The FCA's new non-financial misconduct framework is now in force in the UK: The implications

The FCA’s new non-financial misconduct framework came into force on 1 September 2026. The central change is a new rule in the FCA's Code of Conduct sourcebook (COCON), COCON 1.1.7FR. It brings serious bullying, harassment and violence between colleagues within the Conduct Rules for FCA-authorized firms other than banks, where COCON's scope was previously materially narrower. Conduct before 1 September 2026 is not caught by the new rule.

The new rule

COCON 1.1.7FR applies where a member of staff who is subject to the conduct rules engages in unwanted conduct towards a fellow member of the workforce that has the purpose or effect of violating that person's dignity, creates an intimidating, hostile, degrading, humiliating or offensive environment for them, or involves violence towards them. The wording mirrors the Equality Act 2010 definition of harassment, but the conduct does not need to be linked to a protected characteristic. The rule is framed around harassment, including sexual harassment, and violence, although other discriminatory conduct may still be relevant to fitness and propriety.

It closes the bank/non-bank gap

Non-bank conduct rules used to apply mainly to conduct connected to the firm's financial services activities, making it harder to bring bullying, harassment or violence within scope. The rule change brings non-banks in line with banks, so misconduct towards colleagues now falls within scope where it relates to the individual's role. Whether that requirement is met depends on several factors, including where the conduct took place, who was involved and whether it was connected to the firm's business; no single factor is conclusive.

It only bites on serious conduct

Only sufficiently serious conduct amounts to a Conduct Rules breach. Firms (and the FCA) should weigh whether the conduct is repeated or part of a pattern, its duration, the extent of its impact, the seniority of and gap between those involved, prior warnings, and whether it is criminal conduct or would justify dismissal. A single incident can be enough, as can a number of more minor instances that show a pattern of behaviour.

For example, consider a team leader who repeatedly belittles a junior colleague's work in front of the team, continuing even after being asked to stop. The repetition, pattern and seniority gap all point towards seriousness, even where no protected characteristic is engaged.

COCON isn't limited to the office, but it stops at private life

Conduct relating to a member of staff's private or personal life is outside COCON's scope, but "private life" is not the same as "outside the office". Relevant factors include whether the conduct happened on the firm's premises or while working on its business, involved a colleague or client, used firm equipment, or arose in a business context, including a firm-organized event wherever held. The Handbook's worked examples treat misconduct at a firm-organised social occasion, such as a Christmas party, as generally within scope. The test is whether the event is a work or work-related occasion including client-organised events.

Fitness and propriety has a broader reach

The Fit and Proper test for Employees and Senior Personnel (FIT) is not confined in the way COCON is. Private life conduct can be relevant to FIT even where it is not a COCON breach if it shows a material risk that the individual will breach regulatory standards or would do so if repeated at work. Even without repetition risk, sufficiently serious private life conduct can be relevant if it risks undermining public confidence in the regulatory system. Firms are not expected to monitor employees' private lives or social media, and lawfully expressing controversial views does not in itself call fitness and propriety into question.

Firms that have not already done so should review the following:

• Codes of conduct, anti-bullying, harassment and social media policies, to reflect that serious misconduct can trigger a Conduct Rules assessment alongside any disciplinary process.
• Manager guidance and training, to ensure managers understand the reasonable steps expected of them when preventing and responding to harassment, and the limits of their accountability where they acted reasonably given their actual knowledge and authority.
• Conduct breach reporting processes, to ensure escalation captures non-financial misconduct as reliably as financial misconduct.
• Fit and proper processes, including onboarding, certification and self-disclosure, to ensure they can identify conduct that would not register under COCON's narrower scope.
• Regulatory reference processes, to ensure past non-financial misconduct is disclosed when someone moves firms.
• Staff communications, so that all employees understand the standards expected of them and how concerns can be raised.

Traps worth avoiding

Overreaching investigations

Firms do not need to proactively monitor social media and are not expected to investigate allegations about private life that are trivial, irrelevant to fitness and propriety, or implausible.

Conflating HR findings with Conduct Rules breaches 

A disciplinary or HR finding does not automatically mean the Conduct Rules have been breached. Conduct must also have the purpose or effect described in the rule and be sufficiently serious before it is a breach, so each case needs its own assessment.

Overlooking the limits of manager accountability

A manager will not be accountable for failing to prevent misconduct they could not reasonably have known about or had no authority to address.

Assuming private life conduct is irrelevant if COCON doesn't reach it 

FIT is broader than COCON and can still catch conduct COCON excludes.

Misjudging mixed-business scope

For firms with both financial and non-financial businesses, conduct will generally be in scope if either the person responsible or the person affected is connected to the financial services business, even where the other is not.

No retrospective review

Firms do not need to revisit past Conduct Rules determinations or fitness and propriety assessments.

Bottom line

The FCA has deliberately left firms to exercise reasonable judgement on what amounts to “serious” misconduct, rather than setting a prescriptive checklist. The practical challenge for firms is therefore to make those assessments consistently. If you haven't already done so, we strongly recommend that your immediate priorities are to review and update conduct policies, brief managers appropriately, and ensure that HR and compliance are aligned.

If the Withers team can help, either pre-emptively or should a misconduct issue arise, please don't hesitate to get in touch.