The FCA's new non-financial misconduct framework comes into force on 1 September 2026. For affected firms, the immediate task is not to turn every workplace dispute into a regulatory breach. It is to make sure HR, compliance and senior management can identify conduct that falls within the FCA framework, investigate it fairly and translate the outcome into Conduct Rules, fitness and propriety, regulatory reference and reporting decisions where required.
PS25/23 applies to all FSMA firms with a Part 4A permission and to staff in those firms who are subject to COCON or FIT. The FCA has amended its Handbook guidance to explain how serious non-financial misconduct can breach the Conduct Rules and how non-financial misconduct can be relevant to the Fit and Proper test. The guidance and the new COCON rule take effect on 1 September 2026.
The practical risk is over-correction as much as under-reaction. Firms need a disciplined framework that separates ordinary performance or interpersonal issues from regulatory misconduct, distinguishes workplace conduct from private life, and records why a particular incident did or did not affect a regulatory assessment.
The 1 September 2026 change is wider than an HR policy update
The FCA's changes bring greater clarity and, for non-bank SMCR firms, a wider regulatory perimeter for serious non-financial misconduct. The policy focus is conduct such as serious bullying, harassment and violence, together with other behaviour that can be relevant to whether an individual meets the standards expected in financial services.
A policy rewrite on its own is therefore insufficient. The firm needs to connect workplace investigations with the regulatory processes that may follow. That can include a COCON assessment, a FIT decision for a Senior Manager or certified person, a regulatory reference, a conduct breach report and, in sufficiently significant cases, consideration of Principle 11 or another notification requirement.
The implementation date also matters when analysing facts. The new COCON rule and guidance take effect from 1 September 2026, so firms should identify when the relevant conduct occurred and apply the correct regulatory framework to that period rather than assuming the new rule retrospectively governs every historic workplace event.
COCON and FIT answer different questions
COCON concerns whether an individual subject to the Conduct Rules has breached an applicable rule. FIT concerns whether a person is fit and proper for a role or certification decision. The same underlying facts can therefore be relevant to both processes without the two assessments being identical.
A firm should avoid a shortcut in which an HR finding automatically becomes a Conduct Rules breach, or a COCON conclusion automatically determines fitness and propriety without separate analysis. The relevant facts, seriousness, context, evidence and role of the individual need to be assessed against the applicable regulatory test.
This separation is particularly important for certification. The firm remains responsible for assessing whether certified staff are fit and proper, and a non-financial misconduct finding can be relevant to that assessment. The decision record should show how the evidence affected the firm's conclusion rather than simply stating that an HR outcome was adopted.
The boundary between work and private life needs a fact-specific assessment
The FCA's final guidance specifically addresses the boundary between work and private life. Firms should therefore resist both extremes: treating all private conduct as irrelevant to regulation, or assuming any objectionable behaviour outside work automatically falls within COCON.
The assessment should focus on the circumstances and the regulatory test that actually applies. Work-related events, interactions with colleagues and conduct connected with the employment environment can raise different issues from genuinely private behaviour with no relevant connection to the firm's activities. FIT can also require consideration of information beyond the narrow workplace context where it is relevant to honesty, integrity, reputation or another aspect of fitness and propriety.
A practical decision template should record the setting, relationship between the people involved, connection to work, seriousness, evidence, regulatory role of the individual and the rule or FIT criterion being considered. This reduces the risk of inconsistent decisions driven by job title, seniority or commercial importance.
Investigations need regulatory discipline as well as employment-process fairness
Many cases will begin as HR investigations. Compliance should not take over every investigation, but the firm needs a defined point at which regulatory input is brought in. That is especially important where allegations involve a Senior Manager, certified person or Conduct Rules staff member and the outcome may affect an FCA obligation.
The evidence record should distinguish allegation, established fact and unresolved uncertainty. The FCA's guidance addresses issues including unproven allegations, and firms should avoid treating an allegation as a regulatory finding merely because it is serious. Equally, an inconclusive employment outcome does not necessarily mean the regulatory analysis disappears if there is reliable evidence relevant to FIT or another obligation.
Investigation governance should also manage conflicts. A highly productive employee or senior executive should not receive a materially weaker process because of commercial importance. Where the normal decision-maker is conflicted, an alternative decision route should be documented.
Fitness and propriety decisions should show the reasoning
For Senior Managers and certified staff, the firm should assess whether non-financial misconduct changes the current fitness and propriety conclusion. The relevant FIT framework includes honesty, integrity and reputation, competence and capability, and financial soundness, although the factual relevance of each element will differ.
The strongest record explains the conduct found, the evidence relied upon, its seriousness and relevance to the person's role, any pattern or recurrence, the individual's response and the reasons the firm concluded that the person remained or did not remain fit and proper. A generic statement that the matter was 'considered under FIT' provides little assurance.
The assessment should also be revisited where new evidence emerges. A case that was initially based on an allegation can change materially following an appeal, external finding, additional witness evidence or subsequent misconduct. The firm's certification and Senior Manager governance should be capable of responding to that development.
Regulatory references and conduct reporting need to be connected to the outcome
Non-financial misconduct can affect regulatory references where the applicable reference rules require the relevant information to be included. Firms should therefore ensure the team preparing references can access the final regulatory assessment rather than only the headline HR outcome.
Conduct Rules reporting also needs a controlled process. The firm should identify whether a report is required, the correct reporting route and timing, and the evidence supporting the classification. A serious internal allegation should not be reported as an established breach unless the firm has reached that conclusion under the relevant rules.
Where the issue is significant for the firm itself, the analysis should extend beyond individual reporting. Principle 11 and SUP 15 can become relevant where the matter reveals a serious cultural, governance or systems-and-controls problem. The notification decision should be documented rather than assumed from the individual case outcome.
Policies, training and manager guidance should be practical
Before 1 September, firms should review staff policies, Conduct Rules processes, FIT assessments and regulatory reference procedures, which are the areas the FCA itself has highlighted for preparation. The documents should use the same decision logic so that HR and compliance do not reach contradictory outcomes because each policy uses different terminology.
Training should focus on judgement. Managers need to understand when an issue may have a regulatory dimension and when to escalate it, while investigators need to know the distinction between employment findings, COCON and FIT. Staff should understand the standards without being encouraged to label every difficult interaction as a regulatory breach.
The firm should also test its speak-up and escalation routes. A policy that looks strong but discourages reporting because employees fear retaliation or believe senior revenue producers are protected can create a culture problem that the new framework is specifically intended to address.
Senior Managers need evidence of reasonable oversight
Senior Managers do not need to personally investigate every allegation. They do need a governance framework that allows serious issues to reach the right decision-makers and prevents known weaknesses from remaining unresolved.
Useful management information can include serious allegation volumes, investigation age, themes, outcomes, repeat issues, regulatory assessments and overdue remediation. The purpose is not to create a league table of misconduct, but to identify whether a business area, management layer or process is generating recurring risk.
Where the FCA's Conduct Rules reasonable-steps guidance is relevant to managers, the firm should ensure responsibilities are clear and that senior leaders can show how they responded to material issues. Minutes, escalation records and remediation tracking can become important evidence if the FCA later asks how management handled a known cultural problem.
What firms should complete before 1 September 2026
The immediate priority is a controlled readiness review. The firm should identify which staff are subject to COCON and FIT, map the new guidance into existing HR and compliance processes, confirm who makes regulatory decisions, update reference and reporting workflows, and train the people who will apply the framework.
A short scenario test is valuable. The firm can take several realistic cases, such as serious workplace bullying, an allegation that remains unproven, misconduct at a work social event and genuinely private conduct, and walk each case through HR, COCON, FIT, reference and notification decisions. Inconsistencies are easier to fix before a live case creates time pressure.
The objective is not zero tolerance for every interpersonal problem. It is consistent, fair and evidence-based application of the FCA framework from the effective date.
How Regulatory Counsel can support
Regulatory Counsel supports FCA-regulated firms with the regulatory, governance and remediation issues covered in this article. We can review the existing framework, identify gaps and support practical implementation or independent assurance.
Speak to Regulatory Counsel to discuss this area.
Frequently Asked Questions
The new COCON rule and the final PS25/23 guidance come into force on 1 September 2026.
The FCA states that the policy applies to all FSMA firms with a Part 4A permission and to staff in those firms who are subject to COCON or FIT.
No. The firm must assess the facts against the applicable COCON guidance and rule. An allegation is not automatically an established regulatory breach.
Potentially. The FCA guidance addresses the boundary between work and private life and explains how private conduct can be relevant to FIT in appropriate circumstances. The assessment is fact specific.
Yes. We can review policies, decision frameworks, COCON and FIT processes, regulatory references, reporting routes, governance and implementation readiness.