September 2026: every small FCA firm needs an NFM investigation process. Here's yours.

FCA PS25/23 extends the COCON conduct rules to all non-bank FSMA-authorised persons from 1 September 2026. Your firm must be able to identify, investigate, log, and report serious non-financial misconduct including bullying, harassment, discrimination, and sexual misconduct. You also need to assess whether misconduct affects an individual's fitness and propriety status, and maintain audit-ready records for FCA review.

The six individual conduct rules (COCON 2.1.1R to 2.1.6R) apply to all conduct rules staff at firms in scope of PS25/23. Rule 1 (acting with integrity) and Rule 2 (acting with due skill, care, and diligence) are most relevant to NFM allegations. Senior managers also face additional rules under COCON 3.1 regarding effective control and regulatory compliance.

Under FCA FIT 2.2, serious non-financial misconduct is a relevant factor when assessing whether someone is fit and proper to hold a regulated role. If an investigation finds misconduct occurred, the firm must decide whether this affects the individual's F&P status — which may require updating their SMCR certification or notifying the FCA if they hold a senior manager function.

The FCA does not mandate specific software. You can comply using paper records, Word documents, or spreadsheets alongside the FCA's published guidance in PS25/23 Appendix 1. However, a dedicated tool provides a structured investigation workflow, embedded COCON rule mapping, and generates audit-ready documentation — reducing the risk of procedural errors that could draw regulatory scrutiny.

The extended COCON conduct rules come into effect on 1 September 2026. From that date, approximately 37,000 non-bank FCA-regulated firms must be able to handle non-financial misconduct allegations in line with the new requirements. There is no transitional period — firms must have their processes in place by the effective date.

Firms that cannot demonstrate appropriate processes for handling NFM allegations risk FCA enforcement action. This could include fines, restrictions on business activities, or individual regulatory sanctions for senior managers under the Senior Managers Regime. The FCA has signalled that it will assess firms' readiness to manage non-financial misconduct as part of its supervisory approach.

Planned pricing starts from £24/month — less than a single hour of compliance consultant time. Join the waitlist to be notified about launch pricing — waitlist members hear about pricing first.

ConductLog is built by Crocker Digital Ltd (Company No. 17008789), a UK software company focused on compliance tools for regulated industries. The product is purpose-built for small FCA-regulated firms, not a repackaged enterprise platform.