FCA non-financial misconduct rules — a September 2026 readiness guide
From 1 September 2026, serious bullying, harassment and violence are inside the FCA's Conduct Rules for every authorised firm. Here is exactly what changes, who it applies to, what counts as serious, and how to be ready.
This page covers the FCA’s non-financial misconduct rules taking effect 1 September 2026. For how a wider speak-up culture plays out across sectors, see our employee relations platform.
The rule is final. The clock is running. The FCA published Policy Statement PS25/23 on 12 December 2025, confirming a new rule (COCON 1.1.7FR) and finalised guidance on how non-financial misconduct relates to the Conduct Rules and the Fit and Proper standard. The rule takes effect 1 September 2026, giving firms eleven months from today to be ready.
PS25/23 is non-retrospective. Conduct before 1 September 2026 continues to be assessed under existing Handbook provisions.
This is the first time the FCA’s Conduct Rules will cover serious bullying, harassment and violence across every authorised firm. Until now, those behaviours sat inside employment law and firms’ own HR policies. From September 2026 they also sit inside the regulator’s enforcement surface.
We update this page monthly and whenever the FCA publishes something material. Everything below is sourced to the FCA’s own publications — links at the foot of the page.
What is changing, in one place
Three changes land together on 1 September 2026, all introduced by PS25/23.
1. A new conduct rule reaches firms it never did before
COCON 1.1.7FR brings serious bullying, harassment and violence inside the Code of Conduct for every FSMA Part 4A authorised firm — not only the SMCR banks, Solvency II insurers and MiFID investment firms that already carried the detailed whistleblowing apparatus under SYSC 18. Non-financial misconduct is now something a non-bank authorised firm can be enforced against.
2. The Code of Conduct explains how NFM breaches it
The amendments to COCON spell out how non-financial misconduct can breach Conduct Rules 1 (acting with integrity) and 2 (acting with due skill, care and diligence). PS25/23 adds examples, tables and flow diagrams the earlier consultation did not carry, so firms can tell more consistently when a behaviour crosses into a breach.
3. Fit and Proper picks up conduct outside work
The Fit and Proper (FIT) sourcebook now explicitly treats conduct outside work as relevant to whether a person is suitable to perform a regulated role. The scope is deliberately narrow — private conduct that is trivial or implausibly connected to someone’s role stays out — but the lens is wider than COCON’s workplace-only focus.
Every authorised firm, not just the banks
The reach of the new rule is the biggest practical change in PS25/23. From 1 September 2026 the Conduct Rules on non-financial misconduct apply to every firm with an FSMA Part 4A permission — roughly 37,000 authorised firms across banking, insurance, investment, consumer credit, mortgages, payment services and e-money, among others.
The detailed whistleblowing arrangements in SYSC 18 — a named Whistleblowers’ Champion, Board-level oversight, formal internal channels capable of handling any disclosure — still apply only to the larger regulated firms. The reform does not change SYSC 18’s scope. What it changes is the baseline every authorised firm has to meet: regardless of SYSC 18, every one of them now has to be able to show how a serious concern reached it and what it did about it.
If your firm sits under the SMCR, you are in scope. If you employ anyone whose role is subject to COCON or FIT, that person is in scope.
What counts as “serious” misconduct
The FCA deliberately declined to publish a fixed list of qualifying behaviours, stating in PS25/23 that firms are best placed to assess seriousness in individual cases. That is a feature of the guidance, not a gap in it. The intent is that firms exercise judgement, aligned with employment and equality law, rather than wait for a checklist that will never be exhaustive.
The guidance anchors judgement on two inclusive descriptions:
- Bullying or harassment that violates a person’s dignity, or that creates an intimidating, hostile, degrading, humiliating or offensive environment. This mirrors the Equality Act 2010 threshold, so a firm that uses the Act’s test is already most of the way to the FCA’s.
- Serious and substantiated poor personal behaviour, of the kind that would normally trigger a regulatory reference under the existing regime.
Explicitly outside the scope:
- Minor incidents that do not have the purpose or effect described in the rule.
- Trivial allegations about private conduct, and allegations whose connection to a person’s role is implausible on its face.
The practical implication: your investigation framework has to be capable of distinguishing serious from minor, substantiated from implausible, and work-connected from private. The FCA does not prescribe how; it does expect you to be able to show the working.
Senior Managers now carry personal liability
Under the Senior Managers and Certification Regime, Senior Managers are responsible for the culture of the areas they lead. PS25/23 brings that responsibility squarely into the NFM space. The Conduct Rule 2 standard — “acting with due skill, care and diligence” — now explicitly covers whether staff feel able to raise concerns, whether misconduct is identified and addressed, and whether action closes the loop.
The FCA’s position is clear on how a Senior Manager escapes personal responsibility. They avoid it only where they:
- could not reasonably have known about the misconduct, or
- did not have authority to act on it.
The burden sits on the Senior Manager to show that. In practice, “could not reasonably have known” is a documentary standard: were the channels in place, was the training current, were the signals monitored, did an investigation framework exist that would have surfaced the issue if it reached the firm. A firm that can produce that evidence protects its Senior Managers; a firm that cannot, does not.
This is where the regulatory shift bites hardest. NFM has always been a cultural problem. From September 2026 it is also an individual-accountability problem.
Timeline from publication to enforcement
- 12 December 2025 — FCA publishes PS25/23 finalising the guidance.
- Jan to Aug 2026 — firms update policies, training, channels and investigation frameworks; align the Senior Managers’ Statements of Responsibilities; prepare the evidence a Conduct Rule 2 defence rests on.
- 1 September 2026 — COCON 1.1.7FR takes effect. From this date, conduct is assessed under the new rule.
- Late 2026 and 2027 — first enforcement signal as the FCA starts asking firms for the evidence base behind individual decisions. Expect scrutiny of outlier firms, of patterns surfaced through SYSC 18 reporting, and of regulatory references flagged under FIT.
The FCA received 1,131 whistleblowing reports in 2024/25, with 51% leading to direct regulatory action against firms, and Q1 2026 reports jumped 26% year on year. The baseline is already rising. The new rule gives the regulator more to act on.
What to do now
Five things every in-scope firm needs to be able to produce by 1 September 2026. Not a legal checklist — a working list of what evidence looks like.
Accessible, confidential reporting channels
- At least one named channel that reaches someone with authority to act.
- An anonymous route for cases where the reporter cannot be named.
- Public-facing wording that treats speaking up as expected, not exceptional.
Training that reaches managers
- Regular, scenario-based training on identifying, responding to and escalating NFM.
- Specific guidance on the dignity-and-environment threshold under the Equality Act lens.
- Records of completion for every manager with Conduct Rule 2 responsibilities.
Investigation framework fit for the range
- A documented process that handles bullying, harassment, sexual misconduct and violence.
- Independence from the line manager where the allegation touches the line.
- A pathway for inconclusive investigations — a known weak point in regulatory references.
Monitoring of culture and speak-up signals
- Trend data at team and business-unit level, not just firm-wide averages.
- A quarterly review that reaches Senior Managers and sits in minutes.
- Correlation checks against exits, pulse surveys, grievance filings.
Documented action, closed loop
- Every substantiated case ties to an action, an owner and a verified closure.
- Learning fed back into training content, policy and the channel copy.
- A board-ready narrative that an inspector can follow.
Alignment with the wider regime
- SYSC 18 arrangements still met where they apply.
- PIDA whistleblower protection unchanged and preserved in channel copy.
- EU Whistleblowing Directive and Sapin II obligations covered where you operate across borders.
Or stop running the audit by hand altogether.
Keeping all of the above current through policy, training and investigation workflows — and producing the evidence pack on demand — is where firms lose time and Senior Managers lose protection. Safe Workplace keeps the loop closed year-round, so when the FCA asks, the record is already written.
- Named and anonymous reporting channels, with routing and SLAs built in
- Investigation workflow tied to policy, training and closure evidence
- Culture signals at team and unit level, not just firm averages
- A one-click evidence pack for every Senior Manager’s area
Last reviewed: 2 October 2026. We review this guide monthly against FCA publications; where ours differs from the Handbook, the Handbook is correct.
Common questions
When do the new FCA non-financial misconduct rules take effect?
1 September 2026. The FCA published Policy Statement PS25/23 on 12 December 2025 confirming the implementation date and finalising the guidance. The amendments to COCON and FIT are non-retrospective; conduct before 1 September 2026 continues to be assessed under existing Handbook provisions.
Which firms are affected by COCON 1.1.7FR?
Every FSMA Part 4A authorised firm, not just banks and insurers. From 1 September 2026 the Conduct Rules on NFM reach every firm under the Senior Managers and Certification Regime. SYSC 18's detailed whistleblowing arrangements still apply only to the larger regulated firms, but every authorised firm must now be able to show how a serious concern reached it and what it did about it.
What is COCON 1.1.7FR?
The new rule that brings serious bullying, harassment and violence toward a colleague inside the FCA's Code of Conduct for firms beyond banks. It operates alongside existing Conduct Rules 1 and 2 and the Fit and Proper standard, and takes effect 1 September 2026.
What counts as serious non-financial misconduct?
The FCA deliberately declined to publish a fixed list, stating firms are best placed to assess seriousness in individual cases. The guidance anchors on bullying or harassment that violates dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment, and on serious and substantiated poor personal behaviour. Minor incidents, and trivial or implausible allegations about private conduct, fall outside.
How does non-financial misconduct interact with Fit and Proper?
COCON covers work-related NFM. The Fit and Proper (FIT) sourcebook extends the lens to conduct outside work where it bears on a person's suitability to perform a regulated role. Both strands take effect 1 September 2026 and together close the gap PS25/23 was published to close.
What is a Senior Manager's personal liability for NFM?
Under Conduct Rule 2 (due skill, care and diligence) a Senior Manager is responsible for the culture in the area they lead, which includes whether staff feel able to raise concerns and whether misconduct is identified and addressed. A manager escapes responsibility only where they could not reasonably have known about the misconduct, or where they did not have authority to act. The burden is on them to show that.
Does PS25/23 tell firms how to investigate NFM allegations?
No. The FCA explicitly declined to prescribe an investigation framework, calling it an area requiring careful judgement. Firms are expected to have an investigation process that is capable of handling the full range of NFM allegations and that produces evidence Senior Managers can act on.
How does the new rule interact with the EU Whistleblowing Directive and Sapin II?
The FCA's rule sits alongside, not instead of, existing whistleblowing law. UK firms must still meet the Public Interest Disclosure Act's protections. Firms with EU operations continue to meet the EU Whistleblowing Directive, and firms with French operations continue to meet Sapin II. The practical consequence is that one speak-up channel typically has to satisfy multiple regimes at once.
What does a firm need to evidence by 1 September 2026?
Five things, as a working list: accessible, confidential reporting channels (anonymous routes included); regular training for managers on identifying, responding to and escalating NFM; an investigation framework fit to handle the full range of allegations; monitoring of culture and speak-up signals; and documented action on what the firm learns.
References
- Care Quality Commission — FCA — PS25/23: Tackling non-financial misconduct in financial services (12 December 2025)
- Care Quality Commission — FCA — PS25/23 Policy Statement (PDF)
- Care Quality Commission — FCA — Non-financial misconduct (firms guidance)
- Care Quality Commission — FCA Handbook — SYSC 18 Whistleblowing
- Care Quality Commission — FCA Handbook — COCON
- Care Quality Commission — FCA Handbook — FIT (Fit and Proper test)
For general information only and reflects our understanding of CQC's approach as of July 2026. The framework is changing during 2026 — always check cqc.org.uk for the current framework for your sector. Reviewed by the CompliantCare clinical team.