GB
The FCA non-financial misconduct guidance came into force on 1 September 2026, alongside a new Conduct Rules provision that brings serious workplace misconduct at many non-bank firms within the scope of COCON.
The central message is clear: behaviour such as bullying, harassment or violence can have regulatory consequences, while conduct outside work can also be relevant when a firm assesses an individual's fitness and propriety. This is not simply an HR issue. It can affect Conduct Rules assessments, certification decisions, regulatory notifications and references.
For FCA-regulated firms operating under the Senior Managers and Certification Regime, the practical challenge is joining up employment processes and regulatory decision-making without treating every allegation as a regulatory breach.
Non-financial misconduct, under the FCA's guidance, is misconduct that is not clearly financial in nature but may still breach the Conduct Rules or be relevant to whether an individual is fit and proper to perform a regulated role.
The term is broad, but the new COCON rule focuses particularly on serious workplace behaviour such as:
- sexual harassment or assault
- bullying, intimidation or harassment
- violent or abusive behaviour
- other serious misconduct that may call an individual's honesty, integrity or reputation into question, including relevant criminal conduct outside financial services
Context matters. The FCA guidance does not make every disagreement, poor joke or unproven allegation a Conduct Rules breach. Firms must consider the seriousness, purpose, effect and surrounding facts, then decide whether the conduct falls within COCON and whether it breaches an individual conduct rule.
Private-life conduct is treated differently. It will not usually fall within COCON simply because the individual works for a regulated firm, but it may still be relevant to a fitness and propriety assessment under FIT. That is particularly important for senior managers, certified staff and others whose role depends on the firm being satisfied that they remain fit and proper.
The final COCON and FIT guidance and the new rule at COCON 1.1.7FR came into force on 1 September 2026.
The FCA published Policy Statement PS25/23 on 12 December 2025 following consultation in CP25/18. The package explains how firms should identify serious non-financial misconduct, decide whether it falls within COCON and assess its relevance to fitness and propriety.
The rule change is especially significant for non-bank SM&CR firms. It expands the scope of COCON so that serious bullying, harassment and violence towards colleagues can be covered when connected with the performance of an individual's role, even where it is not part of a regulated financial services activity. The FCA estimated that the rule and guidance would affect approximately 37,805 SM&CR firms.
The new COCON rule is not retrospective. Conduct that occurred before 1 September 2026 must be considered under the Handbook rules that applied at the time. The FCA does not expect firms to reopen historic decisions simply to reassess them under the new rule. However, earlier conduct may still be relevant to a current fitness and propriety assessment under the FIT framework.
The new framework gives firms more clarity, but it also raises the standard expected of their processes. In practice:
Serious workplace non-financial misconduct can amount to a breach of the FCA Conduct Rules.
The COCON scope for relevant misconduct at non-banks is now more closely aligned with the position for banks.
Firms must make fair, proportionate and evidence-based decisions when allegations arise, rather than dismissing the matter as an HR issue.
Managers may need to take reasonable steps to prevent or address misconduct where they know about it and have authority to act.
Where disciplinary action is taken because of a Conduct Rules breach, FCA notification requirements may be triggered.
Serious and substantiated findings must be considered when preparing regulatory references, helping to prevent individuals from avoiding accountability by moving between firms.
The FCA is not asking firms to become moral arbiters or to investigate trivial, implausible or purely personal allegations without justification. It expects reasoned judgement: what happened, how reliable the evidence is, whether the behaviour is connected to the person's role, whether COCON applies and what the conduct says about fitness and propriety.
The guidance has practical consequences across governance, people management and regulatory compliance:
Fitness and propriety assessments must properly consider relevant non-financial misconduct, including conduct outside work where appropriate.
Disciplinary processes must be fair, independent where necessary and carefully documented.
Regulatory references must accurately reflect serious, substantiated findings where the rules require disclosure.
HR and compliance teams need a shared escalation process so regulatory issues are identified without prejudging an employment investigation.
Boards and senior managers need reliable management information and clear oversight of culture and conduct risk.
For founders and leadership teams, allegations involving senior people are particularly sensitive. The firm must protect fairness and confidentiality while also considering individual accountability, certification, regulatory reporting and reputational risk.
Not every fintech falls within the rules in the same way. The FCA says PS25/23 is relevant to firms with a Part 4A permission and individuals subject to COCON and FIT. Payment institutions and e-money institutions that do not have a Part 4A permission are not automatically brought into scope by the new COCON rule, although employment law, governance expectations and other regulatory obligations may still apply. Firms should confirm their own perimeter before relying on a generic checklist.
The rules are already in force, so firms should treat any outstanding implementation work as a priority.
Review conduct policies and disciplinary frameworks. Check that definitions, investigation steps, decision-making responsibilities and possible regulatory consequences reflect PS25/23 and the new COCON rule.
Align HR and compliance. Agree clear escalation triggers, information-sharing protocols and ownership. Employment and regulatory assessments may overlap, but they are not the same exercise.
Train managers. Explain when conduct may move beyond an internal people issue and become relevant to COCON, fitness and propriety, notifications or regulatory references.
Revisit fitness and propriety processes. Update annual certification and event-driven assessment procedures so relevant workplace and private-life conduct is considered fairly, proportionately and consistently.
Stress-test senior cases. Run a tabletop exercise involving an allegation against a founder, senior manager or board member. Confirm who would investigate, manage conflicts, make regulatory decisions and communicate with the FCA.
Throughout the process, document the evidence considered, the rules applied, the reasoning behind the conclusion and any action taken. The FCA cares about the quality and consistency of the decision-making process as well as the final outcome.
PS25/23, the new COCON rule and the final COCON and FIT guidance have applied since 1 September 2026.
The rule brings serious workplace misconduct at non-bank SM&CR firms more closely into line with the position for banks.
The new COCON rule is not retrospective, although earlier conduct may remain relevant to a current fitness and propriety assessment.
Serious and substantiated findings can affect regulatory notifications, certification decisions and regulatory references.
Firms should have updated policies, aligned HR and compliance, trained managers and documented how decisions are reached.
Non-financial misconduct sits at the intersection of employment law and financial regulation. We help FCA-regulated firms investigate sensitive allegations, manage disciplinary and grievance processes, assess SM&CR implications and make defensible decisions on reporting and regulatory references.
We can also review your policies, escalation framework, fitness and propriety process and manager training so the regulatory response works in practice, not just on paper. Get in touch with our Employment and Fintech teams if you need support with a live issue or a post-implementation review.
We act as an extension of your team and handle any overflow in specialist areas.
Working across five continents, operating in multiple sectors, with over 400 clients.
Offices in London | Dubai.
