From 1 September 2026, new FCA rules and guidance on non-financial misconduct take effect.
The changes clarify when serious workplace misconduct such as bullying, harassment and violence can breach the FCA Conduct Rules, and how firms should consider misconduct when assessing whether employees remain fit and proper.
For affected financial services firms, the immediate task is practical: review policies, reporting processes, fit and proper assessments and regulatory references.
TL;DR
- The FCA non-financial misconduct rules take effect on 1 September 2026.
- A new Conduct Rule provision extends COCON for non-bank SMCR firms to certain serious work-related misconduct involving colleagues.
- The FCA has also published guidance on how non-financial misconduct should factor into FIT, Conduct Rule decisions and management responsibilities.
- Firms should review staff policies, Conduct Rule breach reporting, fit and proper assessments and regulatory references.
- Firms do not need to monitor employees’ private lives or social media.
- The rules concern employee conduct. They are separate from customer conversation monitoring and Consumer Duty compliance.
- For compliance and risk teams, the broader requirement remains familiar: identify material risks, apply consistent judgement, escalate where necessary and retain evidence of decisions.
For the FCA’s full guidance, see Non-financial misconduct in financial services.
What are the FCA non-financial misconduct rules?
Non-financial misconduct describes behaviour that is not clearly financial in nature. The FCA highlights bullying, harassment and violence as key examples.
From 1 September, a new provision in COCON extends the scope of the Conduct Rules for non-bank SMCR firms where certain unwanted or violent conduct towards colleagues has a sufficient connection to the person’s work.
The FCA Handbook describes covered unwanted conduct as behaviour that has the purpose or effect of:
- violating another person’s dignity
- creating an intimidating, hostile, degrading, humiliating or offensive environment
- being violent towards another person
The FCA makes clear that the Conduct Rules apply only where the relevant requirements are met. The circumstances and seriousness of an incident still matter.
See the FCA Handbook COCON rules effective from 1 September 2026.
What changes on 1 September 2026?
The changes affect several parts of firms’ conduct governance.
| Area | What changes |
|---|---|
| Conduct Rules (COCON) | The scope for non-bank SMCR firms extends to certain serious bullying, harassment and violence against colleagues where there is a sufficient work-related connection. |
| Fit and Proper (FIT) | FCA guidance clarifies how relevant non-financial misconduct can factor into assessments of fitness and propriety. |
| Senior management | Guidance helps firms assess the reasonable steps expected from managers, taking account of their knowledge and authority. |
| Regulatory references | Firms need to consider whether their processes properly capture relevant conduct information. |
| Internal policies | Firms should check whether policies and procedures reflect the new regulatory position. |
The FCA describes the changes in PS25/23: Tackling non-financial misconduct in financial services.
Who do the FCA non-financial misconduct rules apply to?
There are two important points to separate.
The new COCON rule specifically extends the position for SMCR firms other than SMCR banking firms. Banks already operate under a broader application of COCON.
The FCA’s accompanying guidance has wider relevance. The FCA states that its policy statement applies to FSMA firms with a Part 4A permission and staff within those firms who are subject to COCON or FIT.
This means the changes matter across a broad section of regulated financial services, including firms within wealth management and financial advice.
They do not mean that every instance of poor workplace behaviour automatically becomes an FCA Conduct Rule breach.
What counts as non-financial misconduct under the FCA rules?
The FCA focuses on serious conduct.
Its guidance covers behaviour including bullying, harassment, offensive or insulting conduct, conduct that causes distress and violence towards colleagues.
When deciding whether behaviour falls within COCON, firms need to consider the facts of the individual case.
The FCA identifies factors including:
- the seriousness of the conduct
- its effect on the other person
- its purpose
- the surrounding circumstances
- whether the conduct demonstrates a lack of integrity
- whether it shows a failure to act with due skill, care and diligence
A firm’s own disciplinary decision and the FCA Conduct Rules also serve different purposes. An employment issue does not automatically amount to a regulatory breach.
The FCA provides further detail in COCON 4.3: Specific guidance on harassment.
What should financial services firms do?
The FCA has given firms a straightforward preparation list.
Before the rules take effect, firms should review whether they need to update their approach to:
- Staff policies
Policies should reflect the circumstances in which serious work-related misconduct may have regulatory consequences.
- Conduct Rule breach reporting
Firms need a process for deciding whether substantiated misconduct falls within COCON and whether regulatory reporting follows.
- Fit and proper assessments
Relevant misconduct may need to form part of the firm’s assessment of an individual’s honesty, integrity and reputation.
- Regulatory references
Processes should allow firms to identify and include relevant information where regulatory reference requirements apply.
- Staff and manager understanding
Managers and employees covered by the rules need to understand what has changed and how the firm will apply the rules.
What do firms not need to do?
The FCA has also tried to define the limits of the new requirements.
It says firms do not need to:
- retrospectively reassess previous Conduct Rule decisions
- revise previous fit and proper assessments solely because of the new guidance
- monitor employees’ private lives
- monitor employees’ social media accounts
- investigate trivial, implausible or irrelevant allegations about employees’ private lives
- take action that conflicts with privacy, employment or other relevant law
This distinction matters.
The FCA’s approach does not create a general requirement for firms to place employees under continuous monitoring. Firms still need proportionate investigation, judgement and appropriate evidence when a relevant issue arises.
How does non-financial misconduct affect fit and proper assessments?
COCON and FIT perform different functions.
The new COCON provision addresses certain work-related misconduct. FIT can consider a broader range of behaviour where that behaviour genuinely affects whether an individual remains fit and proper to perform their role.
The FCA states that relevant misconduct can already form part of a FIT assessment, including conduct outside work in appropriate circumstances.
That does not mean every allegation or private-life incident should affect an assessment.
Firms need to consider relevance, reliability, seriousness and the connection between the behaviour and the individual’s fitness and propriety.
This makes documented judgement particularly important.
A firm should be able to show what information it considered, why it considered it relevant and how it reached its conclusion.
What do the rules mean for compliance and risk teams?
The operational challenge extends beyond updating an employee handbook.
Compliance, HR and senior management may need clear agreement on:
| Question | Why it matters |
|---|---|
| Who determines whether an incident may fall within COCON? | Employment and regulatory assessments need clear ownership. |
| How does HR escalate potentially relevant cases? | Relevant misconduct needs to reach the appropriate regulatory decision-maker. |
| What evidence supports the decision? | Firms may need to justify why behaviour did or did not constitute a breach. |
| How does the finding affect FIT? | COCON and FIT require separate assessments. |
| Does the issue affect a regulatory reference? | Relevant findings may need to follow the individual to another regulated firm. |
| What MI reaches senior management? | Firms need enough information to identify patterns and oversee conduct risk. |
The FCA says the primary responsibility for preventing and dealing with non-financial misconduct remains with firms.
That makes consistency particularly important. Similar cases should not produce materially different regulatory decisions simply because they reached different managers or teams.
Do the FCA non-financial misconduct rules require AI monitoring?
No.
The new rules do not require firms to use AI to detect workplace misconduct.
They also do not require firms to monitor every internal employee communication.
In fact, the FCA explicitly states that firms do not need to monitor employees’ private lives or social media.
The immediate requirements centre on governance, policies, judgement, escalation and evidence.
Where does AI compliance monitoring fit?
Non-financial misconduct and customer conduct monitoring should not be treated as the same use case.
Aveni Detect supports compliance and QA teams by assessing customer interactions for risks such as conduct issues, complaints, vulnerability and Consumer Duty outcomes.
It does not mean firms can use Detect as a substitute for the HR, investigation, FIT or Conduct Rule processes required under the FCA’s non-financial misconduct framework.
The connection sits at a broader level.
Both areas require firms to turn large amounts of information into identifiable risk signals, apply consistent frameworks, escalate relevant cases and retain evidence of the decisions made.
For customer-facing compliance, automated monitoring can help firms assess a much larger interaction population and direct human reviewers towards the conversations that warrant attention.
Read more about compliance monitoring in financial services or see how Aveni Detect supports automated QA and compliance monitoring.
Non-financial misconduct vs customer conduct monitoring
The distinction is important for firms considering where technology fits.
| FCA non-financial misconduct | Customer conduct monitoring | |
|---|---|---|
| Primary focus | Conduct between employees and other members of the workforce | Conduct within customer interactions |
| Examples | Serious bullying, harassment and violence | Poor explanations, inappropriate pressure, complaints, vulnerability and unsuitable conduct |
| Relevant frameworks | COCON, FIT, SMCR | Consumer Duty, conduct risk, complaints, vulnerability and firm QA frameworks |
| Typical owners | HR, Compliance, Legal, Senior Management | Compliance, Risk, QA, Customer Operations |
| AI monitoring required? | No | No, although AI can increase monitoring coverage |
| Aveni Detect use case | Not currently positioned as an NFM solution | Yes |
For more on the latter, see Aveni’s guide to Consumer Duty conduct risk monitoring.
What should firms prioritise from 1 September?
For affected firms, five questions provide a useful starting point:
- Do our policies reflect the new COCON rules and FCA guidance?
- Do HR and Compliance know when and how to escalate relevant misconduct?
- Can we distinguish an employment finding from a COCON or FIT decision?
- Do we retain enough evidence to explain those decisions later?
- Do managers and Conduct Rules staff understand what the changes mean for them?
The FCA non-financial misconduct rules give firms more clarity, but they still require judgement.
The priority is therefore a process that helps the right people identify relevant cases, assess them consistently and retain a clear record of what happened next.
Frequently asked questions
When do the FCA non-financial misconduct rules come into force?
The new FCA rule and supporting guidance take effect on 1 September 2026.
What is non-financial misconduct according to the FCA?
The FCA uses non-financial misconduct to describe behaviour that is not clearly financial in nature. Its guidance particularly addresses serious bullying, harassment, violence and related workplace conduct.
Do the FCA non-financial misconduct rules apply to financial advisers?
They can. The changes are relevant to FCA-regulated firms and staff subject to COCON or FIT. Firms should check their regulatory status and which employees fall within the relevant rules.
Does bullying count as an FCA Conduct Rule breach?
Potentially. Serious work-related bullying or harassment can fall within COCON where the relevant conditions are met. Firms must assess the individual circumstances rather than assume every workplace complaint constitutes a breach.
Does misconduct outside work affect fit and proper assessments?
It can where the conduct is genuinely relevant to the individual’s fitness and propriety. The FCA makes clear that firms do not need to investigate trivial, implausible or irrelevant private-life allegations.
Do firms need to monitor employees’ social media?
No. The FCA specifically says firms do not need to monitor employees’ private lives or social media accounts.
Do firms have to reassess old misconduct cases?
No. The FCA says firms do not need to carry out retrospective analysis of previous Conduct Rule decisions or revise past fit and proper assessments because of the new rules.
Can AI help firms comply with the FCA non-financial misconduct rules?
The FCA does not require AI monitoring. The immediate requirements concern policies, escalation, regulatory assessments and evidence. AI may support other areas of conduct and compliance monitoring, but firms should distinguish customer-facing monitoring from employee non-financial misconduct processes.
Does Aveni Detect monitor non-financial misconduct?
Aveni Detect currently focuses on QA and compliance monitoring across customer interactions, including conduct risk, complaints, vulnerability and Consumer Duty outcomes. Firms should not treat it as a replacement for HR investigations, COCON assessments or FIT processes relating to employee non-financial misconduct.
The bottom line
The FCA non-financial misconduct rules strengthen the regulatory consequences that serious workplace behaviour can carry within financial services.
For firms, the practical requirements are clear: understand which conduct falls within scope, update relevant processes, connect HR and regulatory decision-making, train staff and maintain evidence that supports each decision.
For compliance teams, the challenge is less about monitoring more employee conversations and more about making sure serious conduct reaches the right process and receives a consistent, defensible assessment.
