Just in time for party season… non-financial misconduct finalised guidance for financial services is published

On 9 December 2025, the FCA published Policy Statement PS25/23 finalising Handbook guidance on non-financial misconduct (NFM) in financial services, alongside amendments to COCON and FIT under the Senior Managers and Certification Regime (SM&CR).

The guidance largely reflects proposals set out in its July 2025 CP25/18 consultation with some helpful (and some unhelpful) changes of note.

Key takeaways for COCON guidance

1. Implementation date: The guidance (COCON and FIT) will come into force on 1 September 2026. This is the same date as the new COCON scope rule (COCON 1.1.7FR) for non banks (the New Rule). The FCA is publishing the guidance now so that firms have time to prepare.
2. Is there retrospective application?: The paper makes it clear that the FCA does not expect firms to revisit past assessments or take retrospective action.
3. What about PRA proposals?: The PRA is not taking forward its CP18/23 proposals and will expect dual regulated firms to consider the FCA’s guidance when assessing fitness and propriety. This is a good outcome for firms who were potentially facing the challenge of two different sets of rules to navigate.
4. Is there a clear definition of NFM for firms?: Not really. The Guidance flags that it can be a "wide range of behaviour, essentially any misconduct not of a clearly financial nature". It specifically highlights behaviour that can be described as 'bullying, harassment, being offensive or insulting or causing distress and similar behaviour' (which is in line with employment law concepts). However there is also reference to 'misconduct of these kinds, and other forms of NFM' which is arguably less than clear and the FCA has also said that they use 'harassment' and 'bullying' as shorthand for misconduct within scope of the New Rule .
5. Scoping is key: The FCA has confirmed that the New Rule aligns the bank and non-bank position for NFM (with some careful nuance for non-banks – conduct in non-banks is not in scope of the New Rule if it does not relate to SMCR financial activities). The New Rule does not apply to banks, although the FCA has said that banks should take the New Rule into account as guidance. The FCA has also included new flowcharts into the Handbook with the aim of helping firms determine whether behaviour is in scope of COCON, particularly in relation to territoriality, professional/private life and harassment. Some firms will find these useful, particularly where they are broken down by firm type, however for others they won't necessarily answer the specific question.
6. What ICRs could harassment breach?: FCA has inserted that “harassment of a fellow member of the workforce” is an example of misconduct that may breach either ICR1 (integrity) or ICR2 (due skill, care and diligence).
7. Managers' responsibilities: Guidance now clarifies that managers in IC2 is not limited to 'line managers' and should be construed more broadly. There is also greater clarity on when a manager may be in breach of IC2 and what steps managers should take to prevent and respond to NFM, including intervening when they are aware or reasonably should be aware, operating relevant systems and controls, and fostering a safe speak up environment. The FCA confirms that managers’ accountability is limited by knowledge and authority, and it would not expect a manager to be held responsible where they could not reasonably have known or lacked authority to act.

What changes in FIT

FIT guidance generally remains the same as previously published with some notable exceptions:

• There are references to the need for matters to be material for them to be relevant. The FCA notes that a material risk is one that is not remote or speculative but there will still be a role for firms to play to decide such materiality threshold in specific cases.
• Similarly, references to repeated driving offences as an example of lack of F&P have been removed. 
• Conduct in someone's private life is relevant to F&P if it indicates a non remote, non speculative material risk of breaching regulatory standards if it were repeated at work, or is so serious that it risks damaging public confidence. Custodial sentences are likely to be significant, subject to rehabilitation and context. However, the FCA has highlighted that it should not be automatically assumed that conduct by an individual in their private life will be repeated at work.
• The FCA confirms that firms are not expected to proactively monitor staff but should consider investigations where there is a good reason, avoiding trivial, implausible or non material allegations, and complying with applicable law.
• The FCA refines guidance on unproven allegations and notifications under SUP 10C.14.18R by removing text that was most concerning to respondents, while retaining the cross reference to the notification rule, and reiterates how to treat ongoing investigations on Form D.
• On social media, the FCA confirms that the materiality threshold is the same as for other private life conduct (i.e. social media activity will be relevant to F&P if it indicates a material risk that they will breach regulatory requirements). 

The guidance in COCON and FIT comes into force on 1 September 2026 and firms will need that time to prepare for the clarified scope of COCON rules. In particular:

• For non-banks, there will be work to do on scoping.
• For banks and non-banks, employee and compliance handbooks will need to be updated.
• F&P processes will need to be revisited.
• Policy framework reviews undertaken;
• Training programmes planned and rolled out;
• A communication strategy developed.

2026 is going to be a busy one!