On 1st September this year some major changes to the FCA’s rules around non-financial misconduct by staff and employees in regulated firms came into force. First set out in a policy statement published in December 2025, these changes represent the culmination of a long process of debate between the regulator and the industry.

The changes affect two parts of the FCA’s handbook: the “Code of Conduct” (known as COCON), which focuses on work-related misconduct; and the “Fit and Proper” Test (“FIT”), which firms and the FCA use when assessing the suitability, including the fitness and propriety, of an individual to be certified or a Senior Manager.

One major reason for the FCA’s new rules and guidance in this area is a desire on the part of the regulator to give greater clarity to firms and individuals around how they should approach bullying, harassment and other forms of non-financial inappropriate behaviour in the workplace.

But confusion may remain, especially in those grey areas between the personal and professional spheres of life.

Evolving social mores, ever-changing communication technologies, and the fact that working life can be busy and pressurised, may mean questions such as “what photos can I send to colleagues in a WhatsApp group?” or “am I allowed to make risqué jokes at work?” may be difficult to answer.

Here, Hickman & Rose’s Christina Papanastasiou sets out the basics of the FCA’s new rules and guidance under COCON, and how it is likely to apply in some hypothetical, example situations. A future article will explore the changes to FIT.

What does the FCA consider to be non-financial misconduct?

The FCA does not list every possible form of behaviour it considers could amount to non-financial misconduct and a potential COCON breach.

It does not do this because – as it explains – “each case requires individual judgement based on its specific circumstances”.

Instead, the regulator defines non-financial misconduct as “any misconduct not of a clearly financial nature” and identifies three broad forms. These are:

– bullying;

– harassment; and

– violence towards colleagues (which could include verbal and physical violence).

In relation to the first two of these (‘bullying’ and ‘harassment’) the FCA states that these behaviours denote “unwanted conduct that has the purpose or effect of violating a colleague’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them”.

Can any non-financial misconduct trigger a COCON investigation?

The FCA’s updated policy confirms the existence of a seriousness threshold for non-financial misconduct. The COCON rules are supplemented by guidance intended to assist in identifying whether this threshold has been met.

This means (or should mean) that minor incidents of poor workplace behaviour, and minor disagreements between colleagues, should not be considered a potential COCON breach.

Harassment (for which there is particularly lengthy guidance) should only be considered for investigation if it holds the potential to have violated an individual’s dignity or to have created an intimidating, hostile, degrading or offensive environment.

The way in which the recipient of alleged harassment perceives the behaviour can be a factor in determining its seriousness. So too can the alleged harassment’s purpose. Conduct which is intended to cause a prohibited effect can be considered a breach even if it is not fully enacted.

How to determine whether alleged behaviour falls under COCON rules

A major issue in many FCA non-financial misconduct cases is the need to establish whether the alleged behaviour falls within the scope of the relevant COCON rules.

This is not always a straightforward task.

In banks, the technical scope of the rules has not changed. COCON still applies in relation to ‘any activities’ conducted by the firm.

In non-banks, however, the situation has changed. Here, COCON previously only applied to conduct that formed part of, or was for the purpose of, the financial services activities of the firm. However, applying this restriction to non-financial misconduct would have been difficult (and potentially unfair). The FCA has modified the scope of COCON for non-banks to mean that non-financial misconduct towards colleagues will be within the scope of COCON when it occurs in relation to the performance of the individual’s role, and either the perpetrator or the subject deals with the financial services activities of the firm.

Complexities remain however, and the FCA has come up with a series of flow diagrams and tables designed to help in a person and/or their employer determine:

1. Whether the COCON is relevant to a specific situation and, if so;
2. Whether the alleged behaviour is of a kind to which the COCON rules apply.

While these diagrams aim to simplify application of the rules, they are dense and require a significant degree of cross-referencing to understand. Firms and individuals, especially outside of banks, will need to study them closely before taking action.

Where does the FCA draw the boundary between private and professional environments?

The question of COCON’s scope inevitably also involves the question about where the line is drawn between private and professional behaviour.

The FCA is explicit that a regulated person’s private life lies outside its regulatory ambit. It states: “private or personal life is entirely out of scope of the FCA’s power to make and enforce conduct rules for individuals”.

But this is not the full story.

The COCON rules apply to only conduct which has a “sufficient connection” to work and which relates to the individual’s role and the firm’s activities.

In an attempt to define “sufficient connection” the FCA published a table of scenarios showing when conduct is generally within scope of COCON (work context) and when it is generally outside scope (private life).

Some examples of conduct which is usually within scope (and for which COCON therefore applies) are:

• Misconduct toward a colleague on firm premises or while working remotely for the firm.
• Misconduct while travelling to a meeting where you represent the firm.
• Misconduct at firm‑organised social occasions.
• Misconduct at client or industry events (e.g., training, awards, workshops) where attendance is tied to your job.

Some examples of conduct which is usually outside COCON’s scope are:

• Misconduct toward family while working from home;
• Misconduct at a purely private social event organised in a personal capacity (with important caveats for manager‑organised gatherings or “after‑parties” that are a continuation of firm events).

NB: it should be remembered that conduct both inside and outside of the workplace may be relevant to a person’s fitness and propriety under FIT (which will be explored in a separate article).

How can an FCA-regulated individual properly engage with social media?

The question of how an FCA-regulated person can appropriately engage with social media platforms / communications technologies such as Instagram, Facebook, X and others is a vexed one.

This issue is primarily relevant to determinations under FIT, rather than COCON, but it would be a mistake to assume that social media activity (especially on a professional focused social media platform like LinkedIn) might not also engage COCON, simply because social media can feel like a part of a person’s private life.

Conduct on social media may fall within the scope of COCON where there is a sufficiently close connection to the workplace.

For example: bullying, harassing or threatening conduct which would amount to a breach of the conduct rules in the office, will also do so also when carried out through social media, provided the conduct is sufficiently connected to work. Relevant factors may include whether the conduct is directed at a colleague or other member of the workforce, relates to work at the firm, forms part of a wider pattern of workplace-related conduct, or occurs through work-related communications channels.

The FCA guidance suggests that the critical issue is not whether the conduct occurred on a personal social media account, but whether the conduct has a sufficiently close connection to the workplace to justify the application of COCON.

By contrast, social media activity that is genuinely private and lacks a sufficient connection to the workplace will generally fall outside the scope of COCON. The assessment is therefore highly fact specific.

Some example FCA non-financial misconduct scenarios

Drawing on the FCA’s guidance, the following scenarios are designed to illustrate how alleged conduct that does not strictly take place at work may still be relevant to the conduct rules:

“Am I allowed to share personal holiday photos with work colleagues?”

Usually yes, but context and impact matter.

Friendly, welcomed sharing of photos is fine. Problems arise if images are inappropriate, unsolicited or repeated after a colleague signals discomfort, and especially if there’s a power imbalance.

The FCA’s seriousness factors (such as repetition, duration, impact, seniority) and its “purpose/effect” test for harassment are central here. Even if you didn’t intend to offend, the effect on the recipient (assessed for objective reasonableness) could make conduct a breach when serious.

“If something happens at a client drinks event, does the FCA care?”

The FCA considers client‑organised events and industry gatherings as situations closely connected to work, where misconduct would be relevant.

This includes award ceremonies, workshops and training days where attendance stems from your role. If the behaviour breaches the harassment standard and is serious, it could constitute a breach of the conduct rules.

“Does workplace ‘banter’ count as non-financial misconduct?”

Potentially. The FCA emphasises effect and purpose and will consider the recipient’s perception and whether it is reasonable to conclude that the conduct had a prohibited effect.

Conduct that can violate dignity or create a humiliating environment – especially if targeted or repeated – may constitute misconduct, even if some consider it “banter”.  

“If something happens outside work but a colleague is there, does that count?”

It depends on the connection to work.

A private event organised in someone’s personal capacity will generally fall outside the scope of COCON rules. But if the event is organised by a manager in a way that implies attendance is expected, or if it’s a continuation of a firm event (same group, different venue), the work nexus can persist.

Even where COCON doesn’t bite, conduct may still be relevant to a regulated individual’s fitness and propriety if it indicates a material risk or is otherwise sufficiently serious.

“Can misconduct towards a client breach COCON?”

The FCA’s new rules on non-financial misconduct are primarily focused on work-related misconduct involving colleagues. However, this does not mean that misconduct towards clients falls outside the wider scope of COCON, where this occurs during an individual’s work.

The FCA’s guidance specifically gives the example of misconduct towards a client at a business meeting where the individual is representing their firm, as conduct that would fall within the scope of COCON. More generally, where misconduct occurs in dealings with clients as part of an individual’s professional activities, the conduct may be found to breach the conduct rules.  

Seeking advice on FCA non-financial misconduct

Changing social mores, rapid technological developments, uncertainty about rules, and plain confusion can all make it easy for an individual working in the financial services sector to unwittingly find themselves facing the threat of disciplinary or regulatory action.

The distinction between conduct that is merely inappropriate and conduct that must be reported is not always straightforward.

Anyone in who finds themselves facing the prospect of investigation for non-financial related misconduct is urged to seek professional advice from a specialist regulatory lawyer to help them navigate what can be a difficult decision-making process with profound potential consequences.

Speaking to a specialist lawyer early can help you understand how your firm or the FCA is likely to view the incident, what contextual factors matter, and whether the alleged behaviour falls within the scope of the rules at all.