Non-financial misconduct and managing regulatory risk

by James Alleyne, Partner at Kingsley Napley LLP

As standards of acceptable workplace behaviour continue to evolve, the Financial Conduct Authority (FCA) has been grappling with the issue of non-financial misconduct (NFM). NFM can encompass a wide range of issues; from bullying and harassment, all the way through to criminal convictions for the most serious offences. 

NFM is an inherently difficult and subjective issue for firms to navigate. What might be one person’s firm management style could be another person’s bullying. One person’s sense of humour may well be offensive to another, and so on. It is naturally difficult to apply clear and rigid standards to this, even more so in multi-generational, multi-cultural workplaces, where different individuals will have their own sensitivities and views as to what is acceptable. 

The FCA has sought to bring clarity and certainty to this issue through a new set of rules and guidance setting out its expectations on NFM and aimed at assisting firms in making fair and appropriate decisions. This will apply to all banks and most other regulated financial firms from 1 September 2026 and is likely to have a significant impact upon the whole sector. 

The conduct rules

The conduct rules (as set out in the COCON module of the FCA’s Handbook) are the baseline behavioural standards applicable to the vast majority of employees of regulated firms. They only apply to workplace conduct and include, for example, the requirement to act with integrity and to discharge functions with due skill, care and diligence. Those in senior manager roles are also subject to an additional layer of rules, with the FCA empowered to take action where it is found that an individual has failed to meet the requisite standards.  

Under the current regime, the scope of the conduct rules is wider for staff at banks than at other regulated firms. At non-banking firms (e.g. insurers and asset managers), the conduct rules apply, broadly, to the firm’s financial services activities only. At banks, however, COCON applies in relation to “any activities” conducted by the firm. Currently, NFM by an employee at a non-banking firm is highly unlikely to breach the conduct rules, whereas the same conduct by a bank employee may well do. 

This will change on 1 September 2026.  A new rule specifically extends the scope of the conduct rules in non-banking firms to include serious incidents of work-related bullying, harassment and violence. This has significant potential consequences for individuals. Where a breach of the conduct rules has been found and disciplinary action is taken as a result, the firm is required to notify the FCA and to disclose the matter in any regulatory reference. In the case of serious breaches, the FCA can open its own investigation and take disciplinary action in the form of fines and prohibitions.

For all firms, the FCA has provided new guidance to help assess whether instances of misconduct fall within the scope of the conduct rules. This includes a helpful table illustrating the boundaries between work and an individual’s private life, an important issue given that COCON only applies to workplace behaviour, while recognising that hybrid working and work-related socialising can blur these lines. For example, misconduct towards a colleague at a social event organised by the firm is likely to fall within scope, as are circumstances involving the use of firm premises or firm equipment. 

Those with managerial responsibility also need to be particularly careful; new guidance is clear that there is a positive duty on managers to tackle these behaviours and to provide a safe environment for their staff. In effect, the days of being able to sweep allegations of NFM under the carpet, or simply move problematic staff sideways, are gone. Any failure by firms and managers to deal with these issues thoroughly will expose them to regulatory scrutiny and possible liability. 

Fitness and propriety 

In addition to these changes to COCON, the new guidance also seeks to clarify how NFM forms part of the fit and proper test (FIT). 

Whereas the conduct rules apply to most staff, fitness and propriety is only relevant to a firm’s certified persons and senior managers. In contrast to the conduct rules, however, the fit and proper test does extend to individuals’ private lives, where the conduct is such that it poses a material risk that the individual will breach regulatory rules and standards.     

A number of changes to this test will come in from 1 September 2026. 

The current guidance sets out, by way of a non-exhaustive list, the main assessment criteria, including in respect of honesty, integrity and reputation. At present, this is largely focused on financial issues. The new guidance will extend this to include criminal matters beyond allegations of dishonesty (to include offences of a violent or sexual nature) as well as findings, by a court or in a disciplinary process, that the person has engaged in harassment, victimisation or discrimination.

Many firms may also be particularly interested in the new guidance around employees’ social media usage. Whilst firms are not expected to proactively police the social media accounts of their staff, and the lawful expression of controversial views will not necessarily impinge on fitness and propriety, the new guidance makes clear that personal social media usage can be relevant where it indicates a material risk that the individual will breach regulatory standards. This could include where threats of violence are made or there is clear involvement in criminal activities. 

How to prepare

Whilst firms cannot underestimate the importance of these changes, it is worth bearing in mind that the FCA is unlikely to expect perfection from day one. The regulator is likely to understand how difficult and subjective these issues and decisions can be, giving firms leeway to interpret the rules and come to their own positions. What it will absolutely expect though, from the outset, is for firms to make careful and defensible decisions supported by strong governance. Any decisions should refer to the relevant guidance, involve appropriate stakeholders with a clearly documented audit trail showing their thought process, the factors they have considered and how they have come to a particular outcome.  

To ensure that they are in the strongest possible place to achieve this, there are a number of things that regulated firms should start doing now if they have not already. This includes:

• Updating the relevant sections of staff handbooks, codes of conduct and dignity at work policies;

• Reviewing whistleblowing frameworks;

• Reviewing social media usage policies;

• Ensuring there are proper routes of escalation for staff to raise concerns;

• Ensuring staff – particularly those in managerial roles - are trained comprehensively and in a way tailored to their specific roles;

• Considering whether fitness and propriety assessments are adequate in light of these changes and capture everything that is required of them;

• Reviewing the process for providing regulatory references; 

• Establishing and document clear escalation routes to ensure that NFM issues are considered from both an HR and compliance perspective.

• Ensuring that allegations of NFM are dealt with properly.  This means conducting thorough and fair investigations, with clear frameworks that carefully record decision making.