Culture of Compliance: FCA Conduct Rules Explained

A written code of conduct is easy to produce. A culture where people follow it when nobody is checking is harder. The FCA's rules for individuals give firms a concrete starting point: five individual conduct rules for relevant staff, with extra rules for senior managers, and guidance on what training and reporting should look like. This guide summarises the FCA's conduct rules page. It supports our Building a Culture of Compliance course overview and connects to our guide on conflicts of interest.

The five individual conduct rules

According to the FCA's conduct rules page, the individual conduct rules are:

• Rule 1: you must act with integrity.
• Rule 2: you must act with due skill, care and diligence.
• Rule 3: you must be open and cooperative with the FCA, the PRA and other regulators.
• Rule 4: you must pay due regard to the interests of customers and treat them fairly.
• Rule 5: you must observe proper standards of market conduct.

The page says that people performing senior management functions have four additional conduct rules. It does not list them, and refers readers to the Senior Managers Regime page and the Code of Conduct sourcebook for more detail.

What the FCA says about training

The page says staff covered by the conduct rules should receive training relevant to their role. It provides positive and negative indicators for firms, including that a relevant senior manager should oversee training, that training should use realistic scenarios, and that its effectiveness should be assessed. It also says conduct should be linked to fitness and propriety and to performance assessments, and points to section 11 of the SM&CR guide for solo-regulated firms, last updated in 2019, for further detail.

In our reading, this is where a "culture of compliance" becomes testable. A firm that trains staff on the five rules, uses scenarios from its own business, and links conduct to appraisal and pay decisions has evidence that culture is managed. A firm that circulates a policy once a year may not.

Reporting breaches

The page sets out two reporting routes. For staff who are not senior managers, firms must report conduct rule breaches that result in disciplinary action annually, using the REP008 form in RegData. For senior managers, firms must notify the FCA within seven business days of concluding disciplinary action, using Form D on Connect, or Form C if the person is leaving the firm. The page defines disciplinary action to include a formal written warning, suspension or dismissal, or reduction or recovery of remuneration. Breaches that do not warrant these outcomes should not be reported. If an employee appeals or plans to appeal, the firm should still report and include the appeal, and the appeal outcome goes into the next REP008 or Form D. Dual-regulated firms should also check the PRA's own conduct rule breach reporting requirements.

What this means for how a firm behaves

Because breaches that lead to disciplinary action must be reported, the way a firm handles misconduct is visible to the regulator. Consistent outcomes, recorded reasons and a clear route for staff to raise concerns are the practical parts of culture that an outside reader can see. The conduct rules also apply to the way people treat customers (Rule 4) and markets (Rule 5), which links culture to the conflicts and market conduct topics elsewhere in this series.

Who the extra rules apply to

The page says the four additional conduct rules apply to people performing senior management functions, including those performing such a function under the 12-week rule. It does not set out those rules itself. For firms, the practical lesson is that senior managers carry both the five individual rules and the extra rules, and the page expects a relevant senior manager to oversee conduct rules training. That puts responsibility for culture with named people, not only with a compliance function.

Culture is tested by how a firm responds

The FCA page does not define culture, and we have not tried to. What it does give is a set of observable things: whether training is realistic, whether its effectiveness is assessed, whether conduct feeds into fitness and propriety and performance assessments, and whether breaches are reported on time. Each can be checked from records, which is what makes the page useful for compliance staff building a case for a stronger culture programme.

Using this in a compliance role: our suggestions

These steps are our suggestions, not requirements on the FCA page.

• Map each conduct rule to a real scenario from your own business and use it in training.
• Check that the person who oversees training can show how effectiveness was assessed.
• Review whether disciplinary outcomes for similar breaches have been consistent.
• Diarise the REP008 annual return and the seven business day Form D deadline.

For structured learning, browse our CPD courses.

What we could not confirm

The page does not list the senior manager conduct rules or define "conduct rules staff" in detail, so this post does not cover who is in scope. We did not read the Code of Conduct sourcebook, the SM&CR guide or the FCA's culture and governance pages in full. We have not covered the Central Bank of Ireland's own individual accountability framework, so this post is about the UK only. Check the current FCA text before relying on this summary. This post is general information, not legal advice.