In Focus: The FCA’s New Guidance on Non-Financial Misconduct

Background

Non-financial misconduct (NFM) has been a growing area of regulatory focus for some time, with the FCA emphasising that individuals in financial services must uphold high standards. Yet, despite this heightened attention, many firms have grappled with uncertainty about precisely how the FCA expects them to monitor and approach such conduct, and when it is truly relevant to an individual’s fitness to perform their role, particularly given that many real-life scenarios are complex and nuanced. 

A wave of recent developments, including new FCA guidance on NFM, amendments expanding the scope of the FCA’s Conduct Rules for individuals at non-bank firms, high-profile enforcement cases, and important changes to employment law, has resulted in shifting expectations in how firms address and handle NFM. These changes demand fresh thinking about policies, procedures, and culture.

The imperative for firms is clear: they must be equipped to handle NFM matters fairly, consistently, and in a manner that satisfies both regulatory and employment law requirements. In this article, we outline the key changes, explore their practical implications, and address the questions firms most frequently ask as they navigate this new terrain.

Changes to FCA Rules and Guidance

The FCA’s new guidance on NFM was finalised in December 2025 and became effective on 1 September 2026 (see this Latham blog post). The guidance covers two distinct areas: NFM in the Code of Conduct sourcebook (COCON) and NFM in relation to the Fit and Proper test for Employees and Senior Personnel sourcebook (FIT). Crucially, COCON and FIT have different purposes and scope, so the way in which NFM may be relevant to compliance with the Conduct Rules will differ from how it impacts an individual’s fitness and propriety.

The new guidance had to be consulted on twice as various elements proved controversial, indicating the challenge of striking an appropriate balance between providing meaningful guidance whilst avoiding adding confusion or uncertainty. The final guidance necessarily lacks detail in certain places to facilitate a broader application. Equally, it remains quite lengthy and complex overall. Therefore, firms must be mindful of the fact that, ultimately, each case will be heavily fact-specific and issues will need to be determined on a case-by-case basis.

As well as introducing new guidance, the FCA amended the scope of COCON as it applies to firms other than banks, to clarify that serious misconduct (such as bullying, harassment, and violence between staff) is relevant to the Conduct Rules. This change, which also took effect on 1 September 2026, is meant to ensure that equivalent expectations apply to all firms, as previously the scope of COCON was broader for banks. Consequently, for non-banks conduct no longer has to be related to the firm’s financial services activities to be in scope, and so misconduct related to the performance of an individual’s role can constitute a breach of the Conduct Rules. Therefore, additional types of misconduct must be analysed as potential Conduct Rule breaches.

FCA Action on NFM

Prior to introducing new guidance on NFM, the FCA had for some time been trying to set the parameters through its enforcement work. However, the Upper Tribunal has not always taken the same view as the regulator, making it difficult for the FCA to further its NFM agenda.

The FCA has had more success lately, most notably in bringing cases based on lack of integrity under the Conduct Rules, such as the recent case against Crispin Odey in which the Upper Tribunal agreed with the FCA’s findings on all counts (except the size of the penalty), bolstering its position. However, it should be noted that recent cases have not been based on the underlying allegations of NFM (in Odey’s case the treatment of female members of staff), but rather conduct in response to those allegations (his actions in twice dismissing the firm’s executive committee in order to frustrate the internal disciplinary process). 

Therefore, the FCA cannot refer to a clear enforcement case that is based squarely on NFM rather than on related conduct, suggesting that it remains a difficult area. The new guidance, which in part “clarifies” the position on aspects that have proven contentious before the Upper Tribunal in the past (such as whether the mere fact of a criminal conviction can call into question someone’s integrity), may help the FCA to bring more successful cases in future.

Employment Law Changes

The new FCA guidance and employment law can be seen as complementary but distinct regimes. Firms should not assume that meeting one set of obligations will satisfy the other. In response to consultation feedback, the FCA revised the guidance to align it more closely with employment law, with the intention that it should complement rather than duplicate the Equality Act 2010. Even so, areas of divergence remain. The clearest gap concerns harassment: under the Equality Act 2010, harassment must relate to a protected characteristic, whereas the conduct captured by the FCA’s guidance carries no such requirement. 

The expansion of COCON described above does not automatically bring other conduct prohibited by the Equality Act 2010, such as discrimination and victimisation, within the new rule, although such conduct may still breach the Conduct Rules depending on the facts. Conversely, the Equality Act 2010 imposes liability primarily on the employer for acts done in the course of employment (although individuals can also be personally liable), whereas the FCA’s guidance imposes individual accountability on managers, calibrated to their knowledge and authority.

The Employment Rights Act 2025 introduces several key changes that may impact firms:

• From 30 October 2026, the duty to prevent sexual harassment is being strengthened: employers will need to take “all” reasonable steps, which sets a materially higher evidential bar, since it will not be enough to point to steps taken if others were reasonably open to the firm. From the same date, employers also become liable for harassment of their staff by third parties, such as clients, customers, and contractors, across all protected characteristics, subject to a defence where the employer took all reasonable steps to prevent the harassment. That has obvious implications for client entertainment, conferences, offsites, and business travel, and for the alcohol-heavy settings in which much of it takes place. The existing consequences of non-compliance continue to apply to the strengthened duty: an uplift to compensation awarded of up to 25% in the tribunal, as well as potential enforcement action by the Equality and Human Rights Commission.
• Disclosures about sexual harassment now expressly qualify for whistleblowing protection, bringing them within the existing regime of day-one protection from detriment and dismissal and uncapped compensation for successful claimants. This reinforces the protection that may already be available to those who raise NFM concerns and underlines the importance of the “safe” environment for raising concerns emphasised in the FCA guidance.
• From 1 January 2027, employees will be able to bring unfair dismissal claims after six months’ service (rather than two years, as is the case currently), and the cap on the compensatory award is being removed. For financial services employers, the combination is significant: an award may now reflect the employee’s actual financial loss across their whole package, including pension loss, deferred and incentive awards, potentially carried interest, and the value of equity that would have vested. A straightforward unfair dismissal claim will therefore carry exposure that the cap previously made a manageable business risk for senior earners, and a procedural misstep on a high-value exit now has amplified financial consequences. This is likely to lead to an increase in litigation, including by individuals dismissed for NFM, and to remedy hearings that take longer and turn on more expert evidence, in an already congested tribunal system. Given the heightened risk expected to attach to dismissals, firms should ensure that any dismissal for NFM rests on a thorough investigation, rigorous documentation from the outset, and a fair process.
• Confidentiality provisions in agreements between an employer and a worker, including settlement agreements, will be void to the extent that they prevent the worker from making an allegation or disclosure about relevant harassment or discrimination, or about the employer’s response to it, subject only to any “excepted agreements” permitted by regulations. That materially changes what a settlement can deliver on an exit involving NFM allegations, and existing templates will need to be revisited. The date of this change in law is yet to be confirmed. 

FAQs

As the expansion to scope and the new guidance continue to bed in, firms want to ensure that they fully understand the changes. To assist with this, we have answered some of their most common questions below.

• How does the FCA define NFM? Whilst the FCA does not specifically define NFM, it does address which behaviours will be relevant under COCON and FIT. For example, COCON references unwanted conduct that has the purpose or effect of: (i) violating an individual’s dignity; or (ii) creating an intimidating, hostile, degrading, humiliating, or offensive environment for that individual. Essentially, this encompasses serious bullying and harassment. The FCA also references conduct that is violent to the relevant individual. However, this list of behaviours is non-exhaustive, so firms need to consider any relevant misconduct, remembering that a range of factors may be important in deciding whether or not the conduct is relevant. The FCA expects firms to make a reasonable judgement about what is serious in the circumstances, but the guidance indicates that factors such as whether the conduct is repeated or part of a pattern, its duration, the scale of its impact on the subject, the seniority of the person responsible, and the difference in seniority between them and the subject will all be pertinent to seriousness.
• How do the scope of COCON and FIT differ? Conduct in an individual’s private life is relevant to FIT, while COCON explicitly does not cover private or personal life. However, many grey areas remain around the scope of COCON, as the guidance cannot account for every scenario. Circumstances can often be nuanced; for example, misconduct that takes place at a social event with work colleagues following a work event. The FCA has provided a list of factors that point towards conduct being in scope of COCON, such as conduct on the firm’s premises or arising in a business context. It has also set out a table of different types of conduct, indicating which are likely to be in scope of COCON and which are not. For example, misconduct towards another employee when travelling to a meeting would likely be in scope, whereas misconduct towards a member of the public when commuting to work may not be. Ultimately, firms will need to consider each scenario on its own facts and come to a reasonable judgement as to what ought to be captured.
• Do firms have to monitor employees’ private lives? Generally, conduct in an individual’s private life will only be relevant under FIT. However, Senior Managers should be aware of the new guidance in COCON clarifying that they may be required to disclose information about their private or personal life under Senior Manager Conduct Rule 4 if it would be material to an assessment of their fitness and propriety. The FCA has clarified that firms do not need to actively monitor the private lives of their employees and/or Senior Managers for the purposes of FIT; there is only an obligation to look into an individual’s private life if something comes to the firm’s attention that warrants investigation (i.e., because, if true, it would call into question their fitness and propriety). However, firms are not expected to investigate trivial or implausible allegations against their employees, or allegations that the authorities would be investigating (for example, potentially criminal behaviour that is best investigated by the police). The FCA expects that firms will mostly rely on conduct of the kind described in FIT (that is, conduct going to honesty, integrity, and reputation, or competence and capability), criminal convictions, or the findings of a court when deciding on whether NFM in an individual’s private life is relevant to fitness and propriety. 
• When do firms need to check individuals’ social media accounts? The FCA has clarified that firms are not expected to actively monitor the social media accounts of their employees. Like other issues that may arise in an individual’s private life, firms need only consider social media if conduct on such platforms comes to their attention and the conduct is genuinely relevant to FIT. The FCA guidance emphasises that a person can lawfully express their views on social media without calling into question their fitness and propriety, even if these views are controversial or upset others. However, social media content that suggests an individual will engage in misconduct or unlawful activity, or that is intended to incite such activity, could be relevant to fitness and propriety. Firms should also consider whether certain activities on social media breach internal policies on social media use, even if they are not serious enough to call into question fitness and propriety.
• Should firms assume that misconduct in an employee’s private life could be repeated at work? The new FCA guidance in FIT tries to shed some light on this matter. The FCA is of the view that conduct in a person’s private life which shows there is a material risk they will breach the standards or requirements of the regulatory system, or that if repeated in their role would breach the standards or requirements of the regulatory system, may show that the individual is not fit and proper. Importantly, conduct showing dishonesty or a lack of integrity may well fit this description. However, the FCA also highlights that firms must not assume that conduct in an individual’s private life necessarily will be repeated in a work context, although certain misconduct may be relevant even if there is little chance of it being repeated at work. For example, the FCA emphasises that conduct demonstrating a willingness to disregard ethical or legal obligations, abuse a position of trust, or exploit the vulnerabilities of others could undermine public confidence in the financial services industry and so is likely to be relevant to fitness and propriety. Further, repeated, minor misconduct could be relevant even if a single instance would not raise concerns. Consequently, firms will need to make a fact-specific judgement in each case.
• Will a criminal conviction mean that someone should not be found to be fit and proper? The new guidance directly addresses this issue, given the difference in stance between the FCA and the Upper Tribunal in the Frensham case. The FCA does not advocate a blanket approach, so a firm’s assessment will depend on the specific case. For example, surrounding factors, such as the passage of time since the offence or any subsequent rehabilitation, can be relevant. However, certain types of conviction will naturally be more pertinent to fitness and propriety in a regulatory context, for example convictions relating to fraud, financial crime, or an offence under company law. That said, the offence need not have been committed in a work context to be relevant under FIT. Further, a criminal conviction can also be relevant under FIT even if it would not by itself cause direct damage to public confidence in the financial services industry.
• Have expectations on managers increased? Are managers now expected to prevent NFM? The guidance articulates the expectation that managers need to take reasonable steps to try to prevent and address NFM, whilst acknowledging that what is reasonable in any given situation will depend on the facts. It is important to note that, in this context, the term “manager” is not limited to a line manager and is not specifically defined, so could capture a broader range of individuals than perhaps expected. There is no absolute expectation that managers can and will prevent every instance of NFM; rather they must do what is reasonable within their powers. The FCA indicates that behaviour such as failing to take complaints of NFM seriously or failing to ensure a “safe” environment in which people can raise concerns about NFM could constitute a breach of Individual Conduct Rule 2 (“You must act with due skill, care and diligence”.). However, the guidance also clarifies that a manager should not be held responsible for failing to stop NFM if they could not reasonably have known about it, or where there are constraints on their ability to act (i.e., they lack authority).
• What is the impact on regulatory references? As the regulatory reference requirements in SYSC 22 mandate that firms disclose any findings that an individual is not fit and proper, disciplinary action taken for breach of the Conduct Rules, and/or any serious misconduct involving the individual, the expansion of COCON for non-banks, and the newly articulated guidance on NFM impact what firms need to disclose. Firms will need to ensure that they are capturing all relevant information in regulatory references.
• If conduct breaches the Conduct Rules, can the firm safely dismiss? Not always. The regulatory and employment law analyses are separate, and a finding that an individual has breached the Conduct Rules does not automatically make a dismissal fair. A tribunal will still examine whether the firm had a genuine belief in misconduct on reasonable grounds following a reasonable investigation, whether a fair procedure was followed, and whether dismissal was a reasonable sanction in the circumstances, including by reference to how the firm has treated comparable conduct in the past. Equally, the absence of a Conduct Rule breach does not mean that conduct cannot be a disciplinary matter: behaviour may fall short of the firm’s own standards or breach its policies without crossing the regulatory threshold. 
• What should firms do if allegations are not substantiated? An unproven allegation is not a finding of misconduct, and firms should be careful not to treat it as one. Any investigation must also comply with applicable law, including data protection requirements. Where concerns are investigated but not upheld, there will often still be lessons to learn and actions to take (such as updating policies, providing training, or changing reporting lines). The FCA will also expect firms to consider whether an issue is genuinely a one-off incident or indicative of something more systemic. 

What Is Expected of Firms?

As firms work to ensure that they have embedded the new guidance appropriately, we set out some key areas for firms to consider:

• Update internal policies. Firms should review and update their internal policies to reflect the new FCA guidance on NFM. This includes policies covering employee conduct, disciplinary procedures, and whistleblowing, ensuring they align with the expanded scope of COCON and the clarified expectations under both COCON and FIT.
• Train key personnel. HR, legal, and compliance staff must all have a thorough understanding of the new guidance. Misconduct allegations should not be seen as an issue solely for HR, as these teams need to work together to ensure outcomes are fair, consistent, and meet regulatory expectations. 
• Consider additional Conduct Rules training. If they have not addressed this already, firms should consider whether staff require additional training on how the Conduct Rules apply in light of the new guidance, bearing in mind the obligation to train all Conduct Rules staff on the Conduct Rules and what the rules mean for them in their role. Firms could revisit Conduct Rules training so that it reflects the new guidance and scope — a step that will be particularly important for non-banks subject to the expanded scope of COCON.
• Brief managers on their responsibilities. Managers need to understand the expectations placed on them in terms of preventing and addressing NFM. The new guidance clarifies that managers should take reasonable steps to protect staff from such conduct and respond appropriately when it occurs, and managers may request support to ensure they are equipped to deal with real-life scenarios. Managers may also request a review of existing processes to deal with NFM so that they can be sure they can take appropriate steps to address it when required.
• Review regulatory reference processes. Firms must have a robust process for ensuring that regulatory references include relevant instances of NFM, requiring firms to make careful decisions about what merits disclosure while balancing employment law considerations.
• Map out potential scenarios. Firms should consider whether it is worthwhile mapping out different NFM scenarios internally. Running through hypothetical situations can help identify gaps in policies or processes, ensure decision-makers are aligned on how to approach difficult cases, and build confidence in handling these matters consistently.
• Prepare for difficult judgement calls. Despite the new guidance, instances of NFM will still require firms to exercise their judgement on a case-by-case basis. Firms should ensure decision-makers are prepared to navigate these challenges thoughtfully and understand that the guidance will not provide clear answers in most cases.
• Ensure consistency in outcomes. Firms need to ensure consistency in how they handle NFM matters internally, and that the rationale for each decision is documented appropriately. It is worth remembering that breaches of COCON only need to be notified to the FCA when they result in disciplinary action, so firms should have clear processes for determining when disciplinary action is warranted.
• Document retention with litigation in mind. Firms should ensure that investigation findings, procedural steps, and comparator decisions are captured as matters progress (rather than reconstructed later), and that HR, compliance, and the business are clear on who records what.
• Revisit sexual harassment risk assessments. Firms should refresh their risk assessments ahead of 30 October 2026 and record both the risks identified and the mitigation steps adopted, together with the reasons for any step that was considered but not taken. Having a policy in place will not, by itself, be enough to meet the enhanced duty; what matters is whether the firm’s systems and controls work in practice.
• Review exit and settlement practices. Allegations should be investigated rather than settled away, and settlement documentation should not prevent protected disclosures or regulatory reporting, commit the firm to a particular regulatory reference, or have the effect of rewarding the alleged conduct. In light of the forthcoming restrictions on confidentiality provisions described above, firms will want to review their templates.