Non-Financial Misconduct: Are You Ready?

The FCA’s new rules and guidance to help tackle Non-Financial Misconduct (NFM) will take effect on 1 September 2026. With the implementation date now only weeks away, SMCR firms should be ensuring that the necessary policies, procedures and internal processes are in place and ready to operate in practice.

We looked in detail at the FCA’s Policy Statement PS25/23 and accompanying guidance, as well as the practical steps Part 4A FSMA firms should be taking ahead of implementation, in our earlier article, FCA guidance on Non-Financial Misconduct: what firms need to know before September 2026 [here].

For firms that have already undertaken that work, now is a good opportunity to check that the changes have been properly embedded and that those responsible for applying them and monitoring compliance understand how the new framework will operate. Firms that have not yet completed their preparations should now make this a priority.

A reminder of what is changing

From 1 September 2026, relevant firms will have to consider and respond to instances and allegations of NFM, even if that conduct does not relate to a firm’s regulatory activities.

The changes clarify how NFM will be assessed under the FCA’s Conduct Rules (COCON) and the Fit and Proper (FIT) regime. Although the two regimes overlap, their scope is different and firms will need to consider carefully which may be engaged when an instance of NFM arises.

COCON

At a high level, the new rule at COCON 1.1.7FR and the accompanying guidance means that:

• Banks and non-bank firms will be more closely aligned so serious NFM towards colleagues will fall within the scope of Individual Conduct Rule 1 or 2 when the conduct in question occurs “in relation to the performance” of the individual’s role.
• NFM is broadly defined – the FCA uses bullying and harassment to describe unwanted conduct that violates a colleague’s dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment.
• “Work-related” conduct is not confined to the office – conduct at conferences, client events, work socials, training events, award ceremonies and other work-related settings outside of the office may fall within scope where there is a sufficient connection with work.
• Only serious misconduct will breach COCON – firms will need to exercise reasonable judgement by reference to factors including the pattern and duration of the conduct, its impact, relative seniority and whether the conduct could justify dismissal or amount to a criminal offence.
• Managers failing to prevent NFM – all managers (not just SMFs) are expected to take reasonable steps to prevent and address NFM. A failure to do so may itself amount to a breach of Individual Conduct Rule 2 – the requirement to act with due skill, care and diligence. The FCA has, however, made clear that a manager will not be in breach where they have acted reasonably, including where they could not reasonably have known about the misconduct or lacked the authority to address it.
• Senior Managers will need to consider their disclosure obligations – private or personal conduct may need to be disclosed under Senior Manager Conduct Rule 4 where it is material to FCA’s or PRA’s assessment of fitness and propriety. 

The new COCON rule applies to conduct taking place on or after 1 September 2026. Earlier conduct should continue to be assessed under the rules in force at the time.

FIT

At the same time, the changes to FIT mean that misconduct forming part of an individual’s private life may need to be assessed through the regulatory lens where such conduct indicates a material risk (meaning a risk that is more than remote or speculative) that the individual would breach regulatory standards or requirements if the conduct were repeated at work, or where there is a material risk of such repetition.

Conduct may also be relevant where it is so serious that there is a material risk of damaging public confidence in the UK financial system or financial services industry. Criminal convictions may be particularly relevant to fitness and propriety, especially where a custodial sentence is imposed.

There are, however, important limits – firms should not automatically assume that private-life conduct will be repeated at work and are not required to investigate allegations that are trivial, implausible or irrelevant to fitness and propriety (for example, because they do not indicate a material risk of a regulatory breach or otherwise raise a material regulatory concern). Nor are firms required proactively to monitor employees’ private social media activity.

A changing legal and regulatory landscape

These changes are being introduced at a time when the employer / employee landscape is changing dramatically as a result of the implementation of the Employment Rights Act 2025 (ERA). Since April this year, reports of sexual harassment in the workplace are automatically deemed a “protected disclosure” for the purpose of bringing whistleblowing claims under the ERA, and as of October 2026, the ERA will introduce a proactive legal duty on firms to take “all reasonable steps” to prevent sexual harassment in the workplace. When instances of NFM are alleged, firms will therefore also need to be mindful of the increased employment law risk that may arise alongside the regulatory scrutiny.

Firms will also need to tread carefully when it comes to disciplinary outcomes that follow any investigations concerning NFM: from January 2027, the ERA will remove the statutory compensation cap as well as reduce the qualifying service required to bring unfair dismissal claims from two years to six months. These changes may increase the risk of disgruntled employees accused of NFM bringing or threatening to bring litigation against firms.

At the same time, as part of the Phase 1 SMCR reforms (which came into effect on 24 April 2026), SMFs are now specifically obliged to take reasonable steps to ensure that the firm complies with its regulatory notification obligations or to take reasonable steps to ensure that all staff (i.e., employees, officers, agents and contractors) in the relevant business area report internally matters requiring notification to the regulator. This additional burden will mean SMF’s will be mindful of wanting additional support, training and resource in their teams to ensure that they are informed when instances of NFM are alleged so that they consider and escalate matters accordingly.

What should firms already be doing?

The new rule and guidance come into force on 1 September 2026, so firms should already be preparing.

Embedding proportionate and defensible systems and processes for identifying, escalating and assessing NFM will be critical – while ensuring that firms do not overreach into employees’ private lives. Key actions include:

• Reviewing and refreshing policies and procedures – including codes of conduct, dignity at work, whistleblowing, social media and disciplinary and grievance policies, to ensure NFM is appropriately captured.
• Updating Conduct Rule breach identification and reporting processes – to ensure relevant NFM is identified and assessed under COCON and FIT, with appropriate clarity around seriousness thresholds and when regulatory notification may be required.
• Defining who will be treated as a “manager” for these purposes – the FCA has not prescribed a single definition and its guidance is not limited to line managers. Firms should therefore identify which individuals may have responsibility or authority to prevent or address NFM and ensure that they understand what is expected of them.
• Clarifying escalation routes – including the respective roles of managers, HR, Compliance and Legal when NFM concerns arise.
• Determining how “material risk” will be assessed in practice – so that decision-makers have a consistent framework for deciding when private-life conduct is sufficiently relevant to engage FIT.
• Reviewing investigation processes and decision-making – so that potential regulatory issues are identified at the appropriate stage and investigations and conclusions are reasonable, proportionate and capable of withstanding scrutiny.
• Maintaining clear decision records – particularly where a firm concludes that conduct is not sufficiently serious or does not present a material regulatory risk. Recording the basis for that judgement will help demonstrate how the firm applied the FCA’s guidance if its decision is later questioned by the FCA.
• Providing targeted training – to Boards, Executive Committees, managers, HR and Compliance teams on NFM and their respective responsibilities under the new framework.
• Reviewing FIT, certification and regulatory reference processes – to ensure NFM is considered consistently and that decisions about what should or should not be disclosed are properly supported.
• Reviewing governance and speak-up arrangements – to ensure concerns are appropriately escalated, recorded and addressed, and that relevant culture and conduct risks receive appropriate senior management oversight.

Firms may also wish to test a small number of recent cases against the new guidance before 1 September. This may provide a useful way of identifying gaps or inconsistencies in policies, escalation routes and decision-making before the new framework goes live.

Looking ahead: the focus moves to implementation

In finalising its NFM policy, the FCA said that its policy work in this area was complete and that its attention would now turn to how firms are tackling NFM in practice.

That makes implementation particularly important. Once the new framework is in force, firms should be prepared to demonstrate not only that they have appropriate policies, but that they are identifying potential NFM issues, investigating them appropriately and reaching reasonable, proportionate and defensible regulatory decisions.

As the FCA’s focus shifts from policy development to firms’ implementation in practice, firms should expect their approach to workplace culture, internal investigations, potential COCON breaches and fitness and propriety assessments to come under closer regulatory attention.

With 1 September 2026 fast approaching, FCA regulated firms should ensure that their policies, escalation processes, investigation procedures and training are ready for the new rules and guidance. Any outstanding implementation work should therefore be prioritised now.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.