FCA extends non-financial misconduct rules to non-banks — What you need to know before 1 September 2026

From 1 September 2026, the FCA will extend its Code of Conduct sourcebook (COCON) containing [rules on individual standards] to capture serious non-financial misconduct (NFM) in non-bank Senior Managers and Certification Regime (SMCR) firms, aligning these firms with obligations that banks have carried for years. The changes bring new notification duties, fitness and propriety implications and regulatory reference obligations. In assessing the relevance of NFM, firms will need to navigate a potentially complicated assessment of whether the conduct in question bears sufficient relation to the firm's business and personnel, as against whether the conduct arose in the course of a person's private or personal life.

The FCA will also bring in additional guidance in its Fit and Proper test for Employees and Senior Personnel sourcebook (FIT) as to when NFM and other forms of conduct are relevant to a fitness and propriety assessment.

This briefing sets out what is changing, who is affected, how this interfaces with employment law and what firms should do to prepare.

What is NFM?

NFM covers a wide range of conduct that extends beyond the ordinary scope COCON to include behaviour not of a clearly financial nature such as bullying, harassment (including sexual harassment) and violence, where relating to persons involved in the business of the firm.

It is not merely an HR or employment law issue. The FCA treats NFM as a regulatory matter going to a firm's culture, governance and individual fitness. The FCA considers that, if left unchecked, serious NFM harms individuals, firms and public confidence in financial services.

What is changing on 1 September 2026?

The new rule (COCON 1.1.7FR)

Pre-1 September 2026, COCON was restricted to conduct that forms part of, or is for the purpose of, a non-banking firm's regulated activities or SMCR financial activities. This made it difficult to bring colleague-to-colleague misconduct within the regulatory perimeter.

From 1 September 2026, a new COCON rule (COCON 1.1.7FR) extends the scope of conduct that COCON normally applies to. For non-banking firms, COCON will now apply to work-related NFM where there is a sufficient connection to the individual's role, even if the conduct does not form part of the firm's SMCR financial activities. Firms will need to assess carefully whether there are sufficient links to the non-SMCR parts of the business.

The new rule applies to unwanted conduct that:

• has the purpose or effect of violating an individual's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them; or
• is violent to that individual.

What is not covered?

• Purely private conduct with no connection to the regulated business.
• Discrimination and victimisation under the Equality Act (though sexual harassment is covered). Firms should nevertheless seek to prevent conduct of this kind and consider whether misconduct of these kinds may still breach the conduct rules.
• Minor workplace disagreements or poor behaviour. The seriousness threshold mirrors the harassment standard under the Equality Act 2010, and the FCA will treat a firm's reasonable judgement on seriousness as compliant.

Important: The rule is not retrospective. Firms do not need to revisit past conduct rule breach determinations or revise historic fitness and property assessments.

Who is in scope?

• The new rule applies to conduct rules staff; a broad category that includes SMF holders, certification employees, board directors and most other personnel of an SMCR firm.
• The potential subjects of NFM (i.e., those who may be victims) are widely defined to include direct employees, individuals performing functions for or providing services to the firm or its group and employees of service providers to the firm or its group.

The Fit and Proper Test (FIT)

The FCA's new guidance makes it clear that a FIT assessment engages NFM conduct beyond the scope of COCON.

• Firms can and must consider any relevant conduct, including conduct in an individual's private life, when assessing fitness and propriety as this can still go to their honesty, integrity and reputation.
• Therefore, a finding that conduct falls outside COCON (i.e., because it lacks a sufficient work-related connection) does not end the analysis. The firm must still consider whether that conduct affects the individual's FIT assessment and whether they can continue to hold an approved, senior manager or certified role.
• The FCA's updated FIT guidance covers social media usage, how to factor in breaches of the regulatory system, as well as breaches of workplace laws and requirements arising outside this system, the circumstances when behaviour from private or personal life will be relevant and how to take into account offences.
• In particular, the relevance of conduct in a person's private and personal life is subject to tests that will likely require subtle assessments for which a firm may not have precedent, for example as to whether the conduct shows that there is a material (non-speculative, non-remote) risk that the individual will breach regulatory standards and requirement or repeat the behaviour within their work role.

Practical implications for non-bank SMCR firms

• Notification obligations - From 1 September 2026, non-banking firms must notify the FCA when formal disciplinary action (written warning, suspension, dismissal or pay reduction/recovery) is taken against conduct rules staff for a COCON breach or where a FIT assessment has been affected.
• Regulatory references - From 1 September 2026, NFM-related findings must be included in regulatory references when an individual moves to another SMCR firm.

Where an adverse finding under COCON and/or FIT can clearly be prejudicial to an individual, a firm's HR and management teams need to be prepared to face scenarios that will require judgement that is consequential to the person assessed and potentially victims, as well as to the firm and its managers.

Manager accountability and the "reasonable steps" defence

Managers face heightened scrutiny from 1 September. The FCA expects them to take reasonable steps to prevent NFM. Failing to do so may itself breach Individual Conduct Rule 2 (due skill, care and diligence). Examples of potential breach include:

• Failing to intervene where the manager knew, or should reasonably have known, about misconduct;
• Failing to operate relevant policies and controls; or
• Failing to provide a safe environment for raising concerns.

The FCA has confirmed it would not hold a Senior Manager in breach of their duty of responsibility for NFM committed by someone in their area if they could not reasonably have known about it or lacked authority to act.

The mixed-business challenge: where financial and non-financial activities intersect

This is a complex aspect of the new rules specific to non-banks. Many non-banking SMCR firms carry on FCA-regulated activities alongside substantial non-financial business lines (for example, a financial advisory firm that also operates a technology or consulting division) supported by shared services like HR, compliance, internal audit, legal and finance that straddles both parts of the business. Where employees work across both parts of the business, or where NFM occurs in the non-financial part, the position requires careful analysis.

The following scenarios illustrate the challenge and where the rules bites:

• Both the perpetrator and victim work in the regulated financial services part of the business: in scope.
• The perpetrator is in the financial services part; the victim is in the non-financial part (or vice versa): in scope.
• Both work exclusively in the non-financial part: out of scope.
• A shared function (e.g. internal audit) covers the whole business without separation between financial and non-financial work: in scope, even if the victim works in the non-financial part.
• A shared function split into separate financial and non-financial teams; both individuals are in the non-financial team: out of scope.
• A shared function split as above; one individual is in the financial team and the other in the non-financial team: in scope.

The employment law dimension

The NFM rules do not arrive in isolation. From October 2026, the month after the NFM rules come into force, the Employment Rights Act 2025 strengthens the existing statutory duty to prevent sexual harassment from requiring "reasonable steps" to requiring "all reasonable steps." Since sexual harassment falls squarely within COCON 1.1.7FR, firms will face a heightened regulatory obligation and a heightened statutory obligation in respect of the same conduct at the same time. This makes it all the more important to treat prevention and investigation as a single exercise rather than parallel regulatory and HR tracks.

From 1 January 2027, the same Act removes the cap on compensatory awards for unfair dismissal claims (currently the lower of 52 weeks' pay and £123,543) and reduces the qualifying period from two years to six months of employment. Where a COCON breach or adverse FIT assessment leads to formal disciplinary action against a senior executive, it will increasingly be in that individual's interest to pursue a Tribunal claim rather than accept a negotiated exit. The potential award now extends across salary, bonuses, pension contributions and any equity or carry positions forfeited on exit and without a cap it is worth fighting for. Firms should ensure that HR, legal and compliance functions are working together from the outset of any NFM case.

Firms must also be alert to the constraints that regulatory obligations place on settlement. From 6 April 2026, the protected disclosure regime was extended to workers making disclosures in relation to sexual harassment, adding a further statutory layer to the existing constraints. An agreement with a departing individual cannot suppress or qualify an NFM finding in a regulatory reference, nor can it prevent the individual from reporting to the FCA or making a protected disclosure. Any clause purporting to do so is void. Settlement agreements should be reviewed now to ensure they include appropriate carve-outs and do not inadvertently give the impression that regulatory findings can be managed away as part of a negotiated exit.

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2026 White & Case LLP}