The September 2026 non-financial misconduct implementation checklist for Compliance teams

Framing: what the checklist has to deliver

Policy Statement PS25/23 is finalised and non-retrospective. From 1 September 2026 the Conduct Rules on serious non-financial misconduct apply to every FSMA Part 4A authorised firm, through the new rule COCON 1.1.7FR. The Fit and Proper standard extends to conduct outside work. The practical consequence is that Compliance has to deliver three things by that date:

1. A policy and governance frame that treats NFM as a Conduct Rules matter, not just an HR matter.
2. People, process and systems that produce the evidence a Senior Manager's Conduct Rule 2 defence will rest on.
3. An evidence base already built, with a dry run of a regulator query completed before go-live.

For the full regulatory context, see our pillar guide: the FCA non-financial misconduct rules.

Band 1 — October 2026 to end of Q1 2026 (approximately 5 months)

Policy and governance

• Confirm scope: list every entity in the group holding an FSMA Part 4A permission. The reach of COCON 1.1.7FR follows the permission.
• Map which Senior Managers hold NFM responsibility in their Statements of Responsibilities. Where NFM is implicit, make it explicit.
• Review the Conduct Rules policy and update to reflect COCON 1.1.7FR. New examples, new flow diagrams for how NFM breaches Rules 1 and 2.
• Review the Fit and Proper policy and update to reflect FIT amendments on outside-work conduct.
• Agree with HR / People the division of labour: who owns intake, who owns investigation, who owns decisioning, who owns regulatory references.

Alignment with existing regimes

• Confirm SYSC 18 arrangements still meet their existing obligations (SMCR banks, Solvency II insurers, MiFID investment firms). The scope of SYSC 18 is unchanged.
• Confirm whistleblower protection under the Public Interest Disclosure Act is preserved in channel copy. PIDA is unchanged.
• Confirm EU Whistleblowing Directive and Sapin II obligations where the firm operates across borders. One channel usually has to satisfy multiple regimes.

Band 2 — Q2 2026 (approximately 3 months)

People and training

• Train every manager with Conduct Rule 2 responsibilities on the new scope. Content: COCON 1.1.7FR, the Equality Act dignity-and-environment test, how to identify, respond to and escalate.
• Train Senior Managers specifically on the "could not reasonably have known" standard and what evidence protects it.
• Keep completion records at the level of each manager and Senior Manager, by area.

Process and investigation framework

• Review the investigation framework end-to-end against the full range: bullying, harassment, sexual misconduct, violence. Three outcomes supported: substantiated, dismissed with reason, inconclusive with reason.
• Build the independent-routing path for cases where the allegation touches the line. Document it in the policy and verify it in the system log.
• Agree the regulatory reference language for inconclusive outcomes with Legal. The FCA called this an area requiring careful judgement, so the firm's judgement has to be documented.

Systems and audit trail

• Audit the audit trail: can every substantiated case produce a chronological record from intake to closure, retrievable in a day, at Senior Manager area level?
• If intake is in one system, investigation in another, action in a third — close the gap. Separate systems break the trail at the exact points the Conduct Rule 2 defence relies on.
• Build team- and business-unit-level culture signals that each Senior Manager can see in their area, not just firm-wide averages.

Band 3 — July to August 2026 (approximately 2 months)

Evidence base

• Reconstruct 12 months of speak-up data at unit level, so the baseline exists before the clock starts.
• Build a one-click Senior Manager evidence pack per area: channels in place, training reach, substantiated cases with closure, inconclusive cases with reasoning, culture signals and trend.
• Finalise the quarterly review cadence that reaches Senior Managers and sits in minutes.

Dry run

• Simulate a regulator query. Pick a Senior Manager area, pick a type of serious NFM, and work the evidence pack end-to-end. Note gaps.
• Close the gaps. There will be gaps. Better to find them in August than in October.
• Brief the Board on readiness and residual risk. The Board carries the overall culture responsibility; make sure the brief is explicit about what has been done and what has not.

From 1 September 2026 — the operating model, not the project

The firms that handle this well do not treat September 2026 as a milestone. They treat it as the date by which the ongoing operating model has to be running. The checklist above is the project. From 1 September it becomes:

• Continuous training updates as PS25/23 is interpreted in enforcement.
• Monthly culture signal review at Senior Manager level, quarterly at Board level.
• Annual investigation framework audit, with pattern-driven changes to severity classification and training content.
• Evidence pack maintained live, not reconstructed on request.

The regulator baseline is already rising. The FCA received 1,131 whistleblowing reports in 2024/25, with 51% leading to direct regulatory action against firms, and Q1 2026 reports jumped 26% year on year. The new rule gives the FCA more to act on. Firms that cannot show the working will be the ones acted against first.

How Safe Workplace fits

Safe Workplace's CalmER platform runs the Band 2 and Band 3 work as one connected system — intake and triage, investigation workflow with three-outcome decisioning, action tracking to closure, team-level culture signals, and Senior Manager evidence packs that produce themselves. If your firm is between October and September 2026 and the Band 3 evidence base is still a theoretical construct, we would be happy to show you what the operating-model version looks like. Book a demo.