On 2 July 2025, the United Kingdom (UK) Financial Conduct Authority (FCA) published a Consultation Paper and Policy Statement (CP25/18) on tackling non-financial misconduct in financial services. There are two components:

• The Policy Statement sets out final rules effective 1 September 2026 amending the Code of Conduct sourcebook (COCON) to more clearly provide that non-financial misconduct (NFM) such as bullying, harassment and violence in the workplace may be within the scope of the conduct rules for non-banks. The FCA states that this more closely aligns the position with that for banks.  
• The Consultation Paper proposes guidance to clarify the conduct rules and fitness and propriety requirements, particularly in relation to NFM. The guidance is intended to ensure the FCA’s rules are applied in a consistent way by firms. Since there are substantive changes to the draft guidance originally proposed in 2023, it is subject to a new consultation.

Why Now?

The FCA has for many years sought to ensure that firms address NFM by individuals operating in the financial services sector. Following the FCA’s consultation in 2023 (CP23/20), support for change and clarity in the approach to NFM was strengthened by last year’s FCA survey on “Incidents of non-financial misconduct (NFM) across Wholesale Brokers, Wholesale Insurers & Wholesale Intermediaries portfolios”. That survey found that more than one third of firms did not report such cases to their boards, and that many lacked appropriate governance structures to deal with such incidents (see here for the results of the survey). Further, the FCA found reports of bullying, discrimination and other NFM in the UK’s financial services industry had surged by almost 60% between 2020-2023 (based on reported cases). 

What Is Changing?

Currently COCON 1.1.7AR provides that for individuals subject to COCON working for non-bank firms, the conduct rules only apply to conduct that forms part of, or is for the purposes of: (i) the firm’s regulated activities and certain related activities (termed “SMCR financial activities”); and (ii) certain kinds of misconduct that could have serious effects (e.g. on the integrity of the UK financial system). 

The FCA’s view is that this does not make it sufficiently clear that NFM by individuals in the workplace may be within the scope of the conduct rules. The FCA also perceives that it creates a discrepancy between the approach for banks and non-banks, since banks are not subject to the provision at COCON 1.1.7AR limiting the activities within the scope of the conduct rules. 

To rectify this, the FCA is making a new rule that will create exceptions to the scope restriction at COCON 1.1.7AR. The effect of new rule COCON 1.1.7FR will be to extend the scope of COCON to certain types of workplace activities with effect from 1 September 2026. 

This somewhat complicated approach of drafting an exception to the scope restriction rather than simply removing or amending the scope restriction, arises because the FCA’s power to make rules of conduct for individuals working for regulated firms is limited by statute. That creates some possible intricacies for non-banks with mixed businesses involving financial services and non-financial services activities.

Why Is This Important?

Despite the convoluted drafting in COCON and the complexities that brings, the FCA’s desired outcome is clear–NFM in the workplace may cause the individual involved to breach the conduct rules.

Where an individual within the scope of COCON breaches a conduct rule and the firm takes disciplinary action, the firm must notify the FCA. The FCA may take enforcement action against the individual, which may result in a financial penalty being imposed on the individual, public censure, and the individual being prohibited from performing regulated activities.

Alongside the conduct rules, the firm would also consider its rights and obligations under employment law, and its determination of whether the individual is fit and proper to perform the responsibilities currently allocated to them.

Important Aspects of the Changes

As mentioned, alongside the new FCA rule described above that expands–or at least clarifies–the scope of activities relevant when determining whether an individual has breached the conduct rules, the FCA is also consulting on new guidance to be included in COCON. There are a number of important observations on the combined package to bring to firms’ attention.

Work Versus Private Life

Due to statutory limitations on the FCA’s power to impose conduct rules, conduct in a person’s private or personal life is out of scope of COCON. However, the FCA makes clear that a person’s conduct in their private or personal life remains relevant, noting in particular the following:

• The required assessment of whether an individual performing senior management or certification functions is fit and proper to perform the responsibilities allocated to them can take account of any relevant matters wherever they occur.
• The FCA also notes that under employment law, misconduct in a non-work setting may cause an employer to take disciplinary action.
• The boundary between misconduct at work versus in private life may not always be clear, and there may be cross-over. The FCA’s proposed guidance seeks to clarify this, and includes various proposed examples, such as if misconduct occurs after a firm event at a separate location or venue, it may be within the scope of the conduct rules if it is a continuation of the first event or if the conduct started at the first event and continued in the new venue. 

Specifically in relation to the assessment of whether a person is fit and proper: 

• The proposed guidance states that firms need not monitor their employees’ private lives. However, if a firm becomes aware of allegations of NFM in relation to an employee’s private life, the FCA would expect firms to investigate such allegations. The proposed guidance states that the FCA expects firms to rely on formal findings such as criminal convictions or the finding of a court, tribunal or regulator to assess whether wrongdoing has occurred in an individual’s private life. 
• The draft guidance removing wording from CP23/20 could have implied regulatory overreach and now states that conduct may be relevant if it shows a willingness to disregard ethical or legal obligations, abuses a position of trust, or exploits others’ vulnerabilities. 
• The revised guidance also uses less subjective, more neutral language than that in CP23/20. The proposed guidance states that conduct in an individual’s personal or private life may be relevant if it is sufficiently serious such that were the person permitted to work at a firm it could undermine public confidence in the regulatory system or otherwise impact the FCA’s statutory objectives. 

Determining Seriousness (or Not!)

The FCA is concerned with “serious” misconduct, and that term appears throughout COCON. The consultation paper proposes including an evidential provision and guidance in COCON to assist firms in determining whether conduct is serious. This includes listing factors to be considered, including whether the conduct is repeated or part of a pattern, the difference in seniority between people and whether the conduct would justify dismissal, etc.

The proposed guidance also makes it clear that seriousness is not the deciding or distinguishing factor in determining whether NFM is a breach of Conduct Rule 1 (acting with integrity) or Rule 2 (acting with due skill, care and diligence). Since only deliberate or reckless misconduct is considered a breach of Rule 1, this means that in the absence of those factors, NFM is likely to be a breach of Rule 2. 

Social Media

The proposed guidance clarifies that, in principle, a person can lawfully express in their private or personal life their views on social media, even if those views are controversial or offensive. However, social media activity may become relevant: 

• In relation to the individual conduct rules, the proposed guidance states that social media activity may be within the scope of COCON. Factors to take into account include whether the material is directed at a fellow member of the workforce, whether the content is related to work at the firm, and whether the person uses a work-issued device. (Proposed guidance at COCON 1.3.7G). 
•  In relation to the assessment of a person’s fitness and propriety, the proposed guidance states that the factors identified as generally relevant in the COCON guidance also apply in relation to social media activity. For example, if a person’s social media content indicates a real risk the person will breach relevant regulatory requirements and standards, or includes threats of violence or clear involvement in criminal activities, this may be relevant to the assessment of the person’s fitness and propriety. (Proposed guidance at COCON 1.3.21G).

Responsibility of Managers

The proposed guidance states that managers should try to prevent harassment and other kinds of misconduct and will not be in breach of Conduct Rule 2 (acting with due skill, etc) if they have acted reasonably (COCON 4.1.8-AG). The guidance also includes examples of conduct by a manager that could breach Rule 2, for example, failing to intervene to stop such behaviour where appropriate if a manager knows or should know of it. 

It is important for managers to be aware of the expectations on them with respect to MFN in the context of their own compliance with the conduct rules. A firm may allocate responsibility for the fair treatment of staff to a particular senior manager, but this will not remove the responsibility of other senior managers to develop and embed healthy cultures.

What Does This Mean for Regulated Firms?

Firms should consider how they approach NFM, including who in senior management will be responsible for ensuring compliance with the requirements.

The rule change will apply from 1 September 2026. The consultation on the guidance is open until 10 September 2025. The FCA is intending to finalise the guidance before the end of 2025 in order to allow firms time to update their processes.  

The specific action items include:

• Ensuring policies, procedures, employee handbooks and workplace governance processes reflect the clarification of the scope of the Rules, the approach to fitness and propriety assessments, and when notification to the FCA is required;
• Since firms are required to train in-scope staff on the conduct rules, provide training to staff on the conduct rules noting the change–or clarification–of the approach to NFM and the responsibility of managers;
• Consider whether fitness and propriety assessment criteria/methodologies need to be changed to ensure they reflect the scope of matters expected to be taken into account; and
• Consider the allocation of responsibilities amongst senior managers on matters relating to the fair treatment of staff, and responsibility for developing and embedding healthy cultures.

Conclusion 

This guidance makes the FCA position clearer. NFM will be scrutinised more than ever before, for both banks and other regulated firms. Firms must update their processes and written policies, and must ensure relevant staff receive training. However, we are only likely to gain a full understanding of the FCA’s approach and expectations once the rule changes and any further guidance come into effect.