.
Threats of violence, evidence of criminal activity or behaviour indicating a material risk of serious workplace misconduct could be relevant.
The FCA also makes clear that people can lawfully express controversial views on social media without automatically calling their fitness and propriety into question, even where colleagues disagree with or are upset by those views.
Context and material regulatory risk matter.
What NFM does not mean
The new framework has limits.
It does not mean:
- every workplace disagreement becomes an FCA breach
- every breach of an internal HR policy becomes a Conduct Rules breach
- firms must monitor employees’ private lives or social media
- firms must investigate trivial, implausible or irrelevant allegations about private conduct
- controversial or unpopular lawful opinions automatically affect fitness and propriety
- firms should revisit previous Conduct Rules decisions or past fitness and propriety assessments
- firms can disregard privacy, employment, equality or other applicable law when investigating allegations
The Conduct Rules threshold is significant. COCON 1.1.7FR only covers serious conduct, and the FCA expects firms to exercise judgement.
An employee breaching a staff handbook is not, by itself, enough to establish an FCA Conduct Rules breach.
Managers also have responsibilities
The guidance makes the position of managers particularly important.
Managers should take reasonable steps to prevent and address serious misconduct within the areas for which they are responsible.
The FCA gives examples of potential failures including failing to intervene where appropriate, failing to operate relevant policies and controls effectively, mishandling complaints and failing to provide a safe environment for staff to raise concerns.
Manager accountability remains proportionate to what the manager knew, what they reasonably should have known, the authority they had and the actions available to them.
Managers who act reasonably are not expected to guarantee that misconduct will never occur.
Regulatory references matter
Serious, substantiated misconduct can follow an individual when they move between regulated firms.
The FCA has confirmed that serious, substantiated cases of poor personal behaviour may need to be included in regulatory references, helping address the problem of individuals avoiding consequences by moving from one firm to another.
Firms therefore need consistent processes for investigating allegations, documenting decisions and determining their regulatory significance.
What FCA firms should have done by today
The FCA has specifically told affected firms to review whether changes are required to their:
- staff policies
- Conduct Rules breach reporting processes
- fitness and propriety assessments
- regulatory reference procedures
- staff and manager training
Compliance and HR teams should also have clear escalation routes so that potential NFM issues are assessed consistently.
Training is particularly important because many of the difficult questions are judgement calls. Employees need to recognise when behaviour could become a regulatory issue. Managers need to understand their responsibilities. HR and Compliance need to distinguish an employment matter from a potential COCON, FIT, reporting or regulatory reference issue.
The rules are now live
The 1 September deadline has arrived.
For affected FCA firms, non-financial misconduct now needs to be embedded into the same compliance framework used to manage individual conduct, fitness and propriety and regulatory accountability.
That requires more than adding NFM to a policy. Firms need people who understand where the regulatory boundaries sit, processes that identify serious cases and evidence showing that concerns are handled fairly and proportionately.
VinciWorks’ FCA Non-Financial Misconduct: Navigating the COCON Rules course helps employees and managers understand the new requirements, including serious misconduct, the work-related boundary, fitness and propriety, private conduct, material risk and proportionate escalation. VinciWorks’ updated FCA Code of Conduct: Upholding the FCA’s Standards course provides broader training on the Conduct Rules and individual accountability.
