Non-Financial Misconduct is now an FCA Conduct issue, firms need evidence, not just policies

From 1 September 2026, the FCA’s new Non-Financial Misconduct (NFM) rules and guidance are in force. This is an important extension of individual accountability and firms’ responsibilities for governance, culture and conduct.

The FCA’s position is clear. Non-financial misconduct can include serious bullying, harassment and violence, and the new COCON 1.1.7FR extends the scope of the Conduct Rules for non-banks where there is a sufficient connection between the behaviour and an individual’s role. The intention is to bring greater consistency between banks and the approximately 37,000 other regulated firms affected. (FCA)

The significance for firms is that NFM can no longer be viewed principally as an HR issue. It now sits firmly within regulatory governance, individual conduct and risk management.

From culture to regulatory evidence

The FCA has consistently linked poor culture with conduct failures. Its new rules provide firms with a clearer framework for deciding when behaviour becomes a regulatory matter.

The final guidance makes important distinctions. COCON does not simply extend into employees’ private lives. However, the Fit and Proper (FIT) assessment is broader. Serious behaviour outside work can be relevant where it indicates a material risk that an individual could breach regulatory standards, demonstrates disregard for legal or ethical obligations, abuses a position of trust, or could undermine confidence in financial services. (FCA Handbook)

Equally, firms are not expected to monitor employees’ private lives or social media routinely, investigate trivial or implausible allegations, or retrospectively reassess previous Conduct Rule decisions. Proportionality and judgement remain central. (FCA)

This distinction matters. Firms need processes capable of identifying what happened, whether it is in regulatory scope, how serious it is, what action was taken and what evidence supports that decision.

The FCA’s final Policy Statement reinforces this. Firms need to consider seriousness, repetition, duration, impact, seniority and power imbalance, previous warnings or disciplinary action and whether conduct may be criminal or justify dismissal. A single serious incident can also fall within scope.

Management accountability also matters

NFM is not solely about the individual accused of misconduct.

The new COCON guidance addresses the responsibilities of managers. Managers should take reasonable steps to prevent relevant misconduct, operate appropriate policies and controls, respond properly to complaints and provide an environment in which people can raise concerns.

Importantly, accountability is proportionate to what a manager knew or reasonably should have known, their authority and their ability to act. (FCA)

This makes governance evidence particularly important. A policy sitting on SharePoint does not demonstrate that a firm understands its NFM exposure or is managing it effectively.

How Model Office supports NFM governance

Model Office has therefore introduced a dedicated Non-Financial Misconduct regulatory module, enabling firms to move from policy-based compliance towards structured NFM oversight.

The module enables firms to benchmark their existing governance arrangements against the new FCA requirements and identify gaps across areas including Conduct Rules, FIT assessments, policies, management responsibilities, reporting, regulatory references, training and monitoring.

More importantly, firms can use Model Office to create an ongoing evidence base around NFM risk: recording assessment results, identifying weaknesses, allocating remedial actions, tracking progress and providing management with data-led oversight of whether the required controls are actually operating.

This creates a repeatable governance workflow process:

Benchmark → identify risk → allocate action → track remediation → monitor → evidence oversight.

That is increasingly important because the FCA has stated that its policy work on NFM is now complete and its focus will turn to how firms are tackling it in practice. (FCA)

For boards, Compliance Officers and Senior Managers, that changes the question.

It is no longer simply: Do we have an NFM policy?

It is: Can we demonstrate that we understand our NFM risks, have appropriate controls, make consistent regulatory decisions and can evidence effective management oversight?

That is the standard firms should now be working towards.

FCA: Non-financial misconduct in financial services

Please click the below icon to learn more about MO RegTech today..