Last Reviewed, and What This Page Is Not
Last reviewed: 17 September 2026. Every statement about the rules was checked that day against the FCA page on non-financial misconduct (last updated 1 September 2026), Policy Statement PS25/23, CP25/18, PS26/6 on the SM&CR review, and the FCA Handbook. PS26/6 belongs on that list because it also changed COCON and SUP 15.11, most of it from 24 April 2026.
Scope, breaches, notifications and references belong with your compliance and legal functions, and the Handbook text is the authority, not this summary.
What Changed on 1 September 2026
The FCA's own summary is brief. New rules and guidance to help tackle non-financial misconduct came into effect on 1 September 2026, and it describes non-financial misconduct as including behaviour that is not of a clearly financial nature such as bullying, harassment and violence.
The core change is a new rule, COCON 1.1.7FR. It applies to an SMCR firm other than an SMCR banking firm and extends the scope of COCON. At non-banks the conduct rules apply primarily to the firm's financial services activities, which made it harder to show that bullying, harassment or violence was, in each case, linked closely enough to be covered. Banks already had the wider scope. Two papers are involved and it is easy to cite the wrong one: the rule was made alongside CP25/18, while PS25/23 finalised the guidance that explains it.
The conduct covered is unwanted conduct with the purpose or effect of violating a person's dignity, or of creating an intimidating, hostile, degrading, humiliating or offensive environment for them, and conduct that is violent to them. The people protected run from employees of the firm or its group to people who provide services to it. Conduct relating only to a part of the business with no SM&CR financial activities stays outside, and the rule is not retrospective.
What Counts, and What Does Not
The rule only covers conduct that is serious (COCON 4.3.7G). That is not a separate, higher threshold invented for non-financial misconduct: the seriousness sits in the wording of the rule itself, and PS25/23 says the threshold is aligned with the one for harassment in the Equality Act. It also says the FCA would treat a firm's reasonable judgement on whether misconduct is serious enough to breach the rules as compliant. The factors it takes into account include:
Being in scope is not the same as breaching a rule. COCON 4.3.3G sets out two steps: the conduct has to be of the type described in COCON 1.1.7FR(4), and it has to involve a lack of integrity, for individual conduct rule 1, or a failure to act with due skill, care and diligence, for rule 2. COCON 4.3.19G to 4.3.23G explain both, and COCON 4.3.4G points to flow diagrams that walk through the same steps.
Three further points matter. Effect is tested both ways: how the person experienced the conduct, and whether it was reasonable for it to have that effect. Purpose counts on its own, so a hostile message intercepted before it arrives can still come within the rule. And a single incident can be enough, as can the effect on a witness, while the absence of a formal complaint does not generally make conduct less serious.
Private life stays out of scope, though the table at COCON 1.3.7G treats misconduct towards a colleague while working remotely, or at a firm social occasion, as generally within scope, and one organised by a manager may be, because their direct reports may feel obliged to attend.
- whether the conduct is repeated or part of a pattern, and its duration
- the size of the impact, which the guidance limits to effects that are serious and marked
- the seniority of the person in question, the seniority gap, and whether they have control or influence over the other person's career
- whether they have been warned or disciplined for similar conduct before
- whether the conduct is criminal or would justify dismissal
What the Guidance Expects of Managers
This is the part that reaches past the person who behaved badly to the person who manages them. Individual conduct rule 2 reads: you must act with due skill, care and diligence. The guidance at COCON 4.1.8-AG to 4.1.8-DG says a manager should try to prevent harassment and similar misconduct, and lists what would breach rule 2:
The limits are written in as clearly as the duties. A manager will not be in breach of rule 2 if they have acted reasonably, and there will often be several reasonable courses of action. The FCA will consider what constrained them: policies set elsewhere in the firm or group, whether they had authority in the case, or a policy that the human resources function deals with allegations. PS25/23 adds that it would not expect a manager to be responsible for failing to stop misconduct they could not reasonably have known about.
Manager is not limited to a line manager (COCON 4.1.3AG), and giving responsibility for fair treatment of staff to one senior manager or a central function does not absolve other managers of their regulatory responsibilities.
- failing to take reasonable steps to protect staff, including failing to intervene to stop such behaviour where appropriate if the manager knows or should reasonably have known of it
- failing to operate the firm's policies, systems and controls appropriately to detect and prevent it, and, with sufficient authority, to set them up and maintain them
- failing to take complaints of such misconduct seriously or to deal with them appropriately
- failing to take reasonable steps to provide a safe environment for people to raise concerns
Two Regimes, Kept Apart
Firms under these rules are also employers under the Equality Act 2010, and it is tempting to treat both as one topic. The FCA does not. PS25/23 says its approach aligns with, but does not duplicate, employers' obligations under the Equality Act and the sexual harassment duty introduced by the Worker Protection (Amendment of Equality Act 2010) Act 2023, and that its power to make conduct rules comes from section 64A of the Financial Services and Markets Act 2000, not from employment legislation.
Section 40A of the Equality Act 2010 is a duty on the employer about sexual harassment of its employees, enforceable by the Equality and Human Rights Commission, or by an employment tribunal only as a compensation uplift under section 124A where a sexual harassment claim succeeds. COCON holds individuals to account, covers bullying, harassment and violence more broadly, and sits with the FCA. That employer duty is the subject of our harassment prevention training page; on how the two regimes relate, the FCA's own words are the ones quoted above.
What HR Is Asked to Review
The FCA says firms should have considered whether to update their approach to staff policies, conduct breach reporting, fit and proper assessments and regulatory references, and should ensure staff and managers understand how the changes apply to them.
Breach reporting is where a manager's first handling can matter later, and there is more than one route. Under section 64C FSMA a firm must notify the FCA when it takes disciplinary action against conduct rules staff for a breach, meaning a formal written warning, suspension or dismissal, or reduction or recovery of remuneration. PS25/23 says misconduct dealt with informally or through lesser disciplinary measures is not reportable that way. That is not the only way. SUP 15.11.6CG says a firm may have to report a COCON breach under Principle 11 or SUP 15.3.11R even though it does not have to report it under section 64C, and SUP 15.3.11R requires immediate notification of a significant breach of a COCON rule. Which route applies sits with your compliance function, not with the manager holding the conversation.
The FCA also says firms do not need to check past breach decisions retrospectively, revise past fitness and propriety assessments, monitor private lives or social media, or investigate trivial, implausible or irrelevant allegations about them. Fitness and propriety under FIT operates separately from COCON and is not covered here.
Training: What the FCA Material Says, and What It Does Not
Neither the FCA's page on non-financial misconduct nor PS25/23 sets out a training requirement for these rules. When respondents asked for templates and training materials, the FCA answered that guidance cannot cover every scenario and encouraged firms to keep working with their trade associations and industry standard setters.
One general duty is worth knowing, and it is put more firmly than a passing mention. Under section 64B FSMA a firm must take all reasonable steps to make sure conduct rules staff understand how the conduct rules apply to them. The Handbook guidance on that duty, COCON 2.3.2G, says the steps a firm must take include the provision of suitable training, covering all of COCON in outline and the rules relevant to a person's work in more depth. Since 1 September 2026 COCON includes the new rule. That is a general duty on the firm about the conduct rules, not a training requirement specific to non-financial misconduct, and it prescribes no format, length or provider.
Our own position, plainly: we do not claim that any course, ours included, discharges a regulatory duty. COCON 1.1.7FR sets the scope of the conduct rules for individuals, and the duties that sit with the firm stay there. What rehearsal offers is narrower, a place to practise the conversations the guidance describes.
Where Managers Actually Get Stuck
Some things cannot be read off a policy, they have to be practised, especially when the subject is a colleague's behaviour. The guidance describes outcomes: intervene, take the complaint seriously, keep it safe to raise concerns. Most of that happens in conversations, in real time, and three moments carry most of the weight.
The first conversation after someone raises a concern. Whether a complaint was taken seriously shows early: whether the manager listens without cross-examining, is honest about what can stay confidential, explains what happens next and who owns it under the firm's policy, then follows through. Under pressure, the unpractised version drifts towards reassurance or towards doubt.
Raising behaviour with a high performer. The seriousness factors include seniority and influence over a career, and COCON 4.3.24G says that once a person has been warned about behaviour, or someone has complained to them about it, it is less likely they could reasonably think it justified. Naming it early, specifically and without turning it into a joke is the conversation most worth rehearsing.
Making reasonable steps traceable. The guidance prescribes no record, but it names what the FCA takes into account: what the manager knew or should reasonably have known, whether they had authority, and who deals with allegations under the firm's policy. A short, factual note made at the time, and a clean handover to the function your policy names, answer that better than memory.
How Sidestream Rehearses These Moments
Sidestream is a behaviour change consultancy, and the method is rehearsal with professional actors. An actor plays the colleague who discloses, or the senior performer who does not see a problem. Managers handle the conversation live, stop, take feedback and try again. Scenarios are built from the organisation's own material, so the firm's policy, escalation route and internal ownership frame what gets practised.
A typical format is a half-day of four hours with 12 to 25 participants. It can sit alongside work on speak-up culture, since a safe environment to raise concerns is the same ground, or on the ordinary management conversations covered in new manager training. Work is priced per engagement, and progress is read at Kirkpatrick Level 3, as observed behaviour at work.
The evidence for the format is modest. In a randomised 2020 UCL study by co-founder Ben Laumann (n = 57), people who rehearsed a feedback conversation with a role-play coach delivered it significantly better than those taught by slideshow or video, rated blind by two independent assessors (Cohen's d = 0.75 against slides, 1.08 against video). The practice condition was a short online coaching session on one feedback model, not a Sidestream programme and not a misconduct conversation. Design and limits are on our research page.
FCA Non-Financial Misconduct Rules for Managers: In Short
Since 1 September 2026, COCON 1.1.7FR brings serious bullying, harassment and violence towards colleagues within the scope of the conduct rules at non-bank SM&CR firms. Scope is only the first step: a breach also needs a lack of integrity or a failure to act with due skill, care and diligence. PS25/23 names what a manager does that would breach rule 2 and sets limits: acting reasonably is not a breach, and knowledge and authority count. The Equality Act duty is a separate regime, and the FCA material sets no training requirement for these rules.
Frequently Asked Questions
Do the FCA non-financial misconduct rules apply to banks?
The new scope rule, COCON 1.1.7FR, applies to SM&CR firms other than SM&CR banking firms, because the conduct rules at banks already had the wider scope. The guidance in COCON 4.3 on when harassment breaches individual conduct rule 1 or 2 does apply to banking firms.
Is every rude remark now a matter for the FCA?
No. The rule only covers serious conduct, and PS25/23 says minor incidents of poor workplace behaviour that do not have the purpose or effect the rule describes, such as violating dignity or humiliating someone, will not breach it. The FCA says it would treat a firm's reasonable judgement on seriousness as compliant.
Can a manager breach the conduct rules over someone else's behaviour?
Under the new guidance, yes. COCON 4.1.8-BG lists as breaches of rule 2: failing to intervene where appropriate if the manager knows or should reasonably have known, failing to take complaints seriously or deal with them appropriately, and failing to keep it safe to raise concerns. A manager who acted reasonably is not in breach, and authority and firm policy count.
Does the rule apply to conduct before 1 September 2026?
No. The FCA says the rule is not retrospective, and PS25/23 says earlier misconduct should be handled under the Handbook in force at the time. Firms are not expected to check past breach decisions retrospectively. But if a firm notices that it determined a past breach incorrectly under the rules that applied then, it should rectify that notification in line with SUP 15.
Does the FCA require training on non-financial misconduct?
There is no training requirement specific to these rules: neither the FCA's non-financial misconduct page nor PS25/23 sets one. Separately, section 64B FSMA requires a firm to take all reasonable steps to make sure conduct rules staff understand how the conduct rules apply, and COCON 2.3.2G says those steps include the provision of suitable training. That duty is general and covers all of COCON. We do not claim that any course discharges it.
How is this different from the Equality Act duty on sexual harassment?
They are separate regimes. Section 40A of the Equality Act 2010 is a duty on the employer, enforceable by the Equality and Human Rights Commission, or by an employment tribunal only as a compensation uplift under section 124A where a sexual harassment claim succeeds. COCON holds individuals to account and sits with the FCA. Our harassment prevention training page covers the employer duty.
Sources: FCA, Non-financial misconduct in financial services (last updated 1 September 2026) · FCA, PS25/23: Tackling non-financial misconduct in financial services (December 2025) · FCA, CP25/18: Tackling non-financial misconduct in financial services · FCA, PS26/6: Senior Managers and Certification Regime Review (April 2026) · FCA Handbook, COCON 1.1 (COCON 1.1.7FR) · FCA Handbook, COCON 2.3 · FCA Handbook, COCON 4.1 · FCA Handbook, COCON 4.3, Specific guidance on harassment · FCA Handbook, SUP 15.11 · FCA Handbook, SUP 15.3 · Equality Act 2010, section 40A, legislation.gov.uk