Culture and non-financial misconduct: FCA publishes second consultation

The FCA has published a long-awaited second consultation paper entitled 'Tackling non-financial misconduct in financial services' (CP25/18) following a number of speeches and an original consultation in September 2023 ('Diversity and Inclusion in the Financial Sector' (CP23/20)) through which the FCA has sought to address industry feedback that the rules and guidance have not kept pace with the rhetoric in relation to non-financial conduct (or "NFM"). The term non-financial misconduct is not defined, but broadly speaking relates to behaviours such as bullying, harassment and violence.  The FCA has often made a correlation between cultural shortcomings and poor market conduct or customer outcomes. In this latest consultation the regulator reiterates its position, stating that one of the clearest warning signs of a failing culture is where behaviours such as bullying or sexual harassment go unchallenged.   

The proposed changes reinforce the FCA's expectations of firms, which include taking decisive action where non-financial misconduct is substantiated and sharing information where the individual concerned is changing jobs to prevent "rolling bad apples".   

CP25/18 comprises two distinct elements:

• a policy statement outlining final changes to the Conduct Rules ("COCON") which will come into force on 1 September 2026; and

• a consultation on revised guidance on COCON and fitness and proprietary requirements ("FIT") which takes into account feedback received on the first consultation and seeks to clarify aspects of the draft guidance.  This revised guidance will only be introduced if there is "clear support" to do so. 

What is changing in COCON with effect from 1 September 2026?

Key points:

• Changes to COCON to explicitly refer to NFM. However, the definition of NFM has been narrowed to more closely align with the definition of harassment in the Equality Act 2010 ("Eq Act") to include conduct that has the purpose or effect of violating an individual's dignity or creating an intimidating, hostile, degrading or humiliating or offensive environment for an individual, as well as conduct that is violent towards an individual. However, the conduct does not have to be linked to a protected characteristic in the same way as the Eq Act so it will include general bullying and harassment (which is not covered by employment legislation). As a result, firms may conclude that NFM amounts to a breach of COCON (giving rise to disciplinary action) but does not breach employment law.  For example, routine humiliation of a junior analyst in relation to the quality of his research at team meetings by a senior manager could be a breach of COCON but, if not related to a protected characteristic such as race, would not be a breach of employment law.  This will inevitably lead to a heightened focus on the merits of a firm's analysis where it concludes there is a breach under COCON, particularly if this leads to sanctions such as termination of employment (depending on the context).

• Alignment of the scope of certain COCON rules to include non-banks (currently there is a discrepancy between the rules that apply to banks and non-banks).  The FCA says that the intention is to give non-banks greater confidence about the scope of their requirements, strengthen their ability to take action and prevent harm.

• There will be no changes to Question G within regulatory references on the basis that the FCA considers there is sufficient guidance under general law and within other parts of the Handbook (such as SYSC).

What does the proposed guidance for COCON and FIT look like now?

The revised guidance has been amended to take into account the feedback received from the original consultation.  In summary:

• The starting point is that COCON does not cover private or personal life so conduct relating to an individual's private or personal life is outside the scope of COCON and cannot be a Conduct Rule breach.  However, the boundary between work-related and private contexts is less clear, and further factors and scenarios have been added to the guidance to assist firms when determining whether NFM which has taken place outside of the workplace falls within the scope of COCON.  New scenarios include NFM which takes place at a round table or training event organised by another firm or industry body, for example.  This non-exhaustive guidance will be helpful to firms to ascertain whether NFM falls within COCON, although it will be important to evaluate all the circumstances when reaching a view.  In addition, conduct which falls outside of the scope of COCON could still be relevant to the assessment of fitness and propriety under FIT.

• There will only be a breach of COCON if misconduct is serious (together with other factors which we have not sought to outline in full here). The FCA has explained that the use of the term 'serious' seeks to reflect the requirement for conduct to have a significant negative effect on the subject which is "violating", "humiliating" or "degrading" and carve out minor incidents of poor workplace behaviour. 

• The FCA has clarified that seriousness is not the deciding or distinguishing factor in determining whether NFM is a breach of COCON Rule 1 (Acting with Integrity) or COCON Rule 2 (Acting with due skill, care and diligence).  In the absence of deliberate or reckless misconduct, NFM is likely to be a breach of COCON Rule 2, rather than COCON Rule 1.

• Managers will be expected to take steps to try to prevent harassment and bullying and may be in breach of COCON Rule 2 if they don't. However, what a manager should do will depend on the facts, and it will be a defence if a manager can demonstrate that he/she has acted reasonably.  Non exhaustive examples include a failure to intervene to stop behaviour that a manager knows about (or should have known about), a failure to set up or operate policies and procedures to detect and prevent such behaviour, or a failure to take complaints seriously or deal with them appropriately. This is very much in line with developments in employment law, including the duty on employers to take reasonable steps to prevent sexual harassment which came into force in October 2024, and the proposed changes set out in the Employment Rights Bill where employers will be liable if they haven't taken all reasonable steps to prevent all types of harassment in the course of employment, including from third parties. As such, firms will need to review their policies, procedures and training to ensure that they are able to identify risk and prevent harassment, rather than relying on reactive processes such as traditional whistleblowing and grievance processes.

• Other employment law concepts have been added to the guidance to assist firms in determining whether there has been a COCON breach. For example, whether the conduct was proportionate to the intended aim and/or whether the individual's response to the conduct was reasonable.

• The FCA does not expect firms to monitor their employees' private lives to identify anything that is relevant to fitness and propriety (such as conduct that is dishonest or shows a lack of integrity). However, if a firm becomes aware of information about an individual's private life which would call into questions fitness and propriety, if substantiated, a firm should take steps to assess the possible impact such as asking for an explanation.  A custodial sentence (even if suspended) is likely to be sufficiently serious to be relevant to fitness and propriety, subject to other considerations such as the length of time that has passed and evidence of rehabilitation.

• A person may lawfully express views on social media even if those views are controversial, offensive or upset work colleagues without calling into question fitness and propriety but could be relevant if the social media activity indicates a real risk that the person will breach requirements and standards of the regulatory system. Examples include threats of violence or clear involvement in criminal activities. This is a notoriously difficult area of developing employment law so firms will need to tread carefully when dealing with such issues, both from an employment law and regulatory perspective.

Comment

The consultation closes on 10 September 2025 and the FCA plans to review the feedback and publicise the outcome of the consultation by the end of 2025.  Absent sufficient support for the guidance, firms could find themselves subject to the revised provisions of COCON but without any guidance to assist them interpret those rules.  In order to ensure some form of guidance is published, firms should consider submitting a response to the consultation even where this is limited to signalling support for the guidance, stopping short of providing detailed feedback on the guidance itself. This is, however, a valuable opportunity to help shape the guidance before it is finalised.  

Whilst the FCA has taken some limited steps to simplify the framework (such as the decision not to pursue changes to the Threshold Conditions), the FCA has used the delay in publication to amend the previous guidance, including considering further permutations in relation to the boundary between work and private life.  For example, social events organised by employees were out of scope under the original guidance.  Under the revised guidance, NFM which occurs after a work event at a separate location which could be considered to be a continuation of the first event, could now fall within the scope of COCON.  Another scenario which will be within the scope of COCON if the revised guidance comes into effect, is where NFM takes place at external training which employees are required to attend by the firm.  This further illustrates that the application of the framework will remain highly fact specific.

Whilst the guidance still requires a high degree of subjective interpretation to be applied to the facts of each incident of NFM, it does provide some helpful examples which illustrate the direction of travel from the regulator's perspective.  Nonetheless, difficult judgements will need to be made and there is potential for a decision on the regulatory consequences to diverge from the employment position.  As such, firms should continue to ensure that their HR and regulatory systems and controls are aligned when dealing with such matters, and they have clear policies and procedures setting out a firm's expectations around conduct of this nature and the approach that the firm will take to manage any issues.  

Once the outcome of this second consultation is announced (whether in the form of a decision to drop the proposed guidance or the publication of finalised guidance on COCON or FIT), firms should not delay work on aligning policy and procedures to the new framework and carrying out training for staff.