Get your firm ready for new rules and guidance to help tackle non-financial misconduct (NFM).
We explain what firms should do before the changes come into effect on 1 September 2026.
What NFM is
Non-financial misconduct includes behaviour that is not of a clearly financial nature such as bullying, harassment and violence.
Where NFM is serious and goes unchecked, it can harm individuals, firms and confidence in financial services.
How NFM is covered by our requirements
Code of Conduct (COCON) rules
A new rule, COCON[1] 1.1.7FR, will extend the scope of the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues, where it relates to an individual’s role.
The new rule will apply where there is a sufficient work-related link.
It will not apply retrospectively or extend our regulatory remit beyond Senior Managers and Certification Regime (SM&CR)[2] financial activities.
Fit and Proper test (FIT)
FIT[3] already allows firms to consider any relevant misconduct, wherever it occurs, when assessing fitness and propriety.
COCON and FIT operate separately. The new COCON rule focuses on certain work-related misconduct, while the new FIT guidance clarifies how firms can take a broader range of NFM into account when assessing fitness and propriety.
New guidance
We have published new Handbook guidance (PS25/23[4]) to help firms apply COCON and FIT with clarity and confidence, reducing the need for external advice.
The guidance, which was strongly supported by respondents to our consultation, covers:
- The boundary between work and private life.
- How NFM can breach the conduct rules.
- Reasonable steps for managers.
- Fitness and propriety assessments, including private life, social media and unproven allegations.
The new rules and guidance will come into effect on 1 September 2026.
What firms should do
Before 1 September 2026, firms should review whether they need to update their approach to:
- Staff policies.
- Conduct breach reporting.
- Fit and proper assessments.
- Regulatory references.
Firms should also ensure staff and managers understand how the changes apply to them.
What firms do not need to do
- Carry out retrospective analysis to check whether they correctly determined past conduct rule breaches.
- Revise past fitness and propriety assessments.
- Monitor employees’ private lives or social media accounts.
- Investigate allegations about employees’ private lives if they are trivial, implausible or irrelevant.
- Do anything contrary to privacy, employment or other relevant law.
