FCA Non-Financial Misconduct: First 90 Days

The FCA's non-financial misconduct rules are now live. On its own guidance page the regulator states that "New rules and guidance to help tackle NFM came into effect on 1 September 2026" — and the page carries a 1 September 2026 update stamp confirming it. If your firm holds a Part 4A permission and is not a bank, the conduct rules that apply to your staff changed last week.

The practical change is narrower than most of the pre-deadline commentary suggested, and the FCA has been unusually explicit about what firms are not expected to do. This guide covers what actually changed, the four things the regulator says you can skip, and what a realistic first 90 days looks like at a small firm.

What changed on 1 September 2026

Two things, and they operate separately.

1. A new conduct rule, COCON 1.1.7FR. The FCA describes it as a rule that "extends the scope of the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues, where it relates to an individual's role." The trigger is a work connection: "The new rule applies where there is a sufficient work-related link."

2. New Handbook guidance on fitness and propriety. Separately from COCON, the FCA confirms that "FIT allows firms to consider any relevant misconduct, wherever it occurs, when assessing fitness and propriety" and that "COCON and FIT operate separately."

That separation matters more than anything else in the new material, and it is the point small firms most often get backwards. COCON is narrow — bullying, harassment or violence, against a colleague, with a work link. FIT is broad — any relevant misconduct, wherever it happened. A single incident can therefore be outside COCON but still relevant to whether someone is fit and proper, and the two assessments reach their conclusions on different tests.

The guidance itself came through PS25/23, which set the date: "The guidance will come into force on 1 September 2026 at the same time as the new rule at COCON 1.1.7FR."

What the FCA says you do NOT need to do

This is the part almost nobody wrote about before the deadline, and it is the part that saves a small firm the most work. The FCA's guidance page lists, under "What firms do not need to do":

Carry out retrospective analysis to check whether they correctly determined past conduct rule breaches.
Revise past fitness and propriety assessments.
Monitor employees' private lives or social media accounts.
Investigate allegations about employees' private lives if they are trivial, implausible or irrelevant.
Do anything contrary to privacy, employment or other relevant law.

The regulator also states plainly that the new rule "does not apply retrospectively or extend our regulatory remit beyond Senior Managers and Certification Regime (SM&CR) financial activities."

Read that list against what a lot of firms were being sold in the run-up: social-media monitoring, a re-papering exercise across historic F&P files, a private-conduct policy. None of it is required. If a consultant or a vendor told you otherwise, the FCA's own page is the answer.

The one place to be careful is the word "trivial". The FCA has said you need not investigate allegations about private life that are trivial, implausible or irrelevant — it has not said you may treat a serious allegation as private and therefore out of scope. Deciding which side of that line an allegation falls on is a judgement your firm has to make and record, not one you can avoid making.

What the FCA expects you to have done

The same page sets the other half. Firms "should have considered whether they needed to update their approach to":

Staff policies
Conduct breach reporting
Fit and proper assessments
Regulatory references

and "should also ensure staff and managers understand how the changes apply to them."

Note the tense. That is written as work which should already have happened. If it has not, the honest position at your firm is that you are behind, and the 90-day plan below is a catch-up plan rather than a refinement plan. Both are fine — what is not fine is discovering the gap when an allegation lands.

The first 90 days: September to November 2026

The rules are in force, so this is no longer preparation. The goal for the rest of 2026 is a firm that can handle the first allegation competently and evidence that it did.

Weeks 1-3 (September): confirm scope and close the policy gap

Confirm who is conduct rules staff. Everyone except ancillary staff, in practice, at a small firm. If you have not re-run the mapping since the rules changed, do it now — our COCON Conduct Rules Self-Assessment walks through the classification.
Check your staff policies name the new scope. A dignity-at-work or anti-harassment policy that makes no connection to the conduct rules leaves a gap: staff read it as an HR document, and nothing tells them a breach is also a regulatory matter.
Confirm your breach register can hold an NFM entry. Most small-firm registers were built around financial conduct — suitability, disclosure, conflicts. Add the fields you would need to record a bullying or harassment finding, before you need them.

Weeks 4-8 (October): training and the dry run

Run the training round. Everyone subject to the conduct rules needs to understand how the change applies to their role — the regulator asked for exactly that. Our conduct rules training guide covers what a defensible round looks like and what to capture as evidence.
Dry-run one allegation. Take a plausible scenario, walk it end to end on paper, and see where you stall. Firms almost always stall in the same two places: who investigates when the allegation names the principal, and what gets written down at each step. The NFM Investigation Checklist gives you the sequence to test against, and our guide on handling a harassment allegation works through the practicalities.
Decide your independence answer in advance. At a three-person firm the person who would normally investigate may be the person named. Agreeing now who you would bring in — another director, an external compliance consultant, an employment solicitor — takes an afternoon. Agreeing it while an allegation sits open takes weeks you do not have.

Weeks 9-13 (November): reporting and the F&P join-up

Confirm the reporting routes. Senior Manager conduct breaches go to the FCA as they happen; other conduct rule breaches are compiled for the annual return. Our conduct rule breach reporting guide covers which route applies to which population and when.
Wire NFM findings into the F&P cycle. Because COCON and FIT operate separately, an NFM finding needs to arrive at the annual fitness-and-propriety assessment as an input in its own right. Our F&P assessment guide sets out the mechanics, and the F&P Decision Tree helps with the "does this actually affect fitness?" question.
Check your regulatory reference process. A conduct rule breach finding is disclosable in a reference for that individual — see our regulatory references guide. A firm that reaches a finding and then gives a bland reference has a problem it created for itself.

The first reporting period is the one to watch

The conduct rule breach reporting year runs 1 September to 31 August. The period that ended on 31 August 2026 closed the day before the new rules took effect, so it contains no NFM breaches under COCON 1.1.7FR.

The period that started on 1 September 2026 is the first one that can. That gives most small firms until autumn 2027 before an NFM finding has to appear in an annual return — but only if the finding was recorded properly at the time. A breach register that gets reconstructed from memory in August 2027 is the failure mode here, not a missed deadline.

Three things small firms are getting wrong already

1. Treating it as an HR change. It is a conduct change with an HR surface. The HR process handles the employment consequences; the conduct process handles classification, recording, F&P impact and reporting. Running only the first leaves the regulatory half undone.

2. Over-reading the scope. COCON 1.1.7FR covers bullying, harassment or violence against colleagues with a sufficient work-related link. It is not a general morality clause, and the FCA has said it does not extend the regulatory remit beyond SM&CR financial activities.

3. Under-reading FIT. The mirror-image error. FIT lets you consider any relevant misconduct wherever it occurred. A firm that decides an incident is outside COCON and stops there has answered only one of the two questions.

Summary

The new NFM rules and guidance came into effect on 1 September 2026; the FCA's own page carries the confirmation and a 1 September update stamp.
COCON 1.1.7FR covers bullying, harassment or violence against colleagues where there is a sufficient work-related link. It is not retrospective.
FIT is separate and broader — any relevant misconduct, wherever it occurs, can bear on fitness and propriety.
The FCA has explicitly said firms need not re-examine past breach determinations, revise past F&P assessments, monitor private lives or social media, or investigate trivial private-life allegations.
The work that matters now is practical: policies that name the new scope, staff who have been trained on it, a register that can hold an NFM entry, and an agreed answer to "who investigates if it is the principal?"
The first reporting period that can contain an NFM breach began on 1 September 2026 — what you record between now and next August is what you will have to report.

Where to start: the PS25/23 Readiness Scorecard scores your firm across the areas above, and the PS25/23 Readiness Pack contains the underlying policy and investigation templates. For the fuller background, see our non-financial misconduct guide and the PS25/23 deadline guide.

Last reviewed: 8 September 2026. This guide explains the FCA's non-financial misconduct rules as they took effect on 1 September 2026. It is general information, not regulatory or legal advice, and it does not describe a ConductLog product feature — ConductLog is validating demand for a tool that helps small FCA-regulated firms handle conduct and misconduct processes. For your firm's specific obligations, check the FCA's published guidance and consider professional advice; where an allegation raises employment-law questions, take specialist employment advice alongside compliance advice.