Every small FCA firm now needs an NFM investigation process. ConductLog is building yours.

FCA PS25/23 has, since 1 September 2026, extended the COCON conduct rules (new rule COCON 1.1.7FR) to firms holding a Part 4A permission that are not banks, building societies, or credit unions. Your firm must be able to identify, investigate, log, and report serious non-financial misconduct — bullying, harassment or violence against colleagues with a sufficient work-related link. Separately, FIT lets firms consider any relevant misconduct, wherever it occurs, when assessing an individual's fitness and propriety status. You also need to maintain audit-ready records for FCA review.

The six individual conduct rules (COCON 2.1.1R to 2.1.6R) apply to all conduct rules staff at firms in scope of PS25/23. Rule 1 (acting with integrity) and Rule 2 (acting with due skill, care, and diligence) are most relevant to NFM allegations. Senior managers also face four additional senior manager conduct rules under COCON 2.2 (SC1-SC4) regarding effective control, regulatory compliance, delegation and disclosure.

Serious non-financial misconduct is a relevant factor when assessing whether someone is fit and proper to hold a regulated role. The criteria sit in FIT 2.1 (honesty, integrity and reputation) — FIT 2.2 is competence and capability — and since 1 September 2026 FIT 2.1.3G expressly includes findings of harassment, bullying, victimisation or discrimination. FIT is wider than the COCON rule: the FCA says it "allows firms to consider any relevant misconduct, wherever it occurs". If an investigation finds misconduct occurred, the firm must decide whether this affects the individual's F&P status — which may require updating their SMCR certification or notifying the FCA if they hold a senior manager function.

The FCA does not mandate specific software. You can comply using paper records, Word documents, or spreadsheets alongside the FCA's published guidance in PS25/23 Appendix 1. However, a dedicated tool can provide a structured investigation workflow, embedded COCON rule mapping, and generate audit-ready documentation — reducing the risk of procedural errors that could draw regulatory scrutiny. ConductLog is planned to work this way; it is not yet available to buy.

The extended COCON conduct rules came into effect on 1 September 2026. Firms in scope must now be able to handle non-financial misconduct allegations in line with the new requirements. There was no transitional period.

Firms that cannot demonstrate appropriate processes for handling NFM allegations risk FCA enforcement action. This could include fines, restrictions on business activities, or individual regulatory sanctions for senior managers under the Senior Managers Regime. The FCA has signalled that it will assess firms' readiness to manage non-financial misconduct as part of its supervisory approach.

Planned pricing starts from £24/month — less than a single hour of compliance consultant time. Join the waitlist to be notified about launch pricing — waitlist members hear about pricing first.

ConductLog is built by Crocker Digital Ltd (Company No. 17008789), a UK software company focused on compliance tools for regulated industries. The product is purpose-built for small FCA-regulated firms, not a repackaged enterprise platform.