FCA Non-Financial Misconduct: What Boards Must Act On Now

From 1 September 2026, bullying, harassment and violence constitute FCA conduct rule breaches — and 37,000 SMCR firms must act now to ensure their governance frameworks are ready.

What Does the FCA’s Non-Financial Misconduct Framework Actually Require?

The FCA’s Policy Statement PS25/23, published on 12 December 2025, finalises the regulatory framework for non-financial misconduct (NFM) in SMCR firms. From 1 September 2026, the FCA’s Code of Conduct (COCON) sourcebook is amended to make it explicit that serious bullying, harassment or violence by individuals subject to COCON constitutes a conduct rule breach — with all the personal regulatory consequences that follow. This is not a guidance update. It is a change to the rules, with direct regulatory accountability for senior managers who fail to establish and maintain adequate NFM governance frameworks.

The FCA’s rationale is clear: culture is a leading indicator of conduct risk. Regulators have repeatedly found that firms with poor internal cultures — particularly those that tolerate non-financial misconduct — are also more likely to produce poor consumer and market outcomes. NFM policy is therefore embedded in the FCA’s broader conduct and culture supervisory framework, not treated as a standalone HR matter.

Executive Action

• Review PS25/23 and the amended COCON sourcebook with your Chief Compliance Officer and General Counsel to confirm your firm’s specific obligations from 1 September 2026.
• Assess whether your current NFM policies, definitions and reporting channels meet the specificity required by the FCA’s new guidance — generic harassment policies are insufficient.
• Brief your board on the regulatory characterisation of NFM: this is now a conduct rules matter, not solely an HR or employment law matter.

Which Firms Are in Scope and What Changes on 1 September 2026?

Approximately 37,000 Senior Manager and Certification Regime (SMCR) firms — including investment managers, insurance firms, consumer credit firms, payment service providers and other FCA-regulated non-banks — will fall under the new NFM rules from 1 September 2026. Banks and dual-regulated PRA firms were already subject to equivalent NFM expectations; the September 2026 changes create parity across the full SMCR population.

According to Ropes & Gray’s April 2026 regulatory analysis, the FCA’s new NFM regime extends the scope of COCON in non-banks so that NFM rules will apply equally and without the previous ambiguity about whether non-financial conduct fell within the code. From 1 September, the definition of a COCON breach explicitly includes conduct that amounts to serious bullying, harassment or violence — whether in the workplace, at work-related events or, in certain circumstances, outside the workplace where the conduct affects the firm or its staff. Firms cannot draw a clean line between workplace and personal conduct.

Executive Action

• Confirm your firm’s SMCR category and identify all individuals subject to COCON — the NFM rules apply to Senior Managers and Certified Persons, not solely to the most senior executives.
• Review your firm’s NFM policy scope to ensure it addresses work-related events and, where relevant, external conduct — the FCA’s guidance is deliberately broad.
• Assess your current investigation and decision-making process for NFM incidents — the FCA expects documented, consistent and fair processes, not case-by-case management.

What Must Boards Govern Under the New NFM Framework?

NFM governance is explicitly a board-level responsibility under PS25/23 — not because boards manage incidents operationally, but because the FCA expects boards to set and monitor the cultural and governance conditions that prevent NFM from occurring and ensure it is effectively addressed when it does. According to Dechert’s January 2026 FCA NFM implementation analysis, a key requirement is that boards or relevant governance committees receive regular reports on NFM incidents, investigations, outcomes and cultural indicators. Boards that receive no NFM reporting are operating a governance gap that the FCA would regard as a deficiency in the firm’s SMCR accountability framework.

The board’s specific governance responsibilities include: approving the firm’s NFM policy and risk appetite; receiving regular quantitative and qualitative NFM reporting; satisfying themselves that senior managers are fulfilling their personal obligations under the Conduct Rules; and overseeing the firm’s approach to investigations, sanctions and remediation. This is not an Audit Committee item alone — the full board must be engaged.

Executive Action

• Establish a board-level NFM reporting framework now: define the metrics, reporting frequency and escalation thresholds that will feed into board packs from September 2026.
• Ensure the board formally approves the firm’s NFM policy, risk appetite and investigation framework before the September 2026 effective date — not as a paper exercise, but as a substantive governance decision.
• Include NFM performance indicators alongside other culture metrics in your quarterly board pack — the FCA will assess board oversight through supervisory engagement and skilled person reviews.

How Should Firms Build Their NFM Governance Framework Before September 2026?

Building an FCA-compliant NFM governance framework requires action across four dimensions: policy, process, reporting and culture. On policy, firms must have a clearly defined NFM policy that specifies what behaviours constitute misconduct, how incidents should be reported, who is responsible for investigations and what sanctions apply — with explicit linkage to the COCON Code of Conduct obligations of SMCR-registered individuals. On process, firms must establish documented, consistent and auditable investigation processes that meet standards of natural justice — the FCA’s guidance makes clear that NFM processes must be robust enough to withstand regulatory and employment tribunal scrutiny simultaneously.

On reporting, firms must build clear escalation pathways from line management to senior management to the board, with documented thresholds for what triggers escalation. On culture, firms should conduct a culture assessment before September 2026 to identify where NFM risks are most acute — particular attention should be given to high-pressure trading environments, client entertainment contexts and remote working arrangements where informal conduct is less visible. The INFORMD governance assessment tools provide a structured approach to benchmarking your firm’s governance framework against regulatory expectations. Access the executive briefing library for additional FCA conduct and culture briefings.

Executive Action

• Commission a gap analysis of your current NFM policy and process against the FCA’s PS25/23 requirements before the end of Q3 2026 — do not wait until the deadline has passed.
• Train all Senior Managers and Certified Persons on their individual COCON obligations regarding NFM — the FCA will hold individuals, not just firms, to account.
• Document your investigation process for NFM incidents in writing and have it reviewed by employment law counsel and your compliance function before September 2026.

What Are the Personal Accountability Risks for Senior Managers?

Under the SMCR, Senior Managers bear personal regulatory accountability for the functions within their Senior Management Function (SMF) allocation. Where NFM occurs within a Senior Manager’s area of responsibility and the Senior Manager has failed to take reasonable steps to prevent it — or has failed to establish adequate governance frameworks — the FCA can take enforcement action against the individual, not just the firm. Enforcement outcomes can include public censure, financial penalties and prohibition from performing regulated functions.

The Prescribed Responsibilities allocated under SMCR include responsibility for the firm’s culture and behaviours — in many firms, this sits with the CEO or a senior board-level executive. That individual faces direct personal accountability if the firm’s NFM governance framework is found to be deficient by the FCA in a post-September 2026 supervisory review or investigation. Use the INFORMD accountability framework template to map your firm’s SMF responsibilities against NFM governance obligations before the deadline.

Executive Action

• Map your firm’s SMF allocations against NFM governance responsibilities and confirm which Senior Manager holds personal accountability for culture and conduct — this individual must be personally briefed on PS25/23 requirements.
• Ensure your Statements of Responsibilities (SoRs) are updated to reflect NFM governance obligations — the FCA uses SoRs as the primary accountability map in enforcement.
• Seek independent legal advice on your firm’s NFM governance readiness before September 2026 — self-assessment alone is insufficient for this category of regulatory risk.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.