Non-financial misconduct: new rules now in effect

• 15 September 2026
• Views
• Employment

Financial Conduct Authority (FCA) reforms to bring non-financial misconduct (NFM) more clearly within the regulatory framework for all regulated firms are now in effect. That means that, going forward, issues that have traditionally been treated as “HR matters” may now have regulatory consequences. The practical challenge for employers will be to align employment processes with regulatory decision-making, without treating every workplace complaint as a potential regulatory breach.

What has changed?

A new rule, COCON 1.1.7FR, brings serious NFM toward a colleague, including bullying, harassment or violence within scope of the Conduct Rules for non-banks. The Conduct Rules may be engaged where there is a sufficient connection between the conduct and the individual’s work, and the conduct does not exclusively relate to areas of the business not conducting financial activities. This broadly aligns the regulatory position for non-banks with the position already applying to banks.

The definition of NFM is familiar to HR professionals. Defined as unwanted conduct with the purpose or effect of violating a person’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them, or violent conduct, the concept echoes the ‘harassment’ concept under the Equality Act 2010. It is, however, broader: to amount to NFM, conduct need not relate to a protected characteristic, and violent conduct is expressly in-scope. In assessing whether NFM amounts to a regulatory breach, firms must assess whether the conduct is sufficiently serious, taking account of its nature, purpose or effect, frequency, impact and wider context.

NFM may breach the existing duties to act with integrity or with due skill, care and diligence (Conduct Rules 1 and 2). A manager’s unreasonable failure to prevent or address misconduct may itself engage the Conduct Rules. 

The reforms also introduce updated guidance to clarify how NFM may impact fitness and propriety assessments. Code of Conduct compliance and fitness and propriety remain separate questions. NFM will be a potential Code of Conduct breach only where there is a sufficient nexus to work, while relevant conduct in an individual’s private life (including social media activity) may affect fitness and propriety in certain circumstances, including where, for example, it indicates a material risk of breaching regulatory standards or is so serious that it risks damaging public confidence in financial services. The FCA has clarified that it does not expect firms to monitor employees’ private lives or social media, revisit historic decisions, or investigate trivial, implausible or irrelevant allegations. It does, however, expect firms to exercise, and be able to evidence, sound, consistent judgement on whether conduct brought to its attention has regulatory implications.

What should employers be doing?

The changes will bring issues that have traditionally been treated as pure “HR” matters within the regulatory framework. That obviously raises the stakes for regulated individuals, with NFM potentially becoming reportable as a breach of the Code of Conduct and affecting fitness and propriety assessments and regulatory references. From firms’ perspective, it is important that regulatory assessments are made robustly and consistently. 

If you have not already done so, you should:

• Update policies and guidance. Ensure conduct, disciplinary, grievance, speak-up, social media and regulatory policies reflect the new rules and guidance on NFM and the potential regulatory consequences of NFM for individuals. Employment and regulatory documents should use consistent language and escalation triggers and procedures should be aligned.

• Join up HR, Legal and Compliance. Complaints should be triaged early to identify potential Code of Conduct or fitness and propriety issues. Where there is a regulatory dimension, HR, compliance and legal teams need to be joined up to ensure that processes are managed appropriately and decisions are made consistently.

• Strengthen record-keeping. Clear and consistent documentation at every stage, from investigating of an issue (or deciding not to investigate) to making factual findings to making employment and regulatory decisions, will be important if a decision is later challenged.

• Review fitness and propriety, reporting and regulatory reference processes. Build NFM into annual and event-driven fitness and propriety assessments, conduct-breach reporting and regulatory references. 

• Training. A firm is required by law to ensure that Conduct Rules staff understand the rules and how they apply to them and should receive appropriate training to ensure this duty is discharged. Managers need practical training on prevention, intervention, escalation and their own responsibilities. HR, Compliance and investigators need to be trained on their roles and applicable procedures and escalation triggers and mechanisms. 

• Test governance and management information. Senior leaders should have appropriate oversight of themes, repeat issues, delays and inconsistent outcomes. Firms should consider whether their data enables them to identify cultural risks while protecting confidentiality.

Final thought

The reforms place responsibility squarely on firms to prevent and handle serious NFM effectively. A proportionate, joined-up framework will help firms protect staff, make fair decisions and demonstrate regulatory compliance—while reducing the risk of inconsistent outcomes, unnecessary reporting and employment claims.