FCA's Non-Financial Misconduct Rule Takes Effect September 1, 2026

The rule and the date

On 1 September 2026, a new FCA rule — COCON 1.1.7FR — extends the Code of Conduct sourcebook in non-banking firms to cover bullying, harassment, or violence against colleagues, where it relates to an individual's role. The FCA finalized this in Policy Statement PS25/23, published 12 December 2025, closing a consultation (CP25/18) that ran from 2 July to 10 September 2025.

If your firm has Part 4A permission and staff subject to COCON or FIT, this applies to you. The rule traces back to a broader September 2023 diversity and inclusion consultation (CP23/20); in March 2025 the FCA dropped most of the other D&I and enforcement-transparency proposals from that consultation but kept the non-financial misconduct strand alive. That's worth noting on its own — NFM survived where the rest of the D&I package didn't.

What counts as non-financial misconduct

The FCA's definition, verbatim: "Non-financial misconduct includes behaviour that is not of a clearly financial nature such as bullying, harassment and violence." Where it's serious and goes unaddressed, the FCA's position is that it "can harm individuals, firms and confidence in financial services." That last phrase — confidence in financial services — is the regulatory hook tying workplace conduct to market integrity, not HR policy.

How the two regimes work — and don't overlap

COCON 1.1.7FR is narrow by design. It requires "a sufficient work-related link" — bullying, harassment, or violence connected to an individual's role. Two limits the FCA states explicitly: it is not retrospective, and it does not extend the FCA's regulatory remit beyond Senior Managers and Certification Regime (SM&CR) financial activities. This is a conduct-rule extension, not a general workplace-behavior mandate.

FIT (the Fit and Proper test) already permitted firms to weigh relevant misconduct "wherever it occurs" when assessing fitness and propriety — including conduct outside work. The new FIT guidance doesn't change that scope; it clarifies how firms should apply it, including to private life, social media conduct, and unproven allegations.

The distinction matters for how you document a case: COCON governs whether a specific, work-linked incident breaches a conduct rule; FIT governs the broader fitness assessment of the individual, which can draw on conduct wherever it occurred. Treating them as one test risks either under- or over-reaching in an investigation file.

What the new guidance actually covers

PS25/23 adds Handbook guidance the FCA says was "strongly supported by respondents to our consultation" — worth noting because it undercuts any framing of this as top-down rule-writing without industry buy-in. The guidance addresses four areas:

1. The boundary between work and private life
2. How non-financial misconduct can breach the conduct rules
3. Reasonable steps for managers
4. Fitness and propriety assessments — including private life, social media, and unproven allegations

The FCA has said this "finalises guidance to support firms applying our rules and brings our policy work on NFM to a close," adding that its focus now shifts to "how firms are tackling it in practice." Read that as a signal: the rulemaking phase is over, and the supervisory attention phase is starting.

What to do before 1 September 2026

Review whether these need updating:

• Staff conduct policies
• Conduct breach reporting processes
• Fit and proper assessment procedures
• Regulatory reference practices
• Staff and manager training on how the new scope applies

What the FCA has explicitly said firms do not need to do

This list matters as much as the obligations, because it forecloses some predictable overreactions:

• No retrospective review of past conduct rule breach determinations
• No revisiting past fitness and propriety assessments
• No monitoring of employees' private lives or social media accounts
• No investigating private-life allegations that are trivial, implausible, or irrelevant
• Nothing that conflicts with privacy, employment, or other applicable law

Why this reads familiar to a US compliance officer

The FCA has no direct US equivalent to COCON or FIT — the SEC and FINRA don't regulate workplace conduct this way. But the structural pattern is one this audience already recognizes from recordkeeping: a regulator sets an obligation, enforcement attention on the specific issue fluctuates, and the underlying duty doesn't move with it.

FINRA's 2026 Annual Regulatory Oversight Report flags recordkeeping lapses more than 50 times, with electronic communications capture failures and inadequate supervision procedures named explicitly as recent examination findings. Meanwhile the SEC has visibly pulled back from the off-channel sweep that produced $392.75 million in combined fines across 26 firms in August 2024 (SEC press release 2024-98) — no comparable new sweep action followed in the first half of 2025. Individual accountability actions kept coming anyway: FINRA fined and censured Benjamin F. Edwards & Co. $750,000 in January 2026 for failing to supervise and retain roughly 3,560 business-related texts sent through unapproved apps, including customer investment directives, and separately barred an individual from the industry over off-channel use that same month.

The lesson generalizes across both regimes: quieter headline enforcement is not the same signal as reduced obligation. The FCA is saying so directly about NFM. FINRA's examination findings are saying the same thing about recordkeeping, just without needing to say it in words — the exam findings speak for themselves.

The compliance file this creates

Whichever side of the Atlantic your firm sits on, the common thread is documentation discipline: conduct rule determinations, fitness assessments, and communications supervision all need a record that shows the firm applied its own stated process at the time — not a reconstruction built after an examiner asks. Firms that already keep tight records on off-channel communications capture and conduct-rule reporting will find the operational lift here is a policy and training update, not a system rebuild.

‍