SMCR September 2026 Checklist: What Small Firms Had to Complete

1 September 2026 was the most significant SMCR compliance deadline for small regulated firms since the regime was extended to solo-regulated firms in December 2019, and it has now passed. The rule that took effect on that date is COCON 1.1.7FR, which the FCA confirmed in July 2025; the PS25/23 — Tackling non-financial misconduct in financial services guidance came into force alongside it. In the FCA's words, COCON 1.1.7FR "extends the scope of the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues, where it relates to an individual's role". Note how narrow that is: PS25/23 says the rule "covers sexual harassment but does not expand the scope of COCON in non-banks to cover other forms of conduct prohibited by the Equality Act, such as discrimination and victimisation" — though it adds that firms "should consider whether misconduct of these kinds, and other forms of NFM, may nevertheless be a potential breach of the conduct rules" on the ordinary tests.

This is not a minor update. It changes the scope of what can be a conduct rule breach, what firms must disclose in regulatory references, how fit and proper assessments are conducted, and what the FCA expects to see in your conduct risk framework.

This page is organised by deadline — the actions that fell due, and how to confirm each is closed. If you would rather work by compliance area than by date, our PS25/23 compliance checklist sets the same ground out as a five-area plan covering policy, training, investigation, F&P and reporting.

This checklist covers the actions a small solo-regulated firm should have completed by 1 September 2026 — and should complete now if it has not.

What changes on 1 September 2026

Under the current rules, COCON's individual conduct rules govern financial conduct — how staff act towards clients, markets, and the regulator. Non-financial misconduct (NFM) — harassment, bullying, discrimination — has historically been a matter for employment law rather than regulatory conduct rules, although the FCA has signalled for several years that it views culture and inclusion as conduct issues.

PS25/23 changed this. Since 1 September 2026:

A new rule (COCON 1.1.7FR) widens the kind of conduct COCON reaches in non-banking firms — bullying, harassment or violence against colleagues with a sufficient work-related link — rather than widening the population it applies to
The FCA publishes new guidance explaining how non-financial misconduct can constitute a breach of the existing COCON conduct rules
The Fit and Proper (FIT) test guidance is updated to confirm that NFM is relevant to fitness and propriety assessments
Non-financial misconduct that results in a disciplinary finding of a conduct rule breach becomes disclosable in regulatory references

The FCA has stated that it expects all affected firms to have "familiarised themselves with the new guidance" by the implementation date. The FCA has also indicated it will monitor firms' implementation in practice after September 2026 — making this an area of active supervisory interest, not a box-tick exercise.

The checklist

1. Policy and procedures update

Update your conduct policy to include non-financial misconduct.

Your firm should have a documented conduct policy (or equivalent). Check that:

Update the policy to define non-financial misconduct explicitly — harassment, bullying, discrimination (protected characteristics under the Equality Act 2010), sexual misconduct
State that non-financial misconduct can constitute a breach of the COCON conduct rules
Set out the process for receiving, investigating, and recording non-financial misconduct allegations
Confirm that COCON applies to ALL staff at the firm, not only those holding approved or certified functions

Sole traders and limited scope firms: the FCA's COCON changes apply to all firms holding Part 4A permissions. Even if your firm is a sole trader or a limited scope firm, COCON has applied since September 2026 to your conduct-rule obligations where you employ or engage staff.

2. Staff training

Train all staff on the extended COCON scope. This was due by 1 September 2026.

The training should cover:

What the individual conduct rules require (acting with integrity; due skill, care and diligence; openness with the regulator; due regard to customers; proper market conduct standards)
What non-financial misconduct is and how it can constitute a conduct rule breach
How to report a concern about a colleague's non-financial misconduct
What happens when a report is made — the firm's investigation process and timeline

Training does not need to be elaborate. A 45-minute session with a short handout demonstrating what each rule means in practice — including NFM examples — is proportionate for a small firm. Document who attended, when, and what was covered.

3. Fit and proper assessment update

Update your annual fit and proper (F&P) assessment process to include NFM.

Check that:

Review your F&P assessment template or questionnaire — does it ask about non-financial misconduct findings from previous employers?
Add a specific section covering non-financial misconduct: has the individual been subject to disciplinary proceedings or findings relating to harassment, bullying, discrimination, or sexual misconduct?
Update your internal guidance on how NFM findings in the F&P process affect your overall assessment of the individual
Ensure that the Senior Manager responsible for fit and proper assessments (typically SMF16, Compliance Oversight) is briefed on the updated FIT guidance

This applies prospectively — individuals who complete F&P assessments after 1 September 2026 will have their assessment conducted under the updated framework.

4. Regulatory reference template and records

Prepare for the expanded disclosure obligation in regulatory references.

Since 1 September 2026, non-financial misconduct findings that constitute conduct rule breaches have been disclosable in regulatory references. Check that:

Brief your compliance function (or Senior Manager with responsibility for regulatory references) on the change — NFM conduct rule breach findings must now be included in references you give
Review your regulatory reference template — does it have a section for non-financial misconduct findings? If not, add one
Establish a recordkeeping process for NFM investigations and outcomes — the records you create now feed into references you may give in future years
Review any existing settlement agreements with former staff — clauses that conflict with your disclosure obligations cannot override your regulatory reference duties (this principle applies equally to NFM disclosures)

The six-year lookback rule that applies to conduct rule breach disclosures applies to NFM conduct rule breaches arising on or after 1 September 2026. Serious NFM misconduct is disclosed without any time limit, consistent with the treatment of other serious misconduct categories.

5. Conduct risk framework update

Update your conduct risk identification and management approach.

Check that:

Add non-financial misconduct to your conduct risk register as a risk category
Identify the specific NFM risks most relevant to your firm — for a small team, interpersonal risks (harassment, inappropriate behaviour between staff) are typically the most relevant categories
Assign a Senior Manager as accountable for the NFM conduct risk category — this should be the same SM who holds accountability for culture and conduct generally (Prescribed Responsibility (a))
Document how NFM incidents will be recorded and reviewed — complaints and incident data should now include NFM categories alongside financial conduct categories
Brief the board or equivalent governance body on the change and the firm's preparation — minute the briefing

For guidance on building a conduct risk framework, see our FCA conduct risk management guide.

6. FCA Directory and fit and proper linkage

Ensure your FCA Directory obligations remain current and connected to your updated F&P process.

Confirm all certified staff and non-SM directors are listed in the Directory with current, accurate data
Ensure your annual attestation deadline is calendared — the attestation window is 12 months from your last update
Check that your F&P update process triggers a Directory update where relevant (e.g. if an NFM investigation results in a certified staff member's role ending, the Directory must be updated within 7 business days)

Actions that cannot be left until August

Some of these items take time — time to draft, time to consult, time to train staff. The deadline was 1 September 2026 and it has passed, so a firm still closing gaps is working against supervisory expectation rather than a countdown. The sequence below is the order the work was meant to run in; it is still the order that works for a firm catching up.

The implementation timeline as it stood:

By end of June/July 2026	By end of August 2026	By 1 September 2026
Update conduct policy	Complete staff training	All items documented and filed
Update F&P assessment template	Complete board briefing	Updated regulatory reference template ready for use
Update regulatory reference template	Complete conduct risk register update	F&P assessment cycle ready for NFM inclusion

After 1 September 2026: what the FCA expects to see

The FCA has been explicit that it will monitor firms' implementation of PS25/23 in practice. Supervisors are likely to ask:

Does the firm have a policy that covers non-financial misconduct as a conduct rule breach?
Have staff been trained on the updated COCON scope?
Has the F&P assessment process been updated?
How has the firm addressed non-financial misconduct investigations — are there records of investigations, outcomes, and actions taken?

The FCA's regulatory objective here is workplaces free from harassment and other forms of non-financial misconduct. Supervisory questions are likely to focus on whether the culture change is real — not whether the policies have been updated in name.

For the full picture of SMCR obligations for small firms, see our SMCR plain-English guide.

This guide is intended as a practical overview of the September 2026 PS25/23 changes for small FCA-regulated firms. It is not legal advice. For complex non-financial misconduct situations or specific regulatory queries, take specialist compliance or employment legal advice.

Sources: