PS25/23 Readiness Scorecard

1. Every member of staff has been classified (SMF / certified / conduct rules staff / excluded) and the classification is recorded.

COCON 1.1 sets out which staff are excluded; everyone else is conduct rules staff at minimum.

2. The firm understands the PS25/23 scope: that serious non-financial misconduct is within COCON when work-connected.

COCON 1.1.7FR introduced by PS25/23, effective 1 September 2026.

3. A named SMF (typically SMF16) owns the conduct-rule programme including NFM scope.

Ownership cannot be delegated to HR alone.

1. A written allegation-handling and investigation policy exists, covering scope, timelines, evidence, witnesses, and confidentiality.

A documented process — not "we will do something reasonable when it happens".

2. Escalation thresholds are defined: which allegations trigger external investigator, which trigger immediate suspension, which are SUP 15.3 reportable.

Documented thresholds, not case-by-case judgement only.

3. External investigators and employment-law support contacts are identified in advance.

Knowing who to call before an allegation lands — not in the middle of one.

4. A tabletop exercise — a hypothetical NFM allegation walked through end-to-end — has been run in the past 12 months.

Tests whether the policy actually works when a real case lands.

1. The F&P assessment template includes NFM-evidence fields (allegation history, outcome, F&P implication).

NFM evidence must be treated as conduct-rule evidence post-PS25/23, not filtered out as HR-only.

2. Every certified individual has had an F&P assessment in the past 12 months.

FIT 2.2 requires annual re-assessment.

3. The FCA Directory has been updated within 7 business days of every relevant change in the past 12 months.

Directory updates are part of the F&P workflow.

4. There is a clear documented link between conduct-rule breach assessments and F&P determinations.

A breach assessment that does not feed F&P is missing the regulatory connection.

1. Every current conduct rules staff member has received initial conduct rules training.

Initial training within the first few weeks of joining or moving into a conduct rules role.

2. Annual refresher training has been delivered (or is scheduled) within the past 12 months.

Annual cadence is standard; gap should not exceed 12 months.

3. A PS25/23-specific trigger training round has been delivered (or is firmly scheduled before 1 September 2026).

PS25/23 is a material rule change and warrants a dedicated trigger-training event.

4. Individual attestation records exist for every staff member for every training round.

Group sign-in sheets are weak evidence; individual confirmation is the standard.

1. A live conduct rule breach register exists and is reviewed at least monthly by the SMF16.

Maintained continuously, not reconstructed at year-end.

2. The REP008 annual return process is documented and the firm has filed (or is on track to file) the most recent return on time.

Within 2 months of accounting reference date. A nil return is still a return.

3. SUP 15.3 notification triggers are documented and known to the SMF16.

Material and ongoing conduct issues — do not wait for REP008.

4. The whistleblowing channel is reachable, monitored, and confidential.

SYSC 18 framework — confirmed by a recent test or live-fire check.