The new guidance dealing with these changes follows overwhelming support from consultation respondents and comes into force on 1 September 2026.
The direction of travel introduced by these changes has been clear for some time. Following the significant public support for the #MeToo movement and increasing scrutiny of workplace culture, the FCA publicly stated as early as 2018 that sexual harassment and similar misconduct could be relevant to its regulatory framework. Senior FCA leaders repeatedly linked healthy workplace culture to good governance, market integrity and consumer protection, laying the foundation for the reforms that have now been finalised.
What Has Changed?
The most significant change is the expansion and clarification of the Conduct Rules for non-bank firms. From September 2026, serious instances of bullying, harassment, violence and similar conduct towards colleagues will be capable of falling within COCON where they occur in relation to an individual’s work role. This aligns the position more closely with that already applied to banks.
The FCA’s guidance explains that conduct will be relevant where it has the purpose or effect of:
- violating an individual’s dignity;
- creating an intimidating, hostile, degrading, humiliating or offensive environment;
or where it involves violence towards another individual.
Importantly, the FCA has confirmed that conduct need not occur in the office to fall within scope. Work-related dinners, social events, business travel, remote working arrangements and interactions involving colleagues, clients or professional contacts may all have the necessary connection to the workplace.
A Broader Approach to Fitness and Propriety
The guidance goes further than workplace conduct alone. While purely private conduct remains outside the scope of COCON, it may still be relevant when assessing whether an individual is fit and proper.
The FCA’s position is that behaviour outside work may raise regulatory concerns where it demonstrates a willingness to disregard legal or ethical obligations, abuse positions of trust, exploit vulnerabilities, engage in violence or serious misconduct, or otherwise presents a material risk that similar behaviour could arise in a regulated role. The regulator has been careful to emphasise that firms should not assume that private misconduct automatically renders someone unfit. There must be a genuine and material risk rather than a remote or speculative concern.
Similarly, social media activity will only become relevant where it suggests a material risk of future breaches of regulatory standards. The FCA expressly recognises that individuals are entitled to hold and express lawful views, even where those views may be controversial or unpopular.
Why This Matters for Firms
The practical implications extend far beyond regulated staff.
The FCA has repeatedly stressed that non-financial misconduct is fundamentally a culture and governance issue. Firms are expected to create environments where concerns can be raised safely, addressed appropriately and escalated where necessary. This means the impact of the new guidance will be felt across HR, compliance, legal, investigations, risk, internal audit and senior leadership teams.
Perhaps most significantly, the FCA expects firms to exercise judgment. Despite the extensive guidance and examples, there are no bright-line tests. Firms will need to assess seriousness, impact, intent, remediation, repetition, managerial responsibility and cultural context on a case-by-case basis.
It is also interesting to note that in the FCA’s most recent whistleblowing data (for whistleblowing reports received by the FCA between January and March 2026), non-financial misconduct appears in the top 10 of allegations of wrongdoing. This data provides a stark reminder that it is not only the FCA who is alive to allegations of misconduct in this area.
Taken together, the pressure on firms’ robust governance and decision-making processes is growing.
The Wider Employment Law Context
The FCA’s reforms do not sit in isolation. Firms should also consider the increasing overlap between regulatory expectations and employers’ statutory preventative obligations relating to harassment, particularly sexual harassment.
Since October 2024, employers have been under a positive and proactive duty to take reasonable steps to prevent sexual harassment in the workplace, including from third parties, such as from clients. From October 2026, that duty is to be strengthened further, requiring employers to take all reasonable steps to prevent sexual harassment which occurs in the course of employment. Alongside this is the potential employer liability for harassment perpetrated by third parties such as clients, customers, contractors and other external contacts, unless the employer can show it has taken all reasonable preventative steps.
This is particularly significant for FCA-regulated firms because many of the key risk areas identified by the FCA as potentially giving rise to non-financial misconduct concerns, for example, client networking or social events, conferences, business travel, and off-site meetings, are also environments in which these wider employment law risks may arise.
The preventative steps firms should be taking are not a one size fits all approach. Instead, firms are encouraged to think proactively about their risk profiles, focusing on how and where their people are working, who they come into contact with and where the risks might arise. This involves conducting risk assessments, focusing on clear reporting procedures (including anonymous routes), engaging in specific training, looking at investigation processes and considering management accountability.
Key Areas Firms Should Be Reviewing Now
With implementation approaching quickly, firms should be focusing on operational readiness. This should include ensuring that FCA non-financial misconduct frameworks align with the firm’s wider obligations concerning the prevention of sexual harassment, third-party harassment and with workplace culture.
Priority areas include:
- reviewing conduct, disciplinary, whistleblowing and anti-harassment policies;
- updating fitness and propriety assessment frameworks;
- reviewing certification and annual assessment processes;
- considering the impact on regulatory references;
- undertaking and documenting harassment risk assessments, including risks arising from third-party interactions, client-facing activities, business travel and work-related social events;
- ensuring investigation procedures reflect both employment and regulatory considerations;
- strengthening interfaces between HR, compliance, audit and legal teams;
- reviewing escalation and FCA notification processes;
- training managers on their responsibilities to intervene and take reasonable steps to prevent misconduct; and
- developing board-level oversight of workplace culture and behavioural risks.
Regulatory references will be a particular area of focus. Firms will need to consider carefully whether allegations are sufficiently substantiated, whether any findings are material to fitness and propriety assessments, and whether disclosures are fair, lawful and consistent with employment and privacy obligations.
Investigations Will Become More Complex
Investigations are likely to represent one of the most challenging areas under the new regime. Unlike more conventional financial misconduct matters, relevant evidence may extend beyond, for example, transaction data to include witness testimony, social media content, communications on messaging applications, CCTV recordings and patterns of behaviour. Firms will need to navigate a careful path between their employment law responsibilities, regulatory obligations and, where relevant, parallel external proceedings such as criminal investigations.
Equally, individuals who are the subject of allegations must be provided with enough information to understand the case being advanced and afforded a genuine opportunity to respond, particularly where findings may have implications for their regulatory standing or future career prospects. Given the FCA’s emphasis on evaluative and judgment-based decision-making, maintaining comprehensive records and robust audit trails will be essential.
How We Can Help
Many firms already have policies addressing bullying, harassment and discrimination. The challenge now is ensuring that those frameworks align with the FCA’s regulatory expectations and operate effectively in practice.
- to conduct gap analyses against the FCA’s final guidance;
- to review relevant policies and procedures;
- to develop fitness and propriety assessment frameworks;
- by advising on difficult Conduct Rules; fitness and propriety; and regulatory reference decisions;
- by supporting internal investigations involving workplace misconduct;
- to navigate parallel employment, regulatory and criminal issues;
- to design governance and escalation frameworks;
- by training boards, senior managers, certified and / or Conduct Rules staff, HR teams and compliance functions; and
- with assessing cultural risks and broader workplace conduct concerns.
The FCA has made clear that responsibility for tackling non-financial misconduct rests primarily with firms. As supervisory scrutiny increases, firms that invest now in governance, training, investigation capability and workplace culture will be best placed to manage regulatory scrutiny and demonstrate compliance with the FCA’s expectations when challenged for answers by Supervision and Enforcement teams at the FCA.