FCA PS25/23: The September 2026 Deadline Every Small Firm Should Know

FCA PS25/23 takes effect on 1 September 2026. From that date, approximately 37,000 non-bank FCA-regulated firms (per the FCA's impact assessment) must be able to handle serious non-financial misconduct allegations under the extended COCON conduct rules. There is no transitional period.

If you run a small IFA, mortgage broker, insurance broker, or wealth management firm, this guide covers what PS25/23 is, what it requires, and a practical timeline for getting ready.

What is PS25/23?

PS25/23 is a policy statement published by the FCA on 12 December 2025. It introduces guidance and a new rule (COCON 1.1.7FR) that makes explicit how non-financial misconduct relates to the existing COCON conduct rules.

The work originated from Consultation Paper CP23/20 on diversity and inclusion in financial services, published in September 2023. The FCA subsequently narrowed its focus to non-financial misconduct and published a dedicated consultation, CP25/18, in July 2025. PS25/23 is the policy statement that followed CP25/18, confirming the final rules and guidance on tackling NFM.

Key dates

Date	Event
September 2023	CP23/20 consultation on diversity and inclusion published
July 2025	CP25/18 consultation on tackling non-financial misconduct published
12 December 2025	PS25/23 published — final rules and guidance
23 December 2025	Editorial amendment
23 March 2026	FCA guidance page on non-financial misconduct published
1 September 2026	COCON 1.1.7FR takes effect — compliance required

Who is in scope?

PS25/23 applies to all firms with Part 4A permission from the FCA that are not banks, building societies, or credit unions. In practical terms, this covers:

Independent Financial Advisers (IFAs)
Mortgage brokers and advisers
Insurance brokers
Wealth managers and financial planners
Investment firms
Payment services firms
Consumer credit firms
Claims management companies

The FCA's impact assessment estimates approximately 37,000 firms fall within scope. Most small firms (1–50 staff) have not previously dealt with non-financial misconduct as a regulatory matter — it was treated as an HR issue only.

What PS25/23 requires

The obligations are practical, not bureaucratic. Your firm needs:

1. Recognition that NFM can breach conduct rules

Staff must understand that bullying, harassment, discrimination, sexual misconduct, and violence can constitute breaches of individual conduct rules — particularly Rule 1 (integrity) and Rule 2 (due skill, care, and diligence).

2. An investigation process

When a serious NFM allegation is made, your firm needs a process to:

Receive and log the allegation
Investigate the facts
Assess findings against specific COCON rules
Determine whether the finding affects the individual's fitness and propriety under FIT 2.2
Record the outcome
Report conduct rule breaches to the FCA

Our guide on what small firms must do before September 2026 walks through each step in detail.

3. Updated F&P assessments

Serious non-financial misconduct is now explicitly a relevant factor in fitness and propriety assessments. Your annual certification process must account for this. Use our free F&P Decision Tree to understand how to assess F&P impact.

4. Staff training

Staff need to know that non-financial misconduct has regulatory consequences and how to report concerns. Training does not need to be extensive — a 30-minute briefing covering the policy, reporting process, and practical examples is sufficient.

5. Documented policies

Your compliance procedures should cover NFM handling. This can be a section within your existing compliance manual — it does not require a standalone document.

What PS25/23 does NOT require

The FCA has been clear about boundaries. Firms do not need to:

Review past conduct or reassess previous F&P determinations
Monitor staff social media or private communications
Investigate trivial workplace disagreements or personality clashes
Implement surveillance systems
Purchase specific software or templates

You can comply using paper records, Word documents, and the FCA's published assessment logic in PS25/23 Appendix 1. However, having a structured process reduces the risk of procedural errors that could attract FCA scrutiny.

Practical timeline: March–September 2026

Here is a realistic preparation timeline for a small firm:

March–April 2026: Assess your current state

Audit your existing processes. Do you have a documented investigation process for conduct rule breaches? If not, that is your primary gap.
Review your F&P assessment framework. Does your annual certification process include a step for assessing NFM impact?
Check your training. Do staff understand that NFM can have regulatory consequences?

Use our free COCON Conduct Rules Self-Assessment to test whether you can map misconduct scenarios to specific rules.

May–June 2026: Build and document

Write your NFM policy (or add an NFM section to your compliance manual).
Create your investigation process. Document the steps from allegation to outcome. Use our free NFM Investigation Checklist as a starting point.
Update your F&P assessment forms. Add NFM-specific questions to your annual certification process.
Brief your senior managers. They face personal accountability under SC1 and SC2.

July–August 2026: Train and test

Train all staff. Cover what NFM means, how to report concerns, and what happens when an allegation is received.
Run a tabletop exercise. Walk through a hypothetical NFM scenario using your new process end to end. Identify any gaps.
Fix gaps. If the tabletop exercise reveals problems — unclear escalation paths, missing documentation steps, confusion about F&P assessment — fix them before the deadline.

1 September 2026: Go live

From this date, your firm must be able to handle NFM allegations in line with the extended COCON conduct rules. The FCA has signalled it will assess firms' readiness as part of its supervisory approach.

What happens if your firm is not ready?

The FCA has several enforcement tools:

Supervisory action — the FCA may require your firm to take specific remedial steps
Fines — for firms and individuals who fail to meet regulatory requirements
Restrictions on business activities — limiting what your firm can do until compliance is demonstrated
Individual sanctions — senior managers may face personal regulatory consequences under the Senior Managers Regime

The FCA has not yet stated whether it will run specific thematic reviews on PS25/23 readiness, but non-financial misconduct is a stated priority in the FCA's business plan.

The cost of compliance

For a small firm, the direct cost of PS25/23 compliance is modest:

Policy update: 1–2 hours of compliance officer time, or included in your next compliance consultant review
Investigation process documentation: 2–4 hours to build a structured process
Staff training: 30 minutes per person, plus preparation time
Ongoing: Time to handle investigations if allegations arise (variable — most small firms may never have one, but the process must exist)

The significant cost is not money — it is the time to build a robust investigation process and maintain it. That process is what you need when an allegation arrives unexpectedly.

Sources

This guide is for general information only and does not constitute legal or regulatory advice. Last reviewed: 24 March 2026.