FCA rule changes will clarify that serious bullying and harassment at any financial institution, including in some instances where it takes place in an individual’s private life, may affect whether they satisfy conduct rules and meet the fit and proper test.
As we previously explained, in 2023 the PRA and FCA each published consultation papers (CP 18/23 and 23/20 respectively) on diversity and inclusion (D&I) in financial services, highlighting the continued regulatory concern in this area. The 2023 consultation papers proposed reforms that included requiring financial services firms to maintain a D&I strategy, mandating that firms set diversity targets, and implementing additional D&I disclosure requirements for large firms. However, in March this year, we reported that the PRA and FCA announced that they were dropping these plans in an effort to boost growth in the UK.
Another important focus of the 2023 consultations was non-financial misconduct (NFM), a topic that had been on the regulators’ radars for some time as part of a broader focus on culture. The outcome of the NFM aspects of the consultations has been highly anticipated.
The FCA has now published in a policy statement its proposed rules on NFM alongside a consultation on draft guidance to support firms to apply its NFM rules if needed (CP 25/18). The policy statement extends the scope of the FCA’s NFM rules while the consultation sets out amended guidance in relation to NFM for the purposes of the conduct rules and fitness and propriety (F&P) assessments.
Extending existing NFM rules to include non-banks
The FCA Code of Conduct (COCON) sets out conduct rules for staff and provides guidance about those rules to firms whose staff are subject to them. The FCA has statutory powers as an enforcement body for breaches of COCON.
While NFM can amount to a breach of FCA rules in any firm, under the current rules, NFM will more commonly breach COCON in a bank than in a non-bank. To address this, yesterday’s publication confirms that the FCA is widening the scope of its rules for non-banks to align the approach across all SM&CR firms and bring more instances of NFM into its regulatory remit.
The NFM rule covers unwanted conduct that has the purpose or effect of violating an individual’s dignity or creating an intimidating, hostile, degrading or humiliating or offensive environment for an individual, or conduct that is violent towards an individual.
The new rule comes into effect on 1 September 2026 and will not apply retrospectively.
Consultation on additional Handbook guidance
The 2023 proposals included new guidance aimed at integrating NFM within the workplace and, in some circumstances, similarly serious behaviour in an individual’s personal or private life, into: (i) F&P assessments (for individuals performing a Senior Management Function or a certification function); (ii) COCON; and (iii) the suitability guidance on the Threshold Conditions for firms to carry on regulated activities.
Yesterday’s consultation sets out amended proposals for potential new Handbook guidance in COCON and the Fit and Proper test for Employees and Senior Personnel (FIT), which aims to make it easier for SM&CR firms to interpret and consistently apply the conduct rules and to clarify statutory and FCA requirements for F&P. The FCA is seeking views on whether additional guidance is needed at all and, if so, on the form it should take. The FCA will only take the guidance forward if there is clear support for it to do so.
The consultation on draft guidance closes on 10 September 2025.
How has the COCON guidance changed since 2023?
In 2023, the FCA made clear that not every instance of misconduct would amount to a breach. Factors to take into account when deciding whether misconduct was serious enough to amount to a breach included whether the conduct was repeated, the duration of the conduct, and the extent of the impact on the subject. Yesterday’s consultation contains new guidance and additional examples, including examples of scenarios illustrating the boundary between work and private life, material about the factors for determining whether NFM is serious enough to amount to a breach, and examples of reasonable steps for managers.
The boundary between work and private life
For instance, misconduct by a manager in relation to a member of the workforce at a social occasion organised by their firm would be in scope of COCON, but misconduct at a social occasion organised by them in their personal capacity would not. What was unclear in 2023 was what the FCA’s stance would be if misconduct occurred at a social occasion that took place after a firm-organised event. The proposed guidance now states that an occasion organised by the manager may be within the scope of COCON, taking into account that the manager’s direct reports may feel obliged to attend. If the event takes place after a firm event but at a separate location or venue, it may be within scope if it is a continuation of the first event or if the conduct started at the first event and continued in the new venue. Otherwise, COCON is likely to cease to apply because the connection between the event and the activities of the firm has been lost.
Further guidance is also provided on the use of social media. The FCA suggests that publishing material on a personal social media account is an example of how it is not possible to give a definitive answer to a scenario based on a single element. However, factors to consider include whether the material is directed at a fellow member of the workforce, whether the content of the social media posts is related to work at the firm, and whether the person uses a work-issued device. The fact that the person uploads the posts during working hours or while on the firm’s premises is not a strong factor pointing towards the application of COCON.
Determining whether NFM is ‘serious’
The use of the term ‘serious’ in COCON meant that the NFM had to have a seriously negative effect to amount to a potential rule breach. Following the 2023 consultation, there were concerns over the subjectivity of the term ‘serious’. Yesterday’s consultation confirms that the use of the term ‘serious’ is aimed at ensuring that minor incidents of poor workplace behaviour were not brought unnecessarily into scope of the FCA’s rules. The FCA has provided more guidance on factors for determining seriousness and the need to take an objective view. The FCA also clarifies that not all misconduct for which a firm might reasonably take disciplinary action under its own disciplinary policy will amount to a breach of COCON. The revised guidance makes it clear that seriousness is not the deciding or distinguishing factor in determining whether NFM is a breach of Conduct Rule 1 (acting with integrity) or Rule 2 (acting with due skill, care and diligence). In line with regulatory law, only deliberate or reckless misconduct is considered a breach of Rule 1. This means that in the absence of those factors, NFM is likely to be a breach of Rule 2.
Reasonable steps for managers
The FCA makes clear in the updated guidance that a manager should try to prevent harassment and other kinds of misconduct and will not be in breach of Conduct Rule 2 if they have acted reasonably. Examples of conduct by a manager that might be a breach include failing to intervene to stop such behaviour where appropriate if the manager knows or should know of it and failing to take seriously or to deal appropriately with complaints of behaviour. The wider context is important here, for example any limits or constraints on a manager’s ability to act if it is the firm’s policy that the HR function deals with allegations of misconduct.
How has the FIT guidance changed since 2023?
FIT sets out factors to which the FCA and firms should have regard when assessing whether an individual is fit and proper to perform their role.
In 2023, the FCA proposed that serious NFM in work and personal life could be relevant to F&P assessments. The rationale used was: (i) the risk that if conduct occurred at work it could go to F&P; (ii) the conduct may show that the individual lacks moral soundness, rectitude and steady adherence to an ethical code, which in turn raises doubts as to whether they will follow the requirements of the regulatory system; or (iii) conduct that is so disgraceful or morally reprehensible or otherwise sufficiently serious could undermine public confidence in the financial sector. According to the FCA, there was considerable support for its 2023 FIT proposals. However, key concerns included how the FCA would expect firms to deal with NFM in private life, the intersection between work and private life and the language used in the FCA’s draft instrument.
NFM in private life
In the new draft guidance, the FCA makes it clear that a firm will normally rely on formal findings, such as criminal convictions or the findings of a court, tribunal, regulator, arbitrator, public enquiry or other body, when assessing whether wrongdoing in private life has taken place. The FCA also clarifies that it does not expect firms to monitor their employees’ private lives to identify anything that is relevant to fitness. However, a firm may become aware of information about an individual’s private life that would – if substantiated – call into question their F&P. In these circumstances, the firm should consider what steps it can reasonably take to assess the possible impact, such as asking for an explanation from the member of staff where appropriate.
As above, social media activity may be relevant to F&P for the same reasons as other conduct. The FCA makes clear that, in principle, a person can lawfully express in their private or personal life their views on social media, even if those views are controversial or offensive and even if work colleagues are upset by those views, without calling into question their fitness under FIT. However, if a person’s social media activity in their private life indicates a real risk that the person will breach the requirements and standards of the regulatory system, then such activity will be relevant to their F&P. Examples could include threats of violence or clear involvement in criminal activities.
Subjective language and technical detail
Terms used in 2023 such as ‘moral soundness’ and ‘disgraceful’ have been replaced with more neutral language in yesterday’s publication and the FCA has also included more examples of the types of conduct both inside and outside work or a regulated role that may be relevant to F&P, such as conduct that is dishonest or shows a lack of integrity as well as repeated minor breaches of law.
Proposals not taken forward
In 2023, the FCA proposed to extend the guidance on the Suitability Threshold Condition in its COND sourcebook to make it clear that NFM and discriminatory practices in firms are relevant to its assessment of their suitability to undertake regulated activities. It also consulted on updating the guidance around regulatory references in SYSC to make it clear that it might be necessary to provide information on NFM or misconduct outside work to a firm requesting a reference.
Having considered the feedback, the FCA has decided not to proceed with its proposals for COND or SYSC. In relation to SYSC, the FCA’s existing rules on regulatory references require firms to disclose all breaches of the conduct rules for which disciplinary action was taken. Similarly, firms are required to provide any other information they reasonably believe to be relevant to the F&P assessment.
Comment
In 2023, the FCA and PRA set down a clear marker that they considered NFM as misconduct for regulatory purposes and that even conduct that occurs outside of the workplace could be relevant in certain circumstances. That was a significant, albeit not surprising, confirmation of the regulators’ approach. Yesterday’s publication only serves to underline the importance of NFM not just for banks, but for all firms bound by the SM&CR regime. Affected firms should consider taking steps now to ensure compliance ahead of the new rules taking effect next year.
For more information on the regulators’ approach to NFM and how these changes may affect your firm and its staff, please speak to the authors of this blog post or your usual Freshfields contact.