Non-Financial Misconduct Is Now In Scope: What Changed for Conduct Rules Training on 1 September 2026

On 1 September 2026 the FCA’s Conduct Rules changed scope. Serious bullying, harassment and violence towards a colleague now fall within the conduct rules at non-bank firms, where the behaviour relates to the individual’s role. The rule had previously applied in this way only to banks.

That is a regulatory change with a training consequence most firms have not yet acted on. If your Conduct Rules training was written before September 2026, it now describes a narrower set of obligations than the ones your staff are actually subject to — and the obligation to train is itself a rule.

What the rule says

The change sits in COCON 1.1.7FR, made by instrument FCA 2025/60 on 9 December 2025 and in force from 1 September 2026. Serious bullying, harassment and violence toward a colleague are within scope of the conduct rules when they relate to the person’s role, rather than only when they form part of a regulated financial services activity.

The scope test is narrower than it first appears, and the detail matters:

• Conduct is in scope if either the person responsible or the person affected works in the firm’s financial services business.
• Conduct confined to a non-financial part of the business stays outside COCON (COCON 1.1.7FR(5)).
• Conduct in private or personal life remains outside COCON entirely.
• The rule has no retrospective effect. Earlier behaviour is assessed under the rules in force at the time.

Alongside the rule, the FCA added a substantial body of new guidance: a scope section at COCON 1.3 with relevant factors and a table of examples; a harassment section at COCON 4.3 addressing seriousness, effect and purpose; guidance on managers’ reasonable steps to protect staff at COCON 4.1.8-A to 4.1.8-D; and flow diagrams at COCON 1 Annex 2 and COCON 4 Annex 1.

The senior manager dimension

Two changes affect senior managers specifically. COCON 1.3.3G clarifies that information from a senior manager’s private life may need to be disclosed under SC4 — the duty to disclose appropriately any information of which the regulator would reasonably expect notice — where it is material to fitness and propriety. The earlier guidance at COCON 4.2.29G(2) has been deleted.

On the fit and proper side, FIT guidance now treats conduct in private life as relevant where it demonstrates a material risk of regulatory breaches. Two limits were set deliberately: firms are not expected to investigate trivial or implausible allegations, and are not expected to monitor social media proactively. Repeated minor breaches can be relevant. The FCA also withdrew a proposed factor on specific characteristics or vulnerabilities.

Why this is a training obligation, not just a policy update

This is the part that converts a scope change into work. Under section 64B of the Financial Services and Markets Act, reflected in COCON 2.3.1G, a firm must ensure that everyone subject to COCON is notified of the rules that apply to them, and must take all reasonable steps to ensure they understand how those rules apply to them.

COCON 2.3.2G then says what suitable training looks like, and it is unusually specific for FCA guidance. Training should give staff a broad awareness of all the COCON rules, plus a deeper understanding of the rules most relevant to their own work. The guidance gives two worked examples: deeper coverage of Rule 5 on market conduct for people who trade in markets, and deeper coverage of Rule 4 on customer interests for people who deal directly with customers.

Two consequences follow. First, a scope change means existing training is now incomplete as a matter of fact — staff cannot understand how rules apply to them if the material predates the rules. Second, the differentiated-depth expectation rules out a single generic module for the whole firm. The obligation is calibrated by role.

COCON 2.3.3G points to SUP 15.3 and SUP 15.11 for reporting breaches, which matters more now that the category of reportable conduct has widened.

Generic harassment training does not discharge this

Most firms already run workplace harassment and bullying training, and it is worth being clear that this is not the same obligation and will not satisfy it. Ordinary workplace training covers employment law duties, internal policy and reporting routes — necessary, and covered in our guide to workplace harassment training programmes. What COCON now requires is that staff understand that such behaviour can be a breach of a regulatory conduct rule attaching to them personally, with consequences for their fitness and propriety and for the firm’s reporting obligations.

Those are different lessons with different evidence. An HR module demonstrates that the employer addressed conduct. A COCON module has to demonstrate that the individual understood a regulatory rule applying to their role.

The rules themselves

For reference, the individual conduct rules in COCON 2.1 — Rules 1 to 5 effective 7 March 2016, Rule 6 effective 31 July 2023:

1. You must act with integrity.
2. You must act with due skill, care and diligence.
3. You must be open and cooperative with the FCA, the PRA and other regulators.
4. You must pay due regard to the interests of customers and treat them fairly.
5. You must observe proper standards of market conduct.
6. You must act to deliver good outcomes for retail customers.

Rule 6 is the individual-level counterpart of the Consumer Duty, explained further at COCON 2.4 and in our guide to the FCA Consumer Duty. The senior manager conduct rules at COCON 2.2 are SC1 effective control of the business you are responsible for, SC2 compliance with regulatory requirements and standards, SC3 appropriate delegation and effective oversight of it, and SC4 appropriate disclosure.

How this interacts with certification

The Certification Regime runs on a twelve-month cycle and the two obligations connect. Under SYSC 27.2.10, a certificate is valid for twelve months from issue and cannot be drafted to last longer. A firm may only issue one where it is satisfied the person is fit and proper (section 63F), and SYSC 27.2.5 requires the firm to consider in particular whether the person has a qualification, has undergone or is undergoing training, has the competence, or has the personal characteristics required.

Training is therefore an input to the certification decision rather than a parallel activity. SYSC 27.2.13 requires a record of every employee holding a valid certificate, and SYSC 27.2.15 expects fitness to be reassessed before an employee starts a function with different competence, qualification or training requirements. Regulatory references under SYSC 22 reach back six years. Conduct Rules breaches resulting in disciplinary action are reported annually, and within seven days where the individual is a Senior Manager. The regime as a whole is set out in our guide to SM&CR and the Certification Regime, and the general training and breach-reporting framework in our guide to FCA Conduct Rules and a culture of compliance.

Scale, and what it is costing the industry

The FCA estimates the change will cost the industry £75m one-off and £40m annually across 37,805 SM&CR firms, of which the new guidance accounts for £50m and £25m respectively. The rule applies to firms with a Part 4A permission under FSMA and the individuals subject to COCON and FIT. Banks are affected by the new guidance — COCON 4.3 applies to them — but not by the scope rule change, since it already applied to them.

What to do

The practical list is short. Re-issue the COCON notification so staff are notified of the rules as they now stand. Update training to cover the widened scope, with the role-differentiated depth COCON 2.3.2G expects rather than one module for everyone. Make sure managers specifically are trained on the reasonable steps guidance at COCON 4.1.8-A to 4.1.8-D. Check that breach-identification and reporting processes recognise the new category. And treat the training record as evidence for the certification decision, not as a separate compliance file.

The underlying expectation is the same one now visible across regulated sectors: the regulator asks whether the person understood and can apply the rule, not whether a course was completed. Audit firms meet the same standard through the competence and sufficient-time requirements of ISQM 1, and a culture where people will actually raise concerns is what makes any of it work — the subject of our guide to speaking up and non-retaliation in financial services.