The FCA's New Non-Financial Misconduct Rules: What Changes on 1 September 2026
On 1 September 2026, the UK Financial Conduct Authority's expanded non-financial misconduct regime takes effect, requiring nearly 40,000 firms — including hedge funds, insurers, pension funds, and brokers — to report serious wrongdoing to the regulator. The rules extend conduct obligations that previously applied mainly to banking firms to any company bound by the FCA's Senior Managers and Certification Regime (SM&CR), a framework that holds senior individuals personally accountable for failures within their areas of responsibility. (The Guardian)
Under the new framework, firms must report serious instances of non-financial misconduct — including bullying, harassment, sexual harassment, racism, violence, and intimidation — to the FCA. The specific conduct rule, COCON 1.1.7FR, extends the scope of conduct rules in non-banking firms to cover these categories of behaviour. (FCA Handbook) Firms are also required to pass on reports of misconduct to a manager's prospective future employer, a mechanism designed to prevent what the FCA calls "rolling bad apples" — individuals responsible for misconduct moving to new firms without consequences. (The Guardian)
The FCA formalised the regime through policy statement PS25/23, titled "Tackling non-financial misconduct in financial services," which updated the Handbook with guidance for firms applying the rules. The regulator had earlier published a culture and non-financial misconduct survey finding that bullying and harassment accounted for 26% of reported misconduct across all sectors, with discrimination at 23%. In a February 2025 speech titled "Culture is contagious," the FCA stated that non-financial misconduct such as bullying, harassment, and discrimination is one of the clearest warning signs of a failing culture. (FCA, FCA)
Jill Lorimer, a financial regulation partner at Kingsley Napley, confirmed that regulated firms are preparing for the September implementation date. The compliance burden is substantial: firms within scope must establish or update internal reporting mechanisms, train staff on the expanded conduct rules, and implement processes for disclosing misconduct histories to prospective employers. (The Guardian)
The backdrop to the new regime includes several high-profile cases. John Neal, former CEO of Lloyd's of London, failed to disclose a "close relationship" with a female colleague. Lloyd's subsequently acknowledged that whistleblower reports dating back to 2023 had been mishandled, constituting a breach of its own governance rules. Separately, last year judges upheld an FCA decision to ban former Barclays chief executive Jes Staley from holding a senior finance industry role after he was found to have misled the regulator over his relationship with Jeffrey Epstein. (The Guardian)
The broader context here is that the FCA is using the SM&CR's personal accountability architecture — originally designed for prudential and market-integrity failures — to enforce cultural standards across the financial services sector. The extension to non-banking firms means that hedge funds, insurers, and pension providers, which may have operated under less detailed conduct regimes, are now subject to the same individual accountability framework as deposit-taking institutions. The reference requirement adds a dimension of cross-firm transparency that did not previously exist in a systematic, regulator-mandated form.
For firms, the practical stakes are twofold. First, the reporting obligation creates a documentary trail that the FCA can use in enforcement actions against both firms and individuals under SM&CR certification. Second, the requirement to disclose misconduct to prospective employers shifts reputational risk into a formal, structured process, raising questions about how firms balance their disclosure obligations against defamation and data protection considerations. The FCA Handbook's COCON 4 chapter provides guidance describing behaviour that can broadly be characterised as bullying, harassment, being offensive or insulting, or causing distress, but firms will need to exercise judgment in applying these definitions to specific cases. (FCA Handbook)
The regime's effectiveness will depend on enforcement posture and the degree to which firms internalise the reporting culture the FCA is seeking to embed. The survey data suggesting that bullying, harassment, and discrimination already account for a significant share of reported misconduct indicates that the problem the rules address is not theoretical. Whether the new obligations meaningfully change behaviour or primarily formalise existing practice is an open question that the FCA's own supervisory and enforcement activity in the coming months will help answer.
