Skip to content
ConductLog

SMCR September 2026 Checklist: What Small Firms Must Complete Before 1 September

1 September 2026 is the most significant SMCR compliance deadline for small regulated firms since the regime was extended to solo-regulated firms in December 2019. PS25/23 — Tackling non-financial misconduct in financial services comes into force on that date, extending COCON conduct rules to cover non-financial misconduct: harassment, bullying, discrimination, and sexual misconduct.

This is not a minor update. It changes the scope of what can be a conduct rule breach, what firms must disclose in regulatory references, how fit and proper assessments are conducted, and what the FCA expects to see in your conduct risk framework.

This checklist covers the actions a small solo-regulated firm should complete before 1 September 2026.

What changes on 1 September 2026

Under the current rules, COCON's individual conduct rules govern financial conduct — how staff act towards clients, markets, and the regulator. Non-financial misconduct (NFM) — harassment, bullying, discrimination — has historically been a matter for employment law rather than regulatory conduct rules, although the FCA has signalled for several years that it views culture and inclusion as conduct issues.

PS25/23 changes this. From 1 September 2026:

  • A new rule (COCON 1.1.7FR) confirms that COCON applies to all staff at all FCA-authorised firms holding a Part 4A permission — not just those explicitly in scope of SMCR
  • The FCA publishes new guidance explaining how non-financial misconduct can constitute a breach of the existing COCON conduct rules
  • The Fit and Proper (FIT) test guidance is updated to confirm that NFM is relevant to fitness and propriety assessments
  • Non-financial misconduct that results in a disciplinary finding of a conduct rule breach becomes disclosable in regulatory references

The FCA has stated that it expects all affected firms to have "familiarised themselves with the new guidance" by the implementation date. The FCA has also indicated it will monitor firms' implementation in practice after September 2026 — making this an area of active supervisory interest, not a box-tick exercise.

The checklist

1. Policy and procedures update

Update your conduct policy to include non-financial misconduct.

Your firm should have a documented conduct policy (or equivalent). Before 1 September 2026:

  • Update the policy to define non-financial misconduct explicitly — harassment, bullying, discrimination (protected characteristics under the Equality Act 2010), sexual misconduct
  • State that non-financial misconduct can constitute a breach of the COCON conduct rules
  • Set out the process for receiving, investigating, and recording non-financial misconduct allegations
  • Confirm that COCON applies to ALL staff at the firm, not only those holding approved or certified functions

Sole traders and limited scope firms: the FCA's COCON changes apply to all firms holding Part 4A permissions. Even if your firm is a sole trader or a limited scope firm, COCON applies from September 2026 to your conduct-rule obligations where you employ or engage staff.

2. Staff training

Train all staff on the extended COCON scope before 1 September 2026.

The training should cover:

  • What the individual conduct rules require (acting with integrity; due skill, care and diligence; openness with the regulator; due regard to customers; proper market conduct standards)
  • What non-financial misconduct is and how it can constitute a conduct rule breach
  • How to report a concern about a colleague's non-financial misconduct
  • What happens when a report is made — the firm's investigation process and timeline

Training does not need to be elaborate. A 45-minute session with a short handout demonstrating what each rule means in practice — including NFM examples — is proportionate for a small firm. Document who attended, when, and what was covered.

3. Fit and proper assessment update

Update your annual fit and proper (F&P) assessment process to include NFM.

Before September 2026:

  • Review your F&P assessment template or questionnaire — does it ask about non-financial misconduct findings from previous employers?
  • Add a specific section covering non-financial misconduct: has the individual been subject to disciplinary proceedings or findings relating to harassment, bullying, discrimination, or sexual misconduct?
  • Update your internal guidance on how NFM findings in the F&P process affect your overall assessment of the individual
  • Ensure that the Senior Manager responsible for fit and proper assessments (typically SMF16, Compliance Oversight) is briefed on the updated FIT guidance

This applies prospectively — individuals who complete F&P assessments after 1 September 2026 will have their assessment conducted under the updated framework.

4. Regulatory reference template and records

Prepare for the expanded disclosure obligation in regulatory references.

From 1 September 2026, non-financial misconduct findings that constitute conduct rule breaches become disclosable in regulatory references. Before the deadline:

  • Brief your compliance function (or Senior Manager with responsibility for regulatory references) on the change — NFM conduct rule breach findings must now be included in references you give
  • Review your regulatory reference template — does it have a section for non-financial misconduct findings? If not, add one
  • Establish a recordkeeping process for NFM investigations and outcomes — the records you create now feed into references you may give in future years
  • Review any existing settlement agreements with former staff — clauses that conflict with your disclosure obligations cannot override your regulatory reference duties (this principle applies equally to NFM disclosures from September 2026)

The six-year lookback rule that applies to conduct rule breach disclosures will apply to NFM conduct rule breaches from September 2026. Serious NFM misconduct is disclosed without any time limit, consistent with the treatment of other serious misconduct categories.

5. Conduct risk framework update

Update your conduct risk identification and management approach.

Before September 2026:

  • Add non-financial misconduct to your conduct risk register as a risk category
  • Identify the specific NFM risks most relevant to your firm — for a small team, interpersonal risks (harassment, inappropriate behaviour between staff) are typically the most relevant categories
  • Assign a Senior Manager as accountable for the NFM conduct risk category — this should be the same SM who holds accountability for culture and conduct generally (Prescribed Responsibility (a))
  • Document how NFM incidents will be recorded and reviewed — complaints and incident data should now include NFM categories alongside financial conduct categories
  • Brief the board or equivalent governance body on the change and the firm's preparation — minute the briefing

For guidance on building a conduct risk framework, see our FCA conduct risk management guide.

6. FCA Directory and fit and proper linkage

Ensure your FCA Directory obligations remain current and connected to your updated F&P process.

  • Confirm all certified staff and non-SM directors are listed in the Directory with current, accurate data
  • Ensure your annual attestation deadline is calendared — the attestation window is 12 months from your last update
  • Check that your F&P update process triggers a Directory update where relevant (e.g. if an NFM investigation results in a certified staff member's role ending, the Directory must be updated within 7 business days)

Actions that cannot be left until August

Some of these items take time — time to draft, time to consult, time to train staff. The deadline is 1 September 2026. In practice, firms that leave preparation to August will not have a meaningful review cycle before the FCA starts supervisory conversations about implementation.

A reasonable implementation timeline:

By end of June/July 2026 By end of August 2026 By 1 September 2026
Update conduct policy Complete staff training All items documented and filed
Update F&P assessment template Complete board briefing Updated regulatory reference template ready for use
Update regulatory reference template Complete conduct risk register update F&P assessment cycle ready for NFM inclusion

After 1 September 2026: what the FCA expects to see

The FCA has been explicit that it will monitor firms' implementation of PS25/23 in practice after September 2026. Supervisors are likely to ask:

  • Does the firm have a policy that covers non-financial misconduct as a conduct rule breach?
  • Have staff been trained on the updated COCON scope?
  • Has the F&P assessment process been updated?
  • How has the firm addressed non-financial misconduct investigations — are there records of investigations, outcomes, and actions taken?

The FCA's regulatory objective here is workplaces free from harassment and other forms of non-financial misconduct. Supervisory questions are likely to focus on whether the culture change is real — not whether the policies have been updated in name.

For the full picture of SMCR obligations for small firms, see our SMCR plain-English guide.

This guide is intended as a practical overview of the September 2026 PS25/23 changes for small FCA-regulated firms. It is not legal advice. For complex non-financial misconduct situations or specific regulatory queries, take specialist compliance or employment legal advice.

Sources:

Ready to manage conduct rule compliance properly?

ConductLog gives small FCA firms a structured investigation workflow with built-in COCON rule mapping. Join the waitlist for early access.

No spam. Unsubscribe any time. Privacy policy.

Related guides

FCA Conduct Risk: What It Is and How Small Firms Manage It

How the FCA defines conduct risk, why it applies to small regulated firms, and the practical framework for identifying, managing, and evidencing conduct risk on an ongoing basis.

FCA Change in Control: The Section 178 Process for Small Regulated Firms

What triggers an FCA change in control notification under FSMA Section 178, who must notify before acquiring a stake in a regulated firm, and how the 60-working-day assessment window works.

FCA Directory Persons: What Solo-Regulated Firms Must Submit

Who counts as an FCA directory person, what data small regulated firms must submit, how to update it within 7 business days, and what the annual attestation requires.