Finally: the FCA policy statement on non-financial misconduct

   Introduction

1. On 12 December 2025, the Financial Conduct Authority (FCA) published its Policy statement PS25/23: Tackling non‑financial misconduct in financial services, which amends its Code of Conduct (COCON) sourcebook and provides guidance to those changes; and explains how non-financial misconduct (NFM) forms part of the Fit and Proper test for Employees and Senior Personnel (FIT) sourcebooks. The policy statement contains final guidance on NFM in the financial services sector, and aims to help firms who asked for additional support to tackle bullying, harassment and violence.

    

2. The guidance will come into force on 1 September 2026, at the same time as the new COCON 1.1.7FR. The guidance explains how firms can apply FCA rules on minimum standards of behaviour for financial services employees, and the factors they should take into account when assessing whether someone is fit and proper for their role.

3. After setting out the background to the policy statement, this article sets out the main changes to the COCON with some observations about the FIT changes and how the new regime may interact with employment law.

    NFM: how did we get here? 

4. In September 2023, the FCA published a consultation paper (CP23/20 (PDF)) which set out proposals for a new regulatory framework on diversity and inclusion in the financial sector, which included proposals on NFM. The FCA announced its belief that greater levels of diversity and inclusion could improve outcomes for markets and consumers. The proposed framework sought to establish minimum standards and give firms a better understanding of what is expected of them from a regulatory standpoint. It sought to help ensure greater consistency and transparency across the sector on firms’ approaches to diversity and inclusion.

    

5. However, on 12 March 2025, the FCA announced that, in light of the broad range of feedback received; expected legislative developments; and to avoid additional burdens on firms, the FCA (and PRA) had no plans to take this work further, except for its NFM proposals. The FCA stressed that it was important that its approach was proportionate and aligned with planned legislation, so the FCA (and PRA) were “taking some further time to get this right and will set out next steps by the end of June this year”.

6. In July 2025, the FCA moved to the next stage in its bid to tackle NFM with the publication of consultation paper CP25/18 (PDF). It announced that with effect from 1 September 2026, the FCA will extend the scope of its conduct rules (COCON) to make clear that serious misconduct such as bullying, harassment and violence is a matter of regulatory concern at all firms subject to the SMCR and not just banks. The FCA sought feedback on proposed additional guidance to help all SMCR firms to interpret and consistently apply the conduct rules and clarify requirements for fitness and propriety.

    What is the FCA policy statement on NFM (PS25/23)?

7. PS25/23 finalised the guidance to support firms applying FCA rules and brought its policy work on NFM to a close.  The FCA announced (perhaps warned) that it “will now focus on how firms are tackling [NFM] in practice”.

    

8. One of the aims of the policy statement is to help firms who asked for additional support during the consultation periods to tackle bullying, harassment and violence.  

    

9. With bullying and harassment in the workplace already attracting a high level of public and regulatory scrutiny, and with significant changes to legislation recently enacted under the Employment Rights Act 2025, the changes form part of wide-scale reforms to tackle NFM. 

    

10. In its December 2025 announcement, the FCA said (under “Who is this for?”):

This publication applies to all Financial Services and Markets Act 2000 (FSMA) firms with a         Part 4A permission, and staff in those firms who are subject to COCON or FIT.

It may also be of interest to other stakeholders, including:

• Regulated firms without a Part 4A permission.  
• Industry groups and trade bodies.  
• Consumer groups and individual consumers.  
• Industry experts and commentators. 

11. Therefore the FCA recognises that whilst all firms subject to the SMCR will now be subject to the changes, there are much wider groups indirectly impacted by NFM. This is consistent with the FCA’s position that greater levels of diversity and inclusion could improve outcomes for markets and consumers; and also consistent with how the changes are drafted to cover as many individuals and firms as possible who may be affected by NFM. Whilst NFM can already amount to a breach of FCA rules for non-banks (under COCON 1.1.7AR and BR), a greater number of incidents will now be covered and the connection between the NFM and the firm’s regulated activities will be looser to cover much wider activities (under COCON 1.1.7FR). This is a significant advance from a compliance perspective and will require significant action by firms, for example, reviews and amendments to policies and procedures; training; and even culture. 

     

12. The FCA states that the guidance is designed to help firms make fair, consistent decisions and take decisive action when standards are breached. The changes are intended to help promote healthy and inclusive workplace cultures and deepen trust in financial services, in line with its Strategy 2025 to 2030. 

     

    How are the changes made? 

     

13. The changes are achieved by the FCA exercising its powers to provide guidance under section 139A of the Financial Services and Markets Act 2000 by laying down the Non-Financial Misconduct (No 2) Instrument 2025 (FCA 2025/60) with the core change being the new rule at COCON 1.1.7FR.

     

14. The COCON sourcebook has been changed to explain how NFM can be a breach of the conduct rules. In general terms, the new rule will bring into the scope of COCON, serious cases of “unwanted conduct” against a colleague at SMCR firms (there are around 37,000 SMCR firms), with such behaviour to become grounds for a finding of misconduct under the regulatory regime. Some of the specific changes are set out below.

     

    Amendments to COCON: Application and purpose

15. The new rule captures NFM against a wide range of individuals including employees of the firm or a member of its group; individuals providing services to a firm or a member of its group; an individual who provides services to the firm (or a member of its group); an employee of a person who provides services to the firm (or a member of its group); an individual who performs a function of a person who provides services to the firm (or a member of its group); and an individual performing an activity that forms part of an activity of the firm (COCON 1.1.7FR(3)). This vast range goes beyond the scope of employment law protection and focusses on all those that may be affected by NFM in order to meet the FCA’s objectives to improve the UK financial sector’s reputation, strengthening its access to global talent and increasing market and consumer confidence. 

     

16. Although, for some reason, the text of COCON 1.1.7FR is not set out in the aforementioned Instrument or PS25/23, it is believed to be unchanged from the July consultation. COCON 1.1.7FR(4) states:

The kind of conduct to which this rule applies as referred to in (3) is unwanted conduct of the following kinds in relation to an individual referred to in (3) (‘B’): 

(a) conduct that has the purpose or effect of: 

(i) violating B’s dignity; or 

(ii) creating an intimidating, hostile, degrading, humiliating or offensive environment for B; or 

(b) conduct that is violent to B. 

17. Employment lawyers will recognise the above definition of harassment with that under section 26 of the Equality Act 2010 (“EqA”). However, there is no need for the conduct to be related to a protected characteristic such as disability, age, race or sex. 

     

18. NFM is defined as “the types of serious misconduct described in the new rule at COCON 1.1.7FR. Broadly, these are bullying, harassment and violence, unless otherwise stated” [see 2.3 of PS25/23]. Section 4.3 is a new section, which provides specific guidance on harassment (see below).

     

19. A comprehensive new section (COCON 1.3) is introduced to cover the scope of COCON. Although it is stated (at COCON 1.3G) that COCON does not apply to private or personal life (COCON 1.3.1G), there are non-exhaustive factors provided to help define when such conduct can be strictly considered to be outside of COCON (private or personal) or would fall within in (a table at COCON 1.3.7G sets out examples). Whether private or not, COCON 1.3.9G states that such conduct illustrated in the table would nevertheless require a senior conduct rules staff member to disclose such matters material to an assessment of fitness and propriety under FIT. COCON 1.3.17G goes further and states that misconduct in private or personal life may be relevant to fitness and propriety, even if there is little or no risk of it being repeated in their work, if it demonstrates a willingness to disregard ethical or legal obligations; abuse a position of trust; exploit the vulnerabilities of others and/or it was sufficiently serious (which would normally include custodial sentences) that if the person was permitted to work at a firm, it would undermine public confidence or impact the FCA’s statutory objectives. There is substantial guidance in relation to the use of social media although the FCA makes clear that firms are not expected to monitor their employees’ private lives.

20. A new Annex 2 is inserted in COCON 1, which includes very helpful flow diagrams including, for example, who falls within COCON 2.2 (senior manager conduct rules) and what conduct applies.

     

    Amendments to the Code of Conduct COCON: Specific guidance on conduct rules

         Individual conduct

21. Two examples of individual conduct that would be a breach of Rule 1 (acting with integrity) are added to COCON 4.1.1G and include subjecting a fellow member of the workforce to “significant detriment” for using the firm’s whistleblowing procedures and harassment of a fellow member of the workforce (see COCON 4.3, specific guidance on harassment, discussed below).   

22. As to Rule 2 (due skill, care and diligence), COCON 4.1.8G now includes comprehensive new provisions relating to the positive duties of a manager (not limited to line managers), and includes a duty to prevent harassment and a non-exhaustive list of examples of breaches. The list includes a failure to take reasonable steps to protect staff from NFM and failing to take such complaints seriously. Managers will be able to argue that they have not breached Rule 2 on the basis that they acted reasonably (some of the relevant factors regarding reasonableness are set out in COCON 4.1.8C).  

23. Therefore both perpetrators and managers who allow NFM to occur may be in breach of Rule 1 and Rule 2 respectively.

24. Whilst the inclusion of whistleblowing detriment is welcome, the reference to “significant” detriment appears to be vague; arguably all whistleblowing detriment is significant. Further, it is notable that victimisation and other forms of discrimination (not least direct discrimination) are not included, which is consistent with COCON 1.1.7FR(4) which makes no reference to protected characteristics. Arguably, by removing references to protected characteristics, the FCA is promoting greater ambition towards equality and inclusion, by effectively trying to eradicate all forms of bullying without hierarchy. However, the reason for their exclusion is not so profound: the FCA merely responded to the feedback from firms that it would be too difficult to implement [2.30 of PS25/23]. 

     

   Specific guidance on harassment 

25. A new COCON 4.3 provides comprehensive, specific guidance on NFM. 

     

26. The general non-exhaustive factors for assessing compliance (COCON 3.1) are unchanged and remain the start point for determining whether a breach has occurred. Subject to that, NFM would be a breach of Rule 1 or Rule 2 if it is the type described in COCON 1.1.7FR(4) and it involves a lack of integrity or a failure to act with due skill, care and diligence (COCON 4.3.3G).

     

27. Under COCON 4.3.6, there are four factors to consider in deciding if the conduct falls within 1.1.7FR(4): whether the conduct was “serious”; its effect, its purpose; and various factors set out in COCON 4.3.16G to 4.3.18G.  The FCA stresses that the new rule is only intended to cover conduct that is serious (at COCON 4.3.7G) and therefore this is the fundamental factor to consider. Helpfully, COCON 4.3.8 sets out the factors to take into account when deciding whether misconduct in relation to a fellow member of the workforce is serious enough to amount to a breach of COCON:

• whether the conduct is repeated or part of a pattern;
• the duration of the conduct;
• the size of the impact on the subject of the conduct (the rule applies to effects which are serious and marked, and not to those which are, though real, of lesser consequence);
• the seniority of the person whose conduct is in question;
• the difference in seniority between the person whose conduct is in question and the subject of the conduct and whether the person whose conduct is in question has control or influence over the other’s career;
• mitigating and aggravating factors even if they take place subsequently (the factors in FIT 1.3.10G(3) to (7) (Breaches of requirements of the regulatory system) are relevant here also);
• whether the person whose conduct is in question has been warned or disciplined for similar conduct by the firm, a previous employer, the police or a regulator;
• whether the person whose conduct is in question has previously undertaken not to do the act or engage in the behaviour in question; and
• whether the conduct is criminal (particularly if it is of the kind described in FIT 1.3.22G (Offences)) or would justify dismissal.

28. Although the factors are useful, there are no illustrations of seriousness provided in PS25/23 and arguably there is wide scope to justify a finding either way. It may be the case that the reference to justifying dismissal will be the most useful for firms, who will need to consider employment law, and particularly whether the conduct amounts to gross misconduct. This reflects the FCA’s response to feedback (including the ELA September 2025 response to the consultation) that the changes include a “clearer alignment with employment law” [1.19 of PS 25/23].

     

29. Conduct related to protected characteristics is not explicitly included in the seriousness factors, although it is likely to be serious [2.30 of PS 25/23].

30. “Effect of the conduct” is explained at COCON 4.3.12G to 4.3.14G, which substantially adopts the requirements under section 26(4) EqA requiring a consideration of the perception of the subject of the misconduct; all of the circumstances of the case; and whether it was reasonable for the conduct to have that effect. There is guidance on “purpose”: essentially stating that there may be a breach of COCON if there is the prescribed intent even when it does not have that effect. The further factors to be considered are set out in COCON 4.3.16G to 4.3.18G, which brings in cases where the relevant effect occurs to a witness to the conduct. 

     

31. A helpful Annex is introduced, which includes numerous flow diagrams, including “Remaining questions” which illustrates the approach to be taken to determine if the NFM amounts to a breach of COCON.

     

    Observations

32. All firms affected by these changes should familiarise themselves with NFM changes. The guidance will come into force on 1 September 2026 at the same time as the new rule at COCON 1.1.7FR. 

     

33. The guidance does suggest that the FCA has listened carefully to feedback provided in the consultation, for example, alignment with banks and with employment law. There has been a significant effort to explain COCON 1.1.7FR and the use of flow diagrams is also useful as are the examples of conduct which fall outside private or personal life (COCON 1.3.7G) both in relation to COCON and FIT. It is regretful that specific examples of breaches were not provided, which may mean that firms (and regulatory lawyers) may need to turn to employment lawyers (or at least employment law) to better understand the principles of unwanted conduct (under COCON 1.1.7FR) and summary dismissal (as part of the seriousness factors under COCON 4.3.6G). 

34. It appears possible that the crucial factor of seriousness may curtail the incidents of unwanted conduct that would amount to a breach of COCON, which would otherwise amount to harassment under section 26 EqA. The application and scope of the rules are much wider than employment law, which is a significant step towards positive cultural change. The “reasonable steps” obligations introduced for managers (COCON 4.1.8) do not go as far as an obligation to take all reasonable steps, which would have been in line with the amendment to section 40A EqA recently made through section 20 of Employment Rights Act 2025. Taking into account the potential career-ending consequences of breaches of COCON, the FCA approach is arguably proportionate. 

35. On balance, the changes are a significant movement towards changing behaviour at FCA-regulated workplaces. When read with the changes to employment law enacted under sections 20 to 24 of the Employment Rights Act 2025, there is a positive policy drive to change culture and to prevent harassment.

     

    Mukhtiar Singh is a member of Doughty Street Chambers' Employment Team and Professional Discipline and Regulation Team. He specialises in whistleblowing and discrimination cases, particularly in regulated sectors.

     

    Mukhtiar Singh | Doughty Street Chambers

    4 January 2026