Beyond compliance: Why conduct and culture are becoming financial risks

This article was first published by Islamic Finance News (IFN) as part of the IFN UK Forum 2026 post event report. The full report can be seen here.

Since the post financial crash shakeup of financial services regulation in the UK, the Financial Conduct Authority (FCA)’s focus has primarily been on whether firms have the right systems and controls in place and on breaches of its rules which have the potential to impact consumers or markets.

Increasingly though, regulatory attention appears to extend beyond the design of governance frameworks and towards how firms behave when those frameworks are tested in practice. Recent developments across financial services regulation suggest a growing focus on conduct, accountability and culture as indicators of governance effectiveness.

FCA Chief Operating Officer, Emily Shepperd, in a speech given last year titled ‘Culture is Courageous’, at the 10th Annual Culture and Conduct in Financial Services Summit said that she is often asked why the FCA cares about culture. Her answer, she said, is simple. “As a conduct regulator, the FCA’s objectives are to protect consumers, ensure market integrity and support the UK’s economic growth and competitiveness. But time and again, when we investigate failures of consumer protection or market conduct, what do we find? The same root cause: failings in culture and governance. That is no coincidence. Because it is culture that drives conduct. Culture that shapes decisions and actions at every level.”

The FCA’s non-financial misconduct rules

The FCA’s non-financial misconduct rules, which apply from the 1st September 2026: (i) extend the scope of the conduct rules to cover bullying and harassment (as well as violence) against colleagues where it relates to an individual’s role; and (ii) clarify how a broader range of non-financial misconduct is to be taken into account when assessing fitness and propriety.

Their introduction arguably reflects a growing focus across the board on the conduct of individuals and corporate culture which is also evident in the changes commenced in 2023 by the Economic Corporate Crime and Transparency Act and completed by the passing of the Crime and Policing Act 2026. Taken together these developments suggest a broader regulatory interest in the relationship between individual behaviour and organisational accountability.

These changes make it clear that if the culture of an organisation is defined by the behaviour it tolerates, that is no longer a matter purely for HR. Conduct which has no obvious impact on markets and even outside of the workplace can create regulatory, financial and reputational risk for firms. A failure to properly address inappropriate behaviour may affect an individual’s fitness and propriety, the firm’s relationship with the regulator and ultimately, the confidence of customers and investors.

The point is not that every instance of misconduct becomes a regulatory issue. Rather, firms’ responses to misconduct may reveal important information about governance, escalation procedures and management oversight. Compliance with the FCA’s rules cannot be reduced to a matter of policies and procedures. Firms will increasingly need to demonstrate that those policies are reflected in the way people actually behave.

From policies to culture

There is an important distinction between having a compliance framework and having an effective compliance culture.

Policies and procedures are necessary. They provide the framework within which employees are expected to operate and can provide an important defence when things go wrong. The failure to prevent fraud offence for example, introduced in December 2023, has a complete defence where the relevant organization can show it had in place reasonable procedures to have prevented the fraud. Most commercial organisations will have a policy for the prevention of fraud and bribery but the requirement for the defence is much broader. Common principles include top-level commitment, (meaning senior leaders must foster a zero-tolerance culture) and monitoring and review (including appropriate investigation and assurance).

The concept of corporate culture as a risk management strategy is therefore not new. Neither are the challenges in monitoring, enforcing, supporting a culture where employees are encouraged to bring concerns to management The question is not simply whether a firm has a policy but whether a firm’s governance arrangements make it sufficiently difficult for poor conduct to go unnoticed, unchallenged or unaddressed. It is relatively easy to describe a commitment to integrity when everything is going well, targets are being hit and business is booming. The more revealing test is what happens when a concern is raised about a senior individual, a commercially valuable client or a significant transaction the business is under pressure to complete.

Trust the process?

For firms operating in markets where ethical considerations form an important part of their product, trust is integral to their bottom line. Trust is difficult to build and is a valuable asset worth protecting. Whistleblowing frameworks provide a useful illustration. While policies can establish reporting channels and escalation processes, confidence in those arrangements depends on how concerns are handled in practice.

The most challenging situations rarely involve straightforward questions of policy compliance. They tend to arise where firms are required to balance competing obligations, manage sensitive internal issues and make decisions under scrutiny.

A firm that responds to misconduct solely by identifying an individual to point to may miss an opportunity to identify a wider governance problem. Firms that use investigations to understand how and why a failure occurred are often better-placed to identify weaknesses in governance, decision-making or oversight, implement meaningful remediation and maintain trust and credibility with employees, customers and regulators.

These themes may have particular resonance in sectors where trust forms an important part of the value proposition offered to customers. Customers may place significant weight not only on commercial outcomes but also on confidence in the governance and standards underpinning products and services. With regards to Islamic finance, the FCA does not assess compliance with Islamic principles, however its increasing focus on governance, accountability and conduct reflects a principle that is widely applicable; trust is far easier to maintain where organisational behaviour aligns with the values a firm promotes.

The real test

The increasing focus on culture and conduct should not be viewed simply as another layer of compliance. It represents a broader shift in how risk is understood. The question is not simply whether risks have been identified and controls documented. It is whether governance arrangements support effective decision-making when those controls are tested.

For values-led firms, there is an additional dimension. Trust is more than a reputational consideration. It is an asset that needs to be protected and when challenged, restored.

The firms best-placed to navigate this environment are unlikely to be those with the longest policy manuals. More often they will be those able to demonstrate that governance arrangements, leadership and organisational culture work together effectively when difficult issues arise.