The FCA's new COCON rule on non-financial misconduct: what it means for financial advice firms

From 1 September 2026, the FCA has extended the scope of its Code of Conduct, known as COCON, at non-bank regulated firms to cover serious, work-related bullying, harassment and violence.

For financial advice firms, this does not mean every workplace complaint becomes a regulatory matter. It does mean the firm needs a clear, proportionate way to handle serious concerns, decide what they mean for a person's fitness and propriety, and record the resulting decisions.

The new rule is COCON 1.1.7FR. It applies to relevant conduct-rules staff at non-bank SM&CR firms where there is a sufficient work-related link. The FCA is clear that it is not retrospective and does not expand its remit beyond SM&CR financial activities. Read the FCA's non-financial misconduct guidance.

What has changed

COCON already sets standards of conduct for relevant people in regulated firms. The new rule makes clear that serious non-financial misconduct can fall within those standards at non-bank firms where the conduct is connected to work.

The Handbook covers unwanted conduct that violates a person's dignity, or creates an intimidating, hostile, degrading, humiliating or offensive environment, as well as violence. The FCA's supporting guidance says the rule covers serious conduct. See COCON 1.1.7FR in the FCA Handbook.

This is not a change that turns private life into a general regulatory matter. The COCON rule needs a work-related link. The FCA's Fit and Proper test, known as FIT, is separate: it allows firms to consider relevant misconduct wherever it occurs when assessing whether someone is fit and proper. The FCA says firms should make those decisions fairly and in line with privacy, employment and other relevant law.

What advice firms should review

The FCA identifies four areas firms should have considered updating: staff policies, conduct-breach reporting, fitness-and-propriety assessments and regulatory references. It also says staff and managers should understand how the change applies to them.

For an advice firm, the practical question is whether those four things join up when a serious concern is raised. A useful review can focus on five checks.

1. Make the reporting route clear

People need to know where a serious concern goes and what happens next. The route should distinguish between an initial report, a fact-finding process and a decision about whether the conduct rules or fitness and propriety are engaged.

2. Make ownership clear from report to decision

Someone should be accountable for moving the matter forward, while decisions remain with the people who have the right authority. Where responsibilities overlap, informal handling can leave uncertainty about what was decided and why.

3. Keep a proportionate, confidential decision record

The record does not need to turn every concern into a large case file. It should, however, make it possible to understand the report received, the steps taken, the evidence considered, the decision made and any follow-up action. Access should be restricted to the people who need it, in line with the firm's privacy and employment-law responsibilities. Clear ownership and dated next actions reduce the risk that important work is left between HR, compliance and management.

4. Separate COCON from fitness and propriety

COCON and FIT are related but separate. A firm should avoid assuming that a workplace allegation automatically means a COCON breach, or that a COCON conclusion is the only input to a fitness-and-propriety assessment. The relevant facts, the person's role and the applicable FCA requirements all matter.

5. Check the regulatory-reference process

Where a serious, substantiated matter has consequences for a person's regulatory record, the firm needs a consistent route from investigation to decision and, where relevant, its regulatory-reference process. This is an area where a complete record and careful professional judgement matter more than a generic checklist.

What the FCA is not asking firms to do

The FCA explicitly says firms do not need to revisit past conduct-rule breach decisions or past fitness-and-propriety assessments. They do not need to monitor employees' private lives or social-media accounts. They do not need to investigate allegations about private life that are trivial, implausible or irrelevant.

That boundary matters. A proportionate process protects people and supports better decisions. It is not a reason to collect information without a clear purpose or to bypass employment-law and privacy obligations.

Where a connected workspace can help, and where it cannot

A productivity workspace can make ownership, next actions and documents easier for the right team to find. It cannot decide whether an allegation is in scope, investigate it fairly, make a fitness-and-propriety judgement or meet a firm's legal obligations.

For firms reviewing this change, the immediate task is not to buy a system. It is to make sure the policy, people and process are clear. Once those decisions are made, the firm can decide how it will keep the work visible and the record usable.

A sensible next step

Ask the person responsible for conduct, compliance or people matters to review the FCA guidance against the firm's current process. Confirm who owns a serious report, how decisions are made and recorded, and when specialist HR, legal or compliance advice is needed.

The FCA's own page provides the starting point for that review, including what firms should consider and the limits it has set. Read the FCA's current guidance.

This article is a general summary of FCA material, not legal, employment or compliance advice. Firms should take professional advice where the facts or their obligations require it.