The FCA published a policy statement and consultation paper CP25/18 on 2 July 2025, confirming final rules to embed non-financial misconduct (NFM) in its Code of Conduct (COCON). For SM&CR firms (FSMA firms with a Part 4A permission), this will align rules with those already in place for banks, to extend the scope of the Conduct Rules to cover serious instances of bullying, harassment and similar behaviour in the workplace.
The FCA is also re-consulting on guidance on this rule, as well as guidance which would explicitly confirm that bullying, harassment and similar misconduct (both in the workplace and personal life) are relevant to ‘fit and proper’ requirements.
The paper follows CP23/20, which proposed NFM changes as well as wider diversity and inclusion (D&I) proposals in September 2023. The wider D&I proposals are no longer being taken forward, as confirmed by the FCA in March 2025.
The FCA also shared findings of a survey last year of how wholesale firms detect and handle incidents of NFM.
In this article
What does this mean?
Policy statement: COCON
Currently the scope of COCON is restricted (except in the case of banks) to regulated activities, other SM&CR financial activities and certain kinds of misconduct that could have serious effects. The FCA confirms it is changing the scope, to make clear that serious bullying, harassment and similar behaviour between staff is subject to the rules. In line with the FCA’s regulatory remit, NFM that clearly relates only to a part of the firm’s business that does not carry on any financial services activities, remains out of scope.
The change will apply from 1 September 2026, on a forward-looking basis only.
The FCA has revised the wording of the rule in response to feedback to CP23/20, aligning it more clearly with employment law.
NFM is defined as unwanted conduct that has the purpose or effect of: violating a member of staff’s dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment for them; or conduct that is violent to them.
The FCA is not taking forward proposals in CP23/20 to provide guidance on the relevance of NFM and discriminatory practices to the Threshold Conditions (COND). It is also not proceeding with additional guidance on how NFM should be incorporated into regulatory references in the Senior Management Arrangements, Systems and Controls (SYSC) sourcebooks. This is because the FCA believes the existing rules and guidance on regulatory references in SYSC 22 are sufficient.
Consultation proposals: Additional guidance in COCON and FIT
The regulator is re-consulting on new Handbook guidance in COCON and FIT, which aims to:
make it easier for SM&CR firms to interpret and consistently apply the change to COCON
clarify how NFM, both in the workplace and in private or personal life, can be relevant to fitness and propriety assessments.
The FCA says it will only proceed with the guidance if there is clear support for it.
It has updated the guidance consulted on in CP23/20 in response to feedback, including:
examples of scenarios illustrating the boundary between work and private or personal life
the factors for determining whether NFM is serious enough to amount to a breach
examples of reasonable steps for managers
clearer alignment of terminology with employment law.
Fit and proper test
The draft guidance explains in more detail how NFM can be relevant to the Fit and Proper test for Employees and Senior Personnel (FIT) section of the Handbook. CP23/20 proposed to explain how NFM in the workplace, and serious NFM in private life, is relevant to fitness and propriety.
Respondents to CP23/20 supported the FIT proposals but raised a number of concerns, including how the FCA would expect firms to deal with NFM in private life and on social media.
NFM in private life
The FCA reiterates that FIT already applies to all relevant matters, wherever they occur. The draft guidance makes clear that when assessing whether wrongdoing in private life has taken place, a firm will normally rely on formal findings (e.g. criminal convictions or the findings of a court, tribunal, regulator, arbitrator or public enquiry). The FCA also clarifies that it does not expect firms to monitor their employees’ private lives.
However, it states that a firm may become aware of information about an individual’s private life that would – if substantiated – call into question their fitness and propriety. In these circumstances, the firm should consider what steps it can reasonably take to assess this possible impact, such as asking for an explanation from the member of staff. If the allegation would reasonably be material to an assessment of fitness and propriety, firms should report it to the FCA, in line with current rules.
Some respondents asked for more guidance on when misconduct in private life unconnected to work should be considered ‘sufficiently serious’ to be relevant to fitness and propriety. The FCA’s proposed guidance states that conduct may be relevant if it shows a willingness to disregard ethical or legal obligations, abuse a position of trust, or exploit others’ vulnerabilities.
Social media
Numerous respondents asked the FCA to clarify its approach to NFM on social media.
The revised draft guidance states that a person can lawfully express their views on social media, even if those views are controversial or offensive and if colleagues are upset by those views, without calling into question their fitness under FIT. However, if a person’s social media activity indicates a real risk the person will breach the requirements and standards of the regulatory system, then such activity will be relevant to their fitness and propriety. Examples could include threats of violence or clear involvement in criminal activities.
What do firms need to do?
Assess policies and procedures in relation to identifying NFM.
Review training for conduct rule staff and HR teams.
Reflect on the FCA’s broader expectations on governance; risk management; preventing, investigating and reporting NFM; and inclusive cultures.
This paper comes in the context of the FCA’s ongoing focus on NFM and culture. The regulator has made clear that an inability to identify and tackle NFM is a warning sign of a failing culture, and wants to give firms greater clarity and confidence to take action. The FCA expects firms to have robust processes, procedures and controls to detect NFM, facilitate appropriate outcomes and report relevant matters.
Firms should review current processes, practices and expectations in light of the changes, alongside the FCA’s NFM survey findings issued in October 2024.
This includes reviewing misconduct reporting and ‘speak up’ processes to ensure they are sufficiently robust and operate in a culture where these are used in practice. Firms may also need to revisit how existing HR and legal processes (e.g. disciplinary processes) are connected to these, to ensure that relevant issues are identified.
A key challenge is to agree clear and consistent definitions and approaches, given the subjective and sensitive nature of NFM incidents. Firms will need to: agree a clear and consistent definition of NFM that can be applied within existing processes and policies; and consider approaches to determining where misconduct meets the threshold of “serious”. While the FCA is consulting on guidance which would provide greater clarity on these matters, any guidance will not be exhaustive and firms will need to exercise carefully considered judgment.
Other areas of focus include governance and oversight arrangements (including Board-level consideration of NFM risks, and structures for deciding outcomes and disciplinary actions for those involved in NFM cases), and training for conduct and HR staff. The FCA reminds firms of their duty under section 64B FSMA to notify conduct rules staff about the rules and take all reasonable steps to make sure they understand how they apply to them.
“Too often when we see problems in the market, there are cultural failings in firms. Behaviour like bullying or harassment going unchallenged is one of the reddest flags – a culture where this occurs can raise questions about a firm's decision making and risk management. Our new rules will help drive consistency across industry and support the vast majority of firms that want to do the right thing to deepen trust in financial services.”
Next steps
The new COCON rule will come into force on 1 September 2026.
The consultation on the draft guidance in Chapter 3 closes on 10 September 2025. Any guidance would be published by the end of this year, and apply from the same date as the new rule.
Separately, HM Treasury and the FCA and PRA are reviewing the SM&CR, and are expected to provide an update later in July 2025.
Contacts
Sajedah Karim
Alison Wade
Follow us
