What Regulated Firms Must Have in Place
The FCA’s new rules and guidance on non-financial misconduct came into effect on 1 September 2026. If your firm operates under the Senior Managers and Certification Regime, these changes apply to you now.
Non-financial misconduct (NFM) covers behaviour that is not of a clearly financial nature, including bullying, harassment and violence. The FCA’s concern is that where this kind of conduct goes unchecked, it harms individuals, damages firm culture, and ultimately undermines confidence in financial services.
The new framework gives the regulator clearer tools to address it.
What Has Changed Under the New NFM Rules
Two parts of the FCA Handbook have been updated.
A new conduct rule, COCON 1.1.7FR, extends the scope of the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues where there is a sufficient work-related link. This does not apply retrospectively, and it does not extend the FCA’s remit beyond SM&CR financial activities. But it does mean that work-related non-financial misconduct can now, for the first time, constitute a conduct rule breach in its own right.
Separately, the Fit and Proper test (FIT) guidance has been updated to clarify how firms can take a broader range of non-financial misconduct into account when assessing fitness and propriety. This includes behaviour in private life, social media conduct, and unproven allegations, within the boundaries of privacy and employment law.
The accompanying guidance, published as PS25/23, covers the boundary between work and private life, how non-financial misconduct can breach the conduct rules, what reasonable steps look like for managers, and how to approach fitness and propriety assessments.
What Firms Need to Have Done
The FCA expects firms to have considered whether they needed to update four areas:
- Staff policies covering bullying, harassment and violence, with clear links to the conduct rules.
- Conduct breach reporting, so that non-financial misconduct is captured where it meets the new threshold.
- Fit and proper assessments, to reflect the updated FIT guidance on how broader misconduct is taken into account.
- Regulatory references, which now need to cover non-financial misconduct where relevant.
Staff and managers should understand how the changes apply to them. A conduct rule that exists in the Handbook but is not reflected in internal policies or training is a gap waiting to be found.
What Firms Do Not Need to Do
The FCA has been clear about the boundaries. Firms do not need to carry out retrospective analysis of past conduct rule breaches, revise past fitness and propriety assessments, monitor employees’ private lives or social media accounts, investigate trivial or implausible allegations about private conduct, or do anything contrary to privacy, employment or other relevant law.
Those boundaries matter. The rules are designed to catch serious, work-related misconduct, not to turn compliance teams into workplace surveillance operations.
How RACO Can Help
For FCA-regulated firms, the practical challenge is making sure the new requirements are reflected in the right places: policies, reporting lines, assessment processes, and training. RACO provides structured compliance and risk management support to FCA-regulated firms, including policy development, governance frameworks, complaints handling, and staff training.
If your firm has not yet reviewed its policies and processes against the new COCON and FIT requirements, or if you are unsure how the changes apply to your specific circumstances, we can help you work through it.
Speak to Our Compliance Team
To discuss how the non-financial misconduct rules affect your firm, or to enquire how we can help your business, call us on 0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
