The Financial Conduct Authority's rules on workplace behaviour stopped being an HR matter for banks alone. Since 1 September 2026 the Conduct Rules in its Code of Conduct sourcebook have covered serious bullying, harassment and violence between colleagues at non-bank firms, and reporting on 24 September put the number of firms newly inside that perimeter at roughly 37,000.
That population is not a niche. It runs from independent financial advisers and mortgage and insurance brokers to wealth and asset managers, insurers, payment firms and lenders — authorised businesses bound to the Senior Managers and Certification Regime, none of which previously faced a conduct rule about how staff treat each other.
What changed in the rulebook
The mechanism is one new rule, COCON 1.1.7FR, working with guidance in the FCA's policy statement PS25/23. Until September, the Conduct Rules for non-banking firms reached only conduct that formed part of, or served the purposes of, a firm's regulated or SMCR financial activities. Colleague-to-colleague behaviour failed that test, which is why consultations running from CP23/20 in 2023 to CP25/18 in 2025 were needed to pull it in.
The rule now catches unwanted conduct towards a colleague that has the purpose or effect of violating that person's dignity, or of creating an intimidating, hostile, degrading, humiliating or offensive environment, or that is violent. The drafting follows the harassment definition in the Equality Act 2010 without requiring a protected characteristic, so sexual harassment is inside the rule as a form of harassment, while discrimination and victimisation do not become regulatory breaches in their own right.
Two limits decide how far a firm's policy has to reach. The conduct must be serious, and the guidance lists frequency, duration, the seniority of those involved, the impact on the person and any aggravating or mitigating factors as what to weigh. It must also have a sufficient work-related link: an office, a client event, a conference or a firm-organised social can qualify, strictly private conduct cannot, and the rule does not reach behaviour that predates it.
Who carries the liability
Individuals first. Serious non-financial misconduct can now breach Individual Conduct Rule 1 on integrity or Rule 2 on due skill, care and diligence, which brings approved persons, certified staff and other conduct rules staff into range. Managers are exposed separately. Under the guidance a manager can breach Rule 2 by failing to take reasonable steps to prevent or address the misconduct, including failing to intervene when they knew, or should reasonably have known, what was happening, or failing to give staff a safe route to raise concerns. The FCA has said it will not hold a manager responsible for conduct they could not reasonably have known about, or had no authority to act on.
The fitness and propriety test goes wider than the conduct rule. Where behaviour falls outside COCON for want of a work connection, firms can still treat it as relevant to whether someone is fit to hold a regulated role, including conduct in private life that shows a disregard for legal or ethical obligations. Regulatory references must carry non-financial misconduct findings when staff move between firms, and firms must tell the FCA when formal disciplinary action — a written warning, suspension, dismissal or pay recovery — follows a breach.
Where NFM is serious and goes unchecked, it can harm individuals, firms and confidence in financial services.
The FCA's baseline for how well firms spot any of this is not encouraging. A 2024 survey of 1,028 wholesale firms covering incidents in 2021, 2022 and 2023 found bullying and harassment accounted for 26 per cent of reports and discrimination 23 per cent, and that half of those incidents surfaced through grievances or similar formal processes rather than through any system the firm ran deliberately. Discipline or other action followed in 43 per cent of cases.
The FCA's instructions on what firms should not do are as specific as the ones on what they must. No retrospective re-scoring of old conduct cases, no revising past fitness assessments, no monitoring of employees' private lives or social media, and no investigation of allegations about private life that are trivial, implausible or irrelevant.
What is still untested
None of the new regime has been through a regulatory decision. There is no published FCA enforcement outcome resting on the misconduct rule, the seriousness threshold is a judgement firms are expected to make and defend, and the line between work and private life is the area the guidance explains at most length and settles least.
The next pressure point is statutory rather than regulatory. From October 2026, the employer duty to prevent sexual harassment moves from reasonable steps to all reasonable steps under the Employment Rights Act 2025, according to analysis by the law firm White & Case, meaning the same behaviour can carry a conduct rule breach and an employment claim together. The FCA's policy work on this rulebook is finished, and its own page is now a readiness checklist rather than a consultation. The test of those 37,000 firms will be the first enforcement notice, and none has been issued yet.