The boundary between employment law and financial regulation in the UK has shifted again. As of 1 September 2026, the Financial Conduct Authority (FCA) has implemented its highly anticipated policy changes, formally embedding serious non-financial misconduct (NFM) into its regulatory framework. We see workplace culture coming under the microscope of FCA regulation.
For those in financial services and regulated roles/firms, this represents a fundamental shift. Bullying, harassment, and toxic workplace cultures are no longer just internal disciplinary issues or employment tribunal risks, they are now direct breaches of regulatory conduct rules.
Key implementation dates
Understanding the timeline is critical for compliance and strategic planning:
· 1 September 2026 (core changes): The FCA’s updated individual conduct rules (specifically under COCON 1.1.7FR [https://handbook.fca.org.uk/handbook/cocon4]) came into full effect for non-banking Senior Managers and Certification Regime (SM&CR) firms. This officially expanded the scope of individual conduct rules to cover serious non-financial misconduct connected to an employee’s role.
· Ongoing 2026/2027 assessments: Financial institutions must immediately integrate these expanded criteria into their active, annual, and ad-hoc Fit and Proper (FIT) assessments, as well as regulatory reference procedures for new hires.
The employment law perspective
From an employment law standpoint, the FCA’s new rules significantly lower the threshold for what constitutes actionable workplace harassment.
Traditionally, under the Equality Act 2010, an employee claiming harassment generally needs to prove that the unwanted conduct relates to a “protected characteristic” (such as sex, race, age, or disability). The FCA’s framework completely bypasses this requirement.
Under the new guidance, general bullying, intimidation, and hostile behaviour such as targeting a colleague over their weight, appearance, or personality traits, fall squarely within the scope of non-financial misconduct.
Employment lawyers must now advise clients that conduct failing to trigger an Employment Tribunal claim may still trigger a mandatory regulatory notification to the FCA.
Furthermore, internal investigations must become significantly more robust. Disciplining or exiting a senior executive now requires a synchronized approach between HR and Compliance, as standard settlement agreements can no longer be used to ‘hide’ or avoid mandatory regulatory reporting.
The regulatory perspective
From a regulatory viewpoint, the FCA has broadened the scope of “fit and proper” in the workplace.
The FCA is sending a clear message: a person cannot be “fit and proper” to work in financial services if they abuse their power or mistreat colleagues.
The expanded COCON and FIT frameworks introduce several critical adjustments for compliance officers:
· Context of the misconduct: Misconduct is caught by COCON if it is connected to a person’s role or the firm’s business. However, the FIT guidance goes further, clarifying that serious private or personal misconduct can also impact an individual’s fitness and propriety if it undermines public confidence in the industry or demonstrates deep-seated dishonesty.
· Investigative rigour: The FCA expects firms to treat serious non-financial misconduct with the exact same level of institutional seriousness, resource allocation, and investigative rigor as financial fraud or insider trading.
· Regulatory references and exits: When a certified individual or Senior Management Function (SMF) leaves a firm under a cloud of NFM allegations, this must be accurately reflected on their regulatory reference, effectively restricting their ability to quietly move to a competitor.
The risk of enforcement
The FCA has left little room for doubt that it regards non-financial misconduct as a priority enforcement area. Firms may see some initial latitude on purely procedural aspects of the new reporting obligations, but no such tolerance should be expected where substantive misconduct is involved. This is particularly related to cases involving sexual harassment, sustained patterns of bullying or acts of violence.
Enforcement attention is most likely to fall first on firms whose systems and controls remain inadequate despite the extended lead time the FCA provided. Individual senior managers face direct personal exposure: the FCA’s guidance makes clear that it will examine whether a manager was aware, or ought to have been aware, of the misconduct and whether they were in a position to take action. The regulator has indicated that it will treat a failure to act through lack of adequate systems in the same way as a conscious decision not to intervene.
There are three principal areas the FCA may consider when deciding whether to bring enforcement action:
- whether the individual is fit and proper.
- whether there has been a breach of the conduct rules.
- whether misconduct was permitted to occur because of systems and controls failings at firm level.
Firms should expect enforcement to proceed across all three tracks simultaneously.
Practical next steps for FCA firms
To navigate this regulatory convergence successfully, firms should take immediate, proactive steps:
- Bridge the HR and Compliance silos: Ensure that your HR team and Compliance department have a unified protocol. HR can no longer conclude a disciplinary grievance without Compliance assessing if a COCON breach or FIT notification is triggered.
- Update handbooks and policies: Review and revise staff handbooks, bullying and harassment policies, and codes of conduct to explicitly reference the 1 September 2026 FCA standards.
- Train managers on the new thresholds: Provide specialised training to line managers and investigators so they understand that “general” bullying is now a regulatory matter.
The FCA has made its expectations clear, healthy workplace cultures are foundational to market integrity. By treating behavioural misconduct as a core regulatory risk, firms can protect both their people and their regulatory standing.
It is important that all firms regulated by the FCA consider the new requirements and ensure that they are compliant, placing an even closer eye on their workplace culture and behaviours.
