Expansion of the FCA’s regulation of non-financial misconduct  

(September 2026 update)

As of 1 September 2026, the Financial Conduct Authority (FCA) has significantly expanded its regulatory framework and guidance to capture non-financial misconduct such as bullying, harassment and violence, in non-banking firms. The FCA anticipates that the changes will affect some 37,000 firms which fall under its Senior Managers and Certification Regime.

Background

The recent changes follow a policy statement published in December 2025.

Previously the FCA’s Code of Conduct (COCON) rules only applied to banking firms. In an effort to tackle apparent cultural failings in the wider sector, new rule COCON 1.1.7FR extends the scope of those rules to non-banking firms, where the misconduct relates to an individual’s role. These changes align the FCA’s overall approach more closely with that taken by regulators in other professional sectors.

Speaking in July of last year, ahead of the changes, the FCA’s deputy chief executive said:

“Too often when we see problems in the market, there are cultural failings in firms. Behaviour like bullying or harassment going unchallenged is one of the reddest flags – a culture where this occurs can raise questions about a firm’s decision making and risk management. Our new rules will help drive consistency across industry and support the vast majority of firms that want to do the right thing to deepen trust in financial services.”

The changes do not apply retrospectively; firms are not expected to revisit historic allegations of misconduct in light of them.

What are the new rules? 

The new rules may be engaged by violent conduct, as well as by unwanted conduct that has the purpose or effect “of violating [an individual]’s dignity” or “creating an intimidating, hostile, degrading, humiliating or offensive environment for [an individual]”. In circumstances where conduct of this nature has occurred, consideration will need to be given to wider FCA guidance, before deciding whether it amounts to a breach of COCON.

Harassment is captured by COCON, but only if is constituted by conduct which is found to be “serious”. Factors informing findings as to seriousness include previous conduct, duration, the relative seniority of the alleged harasser and harassed, whether the conduct would justify dismissal, and the criminality of the conduct.

Guidance associated with the new rules indicates that assessments of alleged harassment should include both a subjective and an objective element. With regard to the former, the perception of the alleged victim (as to the violation of their dignity and /or the nature of the working environment created by the conduct), is relevant. With regard to the latter, an assessment of whether it was reasonable for the conduct in question to have the effect that it did on the alleged victim, should also be carried out.

COCON constitutes one element of the FCA’s regulation of non-financial misconduct, the other being the Fit and Proper Test. The FCA has also published new guidance with regard to the latter, relating specifically to social media. The threshold for misconduct as per this guidance is apparently a high one; threats of violence and clear involvement in criminal activity will be relevant, but (controversial) free expression online by connected persons, will not necessarily require action on the part of regulated firms.

What steps should regulated firms and individuals take, in light of the changes? 

Firms should take what steps they can to avoid allegations of non-financial misconduct being made in the first place. These will include ensuring that the relevant policies are updated and that staff have the proper training. Firms should also prepare to deal with allegations by ensuring that their processes for investigating them are clear and robust. Individuals, need to know about the expansion of non-financial misconduct and how their actions may come into conflict with it.

Once an allegation of non-financial misconduct is made, firms will need treat it carefully. Both the facts of the case and the rules will need to be reviewed closely. Firms will undoubtedly be required to exercise judgment in cases that are not clear cut, especially when making a finding as to seriousness, or as to whether the conduct was sufficiently connected to the individual’s role at the firm. Importantly, senior managers who knew or should have known about misconduct within their area of responsibility, and yet failed to act, may be held personally liable by the FCA.

Individuals who face investigation should seek early legal advice so as to fully understand their position and compliance with the FCA’s rules. Careful analysis needs to be made of the allegations in order to protect the individual’s position in any investigation. This is not just a HR issue, but rather could impact the individual’s future career.