The FCA's paper also contains a Policy Statement confirming a widening of the scope of the CR for non-bank firms as regards non-financial misconduct ("NFM") to take effect from 1 September 2026. Although NFM can already amount to a breach of the CR for non-banks, the FCA believes that the rule change adds clarity and may bring more incidents of NFM in scope for non-bank firms.

We commented on the FCA's previous proposals, published back in 2023, in our client note here.

Changes to the draft guidance – Conduct rules

It is perhaps frustrating for regulated firms that after a long wait the FCA's guidance is still not finalised. However, though there is strong support for FCA guidance providing more clarity on when serious NFM could be a breach of the CR, there were also concerns amongst respondents to CP23/20 that the previous draft guidance lacked sufficient clarity, so could lead to inconsistent and unfair application by firms, and also concerns about an apparent divergence from established employment law which could result in legal challenge.

The FCA now emphasises that the CR are distinct from employment law. Discrimination for the purposes of the CR is not limited to relevant protected characteristics under the Equality Act but is broader.

Under section 64A Financial Services and Markets Act conduct in private or personal life is entirely out of scope of the FCA's statutory power to make rules of conduct for individuals. The FCA has added to the list of examples in the draft guidance illustrating the boundary between work and private/personal life.

For non-bank firms there is guidance on when NFM may be within or outside the firm's "SMCR financial activities".

There is further guidance on the distinction between when NFM may breach Conduct Rule 1 (CR1- lack of integrity) as opposed to Conduct Rule 2 (CR2 – due skill, care and diligence).

Conduct Rule 1

The original guidance for when NFM could be a breach of CR1 started with a description of a "good working environment" and took the position that misconduct causing a serious departure from that standard could be in breach of CR1. The good working environment description has now been removed, as has the non-exhaustive list of examples of serious misconduct that followed it. There had been concerns that these were subjective and unclear.

Instead the starting point in the revised guidance for assessing a potential CR1 breach is identifying whether the behaviour falls within the rule at COCON 1.1.7 FR (unwanted conduct that has the purpose or effect of violating a person's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for the individual or conduct that is violent to the individual), or within the equivalent guidance for banks, and then assessing:

• Whether the behaviour is serious
• All the circumstances of the case, including the perception of the subject of the misconduct insofar as that subjective perception was reasonable
• Whether the behaviour involves a lack of integrity

The revised guidance does not aim to cover every kind of NFM between members of the workforce of a firm that might breach CR1. 

The FCA's aim is that minor incidents of poor workplace behaviour need not be treated as CR breaches and this does not affect a firm's ability to take appropriate disciplinary measures for lower level NFM in line with the firm's internal codes of conduct.

Lack of integrity. Misconduct to a fellow member of the workforce will fall outside the scope of CR1 if the conduct rules staff member (a) thought that there was a good and proper reason for the conduct and its effects were proportionate to the intended aim of the conduct; or (b) did not intend to have a negative impact on the subject of the misconduct, did not know that they were doing so and was not reckless about the effect of their conduct. However, an unreasonable belief that conduct is justified may itself show a lack of integrity. For example, the fact that the individual in question believes that sexual harassment is not blameworthy is not a reason for CR 1 not to apply.

Is the misconduct serious? The draft text provides a list of factors the FCA will take into account in deciding whether misconduct in relation to a fellow member of the workforce is serious enough to amount to a breach. This list is very similar to the one included in the FCA's original draft guidance and includes the size of the impact on the subject of the conduct, the difference in seniority between the person whose conduct is in question and the subject of the conduct, and whether the subject of the misconduct has specific characteristics of vulnerabilities, particularly if this is a factor in the conduct in question.

Conduct Rule 2

NFM in relation to fellow members of the workforce that is not a breach of CR1, may be a breach of CR2 if it involves lack of due skill, care and diligence. The text now being consulted upon expands the original draft guidance in this respect. A manager should try to prevent harassment and other types of misconduct referred to in the guidance. What a manager should do in a particular situation will depend on the exact facts and they will not be in breach of CR2 if they have acted reasonably. A non-exhaustive list of examples of conduct by a manager that would breach CR2 are given including failing to intervene to stop such behaviour, not appropriately operating the firm's systems and controls to detect and prevent such behaviour, failing to take seriously or deal appropriately with complaints of NFM, and failing to take reasonable steps to provide a safe environment for people to raise concerns about such treatment. In considering whether there has been a breach of CR2 the FCA will take into account any limits or constraints on the manager's ability to act in such ways.

Changes to the draft guidance - fit and proper

The FCA's draft guidance on how NFM should be taken into account in the fit and proper assessment has been updated to take into account feedback in the first consultation. NFM in private or personal life can be relevant to the fit and proper assessment, even if there is little or no risk of it being repeated in their work for the regulated firm. Such behaviour will breach the fit and proper standard if it demonstrates a willingness to disregard ethical or legal obligations, abuse a position of trust or willingness to exploit the vulnerabilities of others and/or it is sufficiently serious that if the person were permitted to work at a firm it could undermine public confidence in the regulatory system or otherwise impact the FCA's statutory objectives. A custodial sentence, even if suspended, is likely to mean that the matter is sufficiently serious, though this is subject to consideration of other relevant matters including how old the offence is and rehabilitation since the date of the offence.

Firms are not expected to monitor the private lives of relevant staff to see whether there is anything relevant to fitness. They only need to consider matters in private life in a fit and proper assessment if there is good reason to, for example the firm becomes aware of an allegation which, if true, would call into question the individual's fit and proper status. The guidance recognises that even if the firm is aware of an allegation it may have limited ability to investigate it beyond asking the individual for an explanation. Perhaps problematically, the guidance states that even if a firm cannot establish the truth of an allegation there may still be an obligation to notify the FCA of an allegation that, if it were established to be true, would be reasonably material to a fit and proper assessment.

There is explicit guidance relating to the use of social media in the private lives of staff who are subject to the fit and proper standard. There is no requirement to monitor purely private life social media activity that does not take place through the firm's systems. However, if a firm becomes aware of activity on private life social media that indicates a real risk that the person will breach the requirements and standards of the regulatory system, then the activity will be relevant to the fit and proper status of the individual. Examples include threats of violence or clear involvement in criminal activities.

Regulatory references

The new consultation does not take forward the FCA's proposed guidance to be added to the regulatory reference provisions in the SYSC section of the FCA handbook reminding firms that they may need to disclose NFM at work or in private life in a regulatory reference. However, the FCA's explanatory text makes clear that such disclosure is expected. Some respondents had been concerned about the broad scope of Question G on the current regulatory reference template ("Are we aware of any other information that we reasonably consider to be relevant to your assessment of whether the individual is fit and proper). In response the FCA has confirmed that it considers Question G to be fundamental to the purpose of the regulatory reference and it does not intend to amend it. It enables firms to comment on matters that might reasonably be considered relevant to an assessment but which would not otherwise be included in the reference. Firms are not expected to include information that would be irrelevant to a fit and proper assessment, for example if an internal investigation has exonerated an individual from allegations made against them, there is no need to mention the allegations in a reference or that there has been an internal investigation into them.