The change reflects a broader regulatory message. The FCA increasingly regards workplace culture as a proxy for governance, integrity and risk management. Firms therefore need to ask not only whether misconduct has occurred, but whether it was identified, escalated, investigated, documented and reflected in certification, regulatory references and notifications where appropriate.

Note - in this context, “non-bank firm” refers to an FCA-regulated firm outside the banking sector. Under the FCA Handbook usage a “firm” covers different entities including LLPs, partnerships and sole traders as well as companies.

The new non-financial misconduct rule

The new rule, COCON 1.1.7FR, extends the Conduct Rules framework for non-financial misconduct to non-bank firms carrying out regulated financial services activities in the UK. Serious bullying, harassment or violence towards colleagues may now breach regulatory rules, even where the behaviour is not part of the individual’s financial activities.

The new rule also goes beyond discrimination law: the conduct need not relate to a protected characteristic such as gender or race. At the same time, not every difficult conversation or workplace disagreement will attract regulatory concern. The test is the approach of a “reasonable person” with the relevant skills. Context, seriousness and the connection to the individual’s role will remain central to the analysis. There will be clear overlap with HR and employment law processes; one of the factors in assessing whether there has been a breach, under COCON 4.3, is whether the employee’s action would justify termination of employment. However the FCA make the point that there are key differences between the regulatory and employment law framework that need to be balanced.

The changes also have implications for fitness and propriety assessments. While the FCA does not expect firms to monitor employees’ private lives (or social media), or to investigate trivial allegations, serious conduct outside work may still be relevant where it calls an individual’s integrity or fitness into question.

One point of reassurance is that the Conduct Rules change is not retroactive. Conduct before 1 September 2026 should be assessed under the previous framework. However, historical conduct may still be relevant to current fitness and propriety assessments, particularly where serious concerns were unresolved or inadequately addressed.

Reporting to the FCA

There is no single reporting route. Employees may raise concerns internally, use whistleblowing channels or contact the FCA directly. Firms must notify the FCA when they take disciplinary action for a Conduct Rules breach, and serious matters may also require notification under SUP 15.3.

Where the FCA is likely to focus

The changes are likely to have the greatest impact on asset managers, private equity and hedge fund managers, brokers, insurers and wealth managers, particularly where teams are small and a few individuals carry significant influence or revenue-generating power. Particular areas of concern for the FCA are likely to include:

• Senior involvement: Senior Managers, founders or influential revenue generators.
• Patterns of conduct: Repeated behaviour, multiple complainants or evidence of a wider pattern.
• Serious misconduct: Violence, serious bullying, harassment or abuse of authority.
• Retaliation: Suppression of complaints or interference with an investigation. The guidance specifically calls out subjecting an individual to a ‘significant detriment’ for using a firm’s whistleblowing procedures.
• Process failures: Inadequate or inconsistent investigations and disciplinary outcomes.
• Certification gaps: Failures to reassess fitness and propriety.
• Disclosure issues: Inaccurate regulatory references, incomplete notifications, or evidence that management knew of concerns but failed to take reasonable steps.

These features are likely to turn an employment matter into a regulatory question. The key issue will often be less about the existence of a complaint itself and more about the firm’s response; i.e. whether it took the allegation seriously, protected complainants and witnesses, investigated proportionately, reassessed fitness and propriety where needed, and made accurate and timely notifications or references.

In practice, attention is likely to fall on Senior Managers responsible for culture, compliance and people risk; certified staff; founders; and high-performing individuals whose commercial importance may historically have discouraged escalation. But it is worth noting that the rules apply to all individuals within scope of the SMCR and fit and proper regimes – which could include contractors and consultants, not only employees.

The regulatory significance of workplace culture

The reforms reflect the FCA’s view that conduct risk and people risk are closely connected: a culture that tolerates intimidation, retaliation or the misuse of authority can inhibit challenge, conceal wrongdoing and undermine sound decision-making. Firms will therefore need to show that conduct and culture concerns are escalated consistently, including where they involve senior, influential or commercially important individuals. The new rule puts employers under a proactive obligation to protect employees from others’ breach of the rules, including proactively taking steps to prevent harassment. This is broader than the general employment law obligation to prevent harassment based on a protected characteristic under UK equalities laws.

Workplace investigations will need to serve two purposes: employment-law fairness and regulatory compliance. Firms should therefore build regulatory analysis into investigation protocols from the outset, including whether the conduct may amount to a Conduct Rules breach, affect fitness and propriety, or trigger mandatory notification obligations. Before taking employment decisions they will need to consider the regulatory impact – and vice versa.

External investigators may be appropriate for complex matters or allegations involving senior individuals. Firms should also document key decisions contemporaneously, including the scope of the investigation, the rationale for any escalation decision, the basis for any disciplinary outcome and the impact on certification or regulatory references.

Practical steps for firms

• Ensure sufficient governance and Senior Manager oversight: Senior Managers may face heightened scrutiny where serious workplace misconduct indicates weaknesses in culture, escalation or oversight. The “reasonable steps” defence requires active supervision and documented decisions, not passive reliance on policies. Boards should receive regular reporting on culture and conduct matters, rather than learning of problems only when the regulator asks questions.
• Revisit historical matters where appropriate: Although the rule is not retroactive, unresolved historical concerns may still matter. Firms should consider whether previous allegations involving certified staff or Senior Managers need to be revisited for current fitness and propriety purposes, particularly where concerns were raised but not properly addressed.
• Develop clear criteria for self-reporting and regulatory references: Not every complaint will require notification. The question is whether the conduct amounts to a Conduct Rules breach, affects fitness and propriety, or triggers SUP 15.3 obligations. Any failure to notify the FCA in a timely manner could also have regulatory consequences and lead to enforcement action. Firms should develop clear escalation criteria and consider early FCA engagement where serious misconduct is substantiated. They should also be cautious about assuming that misconduct can be fully contained through settlement terms: regulatory reference obligations may require disclosure of substantiated misconduct, regardless of confidentiality provisions agreed as part of an employment resolution – and noting the obligation to keep references updated for new information.
• Tailor compliance and training to maximise prevention: Training will be necessary but not sufficient. The FCA will expect evidence that policies are understood and applied in practice. Training should be tailored to actual business risk, and line managers should be equipped to recognise when a workplace issue may also be a regulatory issue.
• Dual-regulated firms: For firms which are regulated by the FCA and the PRA different tests now apply.

Checklist for updating compliance programmes

A non-exhaustive list of items to check and update includes:

• Refreshing HR and conduct policies to flag potential Conduct Rules, fitness and propriety, certification and regulatory-reference consequences.
• Training managers to recognise when workplace misconduct may raise regulatory issues, not only employment-law concerns.
• Building express regulatory analysis into investigation protocols and decision records.
• Documenting escalation, notification and certification decisions contemporaneously.
• Linking disciplinary outcomes to certification, regulatory-reference and annual fit and proper processes.
• Reviewing whistleblowing and speak-up channels for accessibility, independence and protection against retaliation.
• Developing clear criteria for regulatory escalation and early FCA engagement in serious cases.
• Reviewing current fitness assessments for certified staff and Senior Managers where unresolved historical concerns may be relevant.

The central message is clear: workplace culture is now part of the regulatory control environment. Firms that recognise this early and join up HR, legal, compliance and senior management processes accordingly will be best placed to prevent an employment complaint from becoming a regulatory investigation.