The UK FCA's Non-Financial Misconduct Rule Is Here – and All Financial Services Firms are in the Crosshairs

What Has Changed

Until now, the FCA’s approach to non-financial misconduct operated principally through the existing conduct rules and the fitness and propriety regime. While the regulator made clear – most prominently through its October 2024 survey of over 1,000 firms – that bullying, sexual harassment and discrimination fell within its regulatory remit, the absence of an express conduct rule left the framework dependent on interpretation and inference.

That has now changed. The new rule creates a standalone prohibition within the individual conduct rules, targeting serious bullying, harassment and violence directed at fellow members of the workforce where the conduct has a sufficient connection to the working environment. The rule does not extend to discrimination or victimisation as independent grounds, though sexual harassment falls within its scope as a form of harassment. Where discriminatory behaviour also constitutes bullying, harassment or violence, it may be caught by the new rule; other forms of discrimination remain subject to the existing conduct rules.

The conduct rule is reinforced by parallel changes to the fitness and propriety framework. The FCA has updated its guidance to state expressly that serious non-financial misconduct – whether it occurs in the workplace or outside it – bears on assessments of an individual’s character. The practical effect is to expand the range of conduct that can support a decision to refuse or revoke approval, and firms should anticipate a corresponding increase in the number of individuals who are blocked from taking up or continuing in regulated roles.

The regulatory reference regime reinforces both mechanisms. Disciplinary action taken for a conduct rule breach must be recorded in the departing employee’s regulatory reference, and firms have discretion to include additional fitness and propriety information they consider relevant. The effect is to create a lasting record that follows individuals across the industry: those with adverse findings on their reference will face significant barriers to securing a new regulated position.

Why Non-Bank Financial Firms Face Elevated Risk

The FCA’s non-financial misconduct regime applies uniformly across the regulated sector, but its practical impact will not be uniform. Non-bank financial firms face elevated risk for several structural reasons.

Smaller compliance teams, greater exposure. Many hedge funds, private equity firms and boutique asset managers operate with lean compliance functions. The new regime requires robust investigation procedures, systematic record-keeping and structured training – capabilities that the major banks have spent years and considerable resources building. A conduct policy that exists in a handbook but has never been actively communicated to staff will carry little weight with the regulator. Similarly, a process in which allegations are handled through ad hoc conversations with HR and resolved by way of a managed exit is unlikely to withstand scrutiny.

Performance-driven cultures. The FCA has been explicit that firms which enforce conduct standards against junior employees but tolerate equivalent behaviour from commercially important senior figures face acute regulatory exposure. That risk profile is common in the non-bank sector, where a handful of key individuals may account for a large proportion of the firm’s revenue and exercise disproportionate influence over working culture. The regulator regards inconsistent enforcement along lines of seniority or commercial contribution as an indicator of governance failure.

International groups. Where a firm’s UK operations sit within a wider international group, there is a risk that group-level HR policies – designed for jurisdictions with different legal and cultural expectations – will fall short of FCA standards. The regulator has made clear that compliance with the UK framework is not optional merely because a different approach applies elsewhere in the group. Firms that apply one set of standards to locally hired staff and another to international secondees or transfers will not be protected.

Newer market entrants. The regime will expand its reach as new categories of firm come into the regulatory perimeter. Cryptoasset firms seeking FCA authorisation under the framework expected to take effect on October 25, 2027 will, on authorisation, fall within SM&CR – and with it, the full suite of conduct rules, including the non-financial misconduct rule. Many of these firms have been built for speed rather than regulatory resilience, and their compliance frameworks and workplace cultures have not been tested against standards of this kind. The time to build those capabilities is during the authorisation process, not after it.

The Grey Areas: Where the Hardest Judgement Calls Will Be

The regime’s outcomes-based design provides flexibility but also creates genuine uncertainty – particularly during the first 12 to 18 months, when firms will be operating with limited regulatory precedent to guide them.

The “reasonable steps” standard. The hardest cases will involve contested allegations, out-of-workplace conduct and commercially important individuals. A compliance officer who receives a formal grievance alleging that a senior dealmaker has engaged in a sustained pattern of intimidation towards junior staff faces an immediate judgement call: what level of investigation is proportionate before interim measures are taken, and at what point does the obligation to act override the risk of disrupting a live transaction? Getting it wrong in either direction carries regulatory and reputational consequences.

Private life and social media. Private or personal conduct falls outside the new conduct rule’s scope. However, the fitness and propriety guidance operates separately and more broadly: conduct in an individual’s private life – including social media activity – may be relevant to a fitness and propriety assessment where it poses a material risk of regulatory breach. Consider a certified employee who repeatedly posts abusive and threatening comments on a personal social media account, directed at individuals outside the firm and unconnected to work. The conduct rule would not apply – there is no work-related nexus and no fellow member of the workforce is targeted. But the fitness and propriety guidance may require the firm to consider whether a pattern of threatening online behaviour suggests a propensity for aggression that is relevant to the individual’s suitability for a regulated role. The position becomes more acute if the posts come to the attention of colleagues or clients, but the guidance does not make relevance contingent on visibility.

Where does demanding management end and bullying begin? A fund manager who, during a period of significant drawdown, routinely singles out individual analysts for blame in front of the wider team and makes remarks that undermine their professional competence may be engaging in conduct that crosses the line into non-financial misconduct, provided the seriousness threshold is met. The FCA’s guidance sets out relevant factors but stops short of drawing a bright line. This is a particularly acute question for firms where high-pressure, direct management styles are the norm.

The Overcautiousness Trap

If inconsistency is the primary regulatory risk, overcautiousness is the primary operational risk. Firms that adopt an unduly low threshold for recordable findings may expose themselves to a different set of problems: reputational harm to employees based on unproven complaints, challenges before employment tribunals and a chilling effect on workforce mobility where the underlying conduct was minor or genuinely disputed. Striking the right balance will be one of the defining challenges of the regime’s first year.

There is a further layer of complexity. The Employment Rights Act 2025 raises the bar for the employer’s preventive duty in respect of sexual harassment, moving from a requirement to take “reasonable steps” to one requiring “all reasonable steps,” with effect from October 30, 2026. Because sexual harassment is expressly within the scope of the new COCON rule, firms will need to satisfy both a heightened statutory standard and a new regulatory obligation in relation to the same category of conduct. Effective compliance will require close alignment between the compliance and employment law functions.

What to Do Now

The FCA has made clear that it expects firms to have been preparing for these changes well in advance of September 1, 2026. There is no transitional period and no grace period: the rule is in force now. Firms that have not yet acted are already exposed. The following steps should be treated as immediate priorities.

• Embed the new conduct rule in your policies and training. Updating a written policy is necessary but not sufficient. The new rule must be actively communicated – through team briefings, onboarding sessions and practical guidance that resonates with staff across all functions and levels of seniority. Ongoing monitoring of whether training is genuinely effective, rather than merely delivered, is equally important.
• Upgrade your investigation protocols. Many non-bank financial firms lack the internal infrastructure to investigate workplace conduct complaints to a regulatory standard. An approach that relies on informal discussions and quiet exits will not withstand FCA scrutiny. Firms should put in place formal investigation procedures that are prompt, thorough and independently overseen, and that produce documented findings with clear reasoning.
• Map your senior manager exposure. Ensure all individuals holding senior management and certification functions understand their personal regulatory obligations under the new regime. Senior managers who fail to take reasonable steps to address non-financial misconduct risk personal enforcement action, including a determination that they are not fit and proper.
• Address record-keeping gaps. The regulator will expect firms to maintain a clear contemporaneous record of each stage of the process – from initial receipt of an allegation through assessment, investigation and outcome. Firms that cannot produce an audit trail demonstrating how and why decisions were taken will be among the most exposed.
• Prepare for regulatory reference obligations. Review your approach to regulatory references to ensure that disciplinary findings for conduct rule breaches, and other relevant fitness and propriety information, are disclosed consistently. Most firms will err on the side of disclosure – the regulatory cost of under-disclosure outweighs the employment law risk of over-disclosure.
• Stress-test for inconsistency. Ask whether the firm would apply the same standards to a top-performing portfolio manager as to a junior analyst. The FCA will. Differential treatment by seniority or commercial value is the single most visible red flag for enforcement.

Enforcement: What to Expect

The FCA has left little room for doubt that it regards non-financial misconduct as a priority enforcement area. Firms may see some initial latitude on purely procedural aspects of the new reporting obligations, but no such tolerance should be expected where substantive misconduct is involved – particularly cases involving sexual harassment, sustained patterns of bullying or acts of violence.

Enforcement attention is most likely to fall first on firms whose systems and controls remain inadequate despite the extended lead time the FCA provided. Individual senior managers face direct personal exposure: the FCA’s guidance makes clear that it will examine whether a manager was aware – or ought to have been aware – of the misconduct and whether they were in a position to take action. The regulator has indicated that it will treat a failure to act through lack of adequate systems in the same way as a conscious decision not to intervene.

There are three principal areas the FCA may consider when deciding whether to bring enforcement action. First, whether the individual is fit and proper. Second, whether there has been a breach of the conduct rules. Third, whether misconduct was permitted to occur because of systems and controls failings at firm level. Firms should expect enforcement to proceed across all three tracks simultaneously.

The new regime is not an incremental extension of the FCA’s existing powers – it is a step change in regulatory expectations around workplace conduct, and the absence of a transitional period means that the cost of inaction is already accruing. The legal and strategic judgements that arise – particularly in the context of an active FCA investigation or supervisory inquiry – demand expert advice at the earliest opportunity. To discuss how the new non-financial misconduct regime affects your firm, or to review your compliance framework in light of these changes, please contact our London Enforcement and Investigations team.