FCA PS26/6: What the New Non-Financial Misconduct Rules Mean for Your Board

From 1 September 2026, non-financial misconduct becomes an explicit, enforceable conduct matter for every SM&CR firm. For small and growing financial services firms, this is not a compliance footnote, it is a governance test.

Earlier this year, the FCA published Policy Statement PS26/6, the first phase of its long-anticipated review of the Senior Managers and Certification Regime (SM&CR). While most of the operational and administrative changes in PS26/6 took effect from 24 April 2026, one element has been deliberately held back: the conduct rule changes aligned with the FCA's separate policy statement on tackling non-financial misconduct (PS25/23). These provisions come into force on 1 September 2026, and they mark a genuine shift in how boards and senior managers will be expected to identify, assess and act on behaviour that has nothing to do with financial transactions at all.

For firms without large compliance functions, this is one of those regulatory moments where "we'll get to it" is not a viable strategy. Here is what is changing, and what boards of small and growing firms need to do now.

What is actually changing

The headline change is a new rule, COCON 1.1.7FR, which extends the Conduct Rules in non-banking firms to explicitly cover bullying, harassment and violence against colleagues, where there is a sufficient link to an individual's role. Previously, this territory sat in a grey area, arguably a matter for HR policy and employment law, only loosely connected to regulatory conduct obligations. From 1 September 2026, that ambiguity is gone. Serious bullying, harassment or victimisation by anyone subject to the Conduct Rules can now constitute a breach of Individual Conduct Rule 1, the requirement to act with integrity.

Alongside this, the FCA has published new Handbook guidance clarifying how firms should apply both COCON and the Fit and Proper (FIT) regime to non-financial misconduct. This guidance addresses several questions that have long troubled boards: where the boundary sits between an employee's private life and their professional conduct; how allegations that are unproven, historic, or arising from social media activity should be weighed in fitness and propriety assessments; and what "reasonable steps" a manager must take to prevent and respond to misconduct in their team.

Importantly, the FCA has been careful to set limits. The new rule will not apply retrospectively, and firms are not expected to proactively monitor employees' private social media or investigate implausible or trivial allegations. The test is proportionality, but proportionality applied consistently and defensibly, which is a different and harder standard than simply "using judgement."

Why this matters at board level

For a small firm, the temptation is to treat this as an HR update. That would be a mistake. The FCA's own position is unambiguous: non-financial misconduct is now a potential indicator of wider regulatory risk, going directly to an individual's integrity and judgement, the same qualities the SM&CR was built to test.

That reframing has three direct consequences for the board and senior managers:

• Accountability becomes personal. Where a Senior Manager holds responsibility for culture, conduct, or people matters, they will need to be able to demonstrate, not simply assert that reasonable steps were taken to prevent misconduct and that escalation, when it occurred, was timely and proportionate. Statements of Responsibilities and Management Responsibilities Maps should be reviewed now to confirm they reflect this.
• Evidence and documentation standards rise. Disciplinary and investigation records will need to be structured so that relevant findings can feed directly into fitness and propriety assessments and, where applicable, regulatory references. A file note buried in an HR system that compliance cannot easily retrieve is no longer good enough.
• Judgement calls need a defensible framework. Boards will increasingly be asked, implicitly or explicitly, "how did you decide this allegation was, or was not serious enough to escalate?" Firms need a documented triage process, not an ad hoc one.

Practical implications for conduct rules training

Conduct Rules training is an obvious pinch point. Training that has historically focused on market abuse, financial promotions and treating customers fairly will need to be refreshed to explicitly cover the expanded scope of Conduct Rule 1, using real, sector-relevant scenarios around bullying, harassment and the work/private-life boundary. Senior managers and certified staff should be able to articulate, in plain terms, when private conduct could reasonably affect their fitness and propriety, because that is precisely the judgement the FCA now expects them to be equipped to make.

Practical implications for disciplinary processes

Existing disciplinary policies were largely designed around employment law requirements, not regulatory ones. From September, small firms should expect to align the two: ensuring investigation outcomes are captured in a form usable for FIT assessments, that escalation triggers are clearly defined and consistently applied, and that HR and compliance functions, often the same one or two people in a small firm have a shared, documented understanding of what constitutes a reportable breach.

A practical starting point, not a scramble

The good news is that PS26/6 gives firms a defined runway to prepare, and the FCA has signalled it wants firms to apply judgement rather than build disproportionate monitoring regimes. For small and growing firms, this is an opportunity to build governance that is right-sized and defensible from the outset, rather than retrofitting a large-firm compliance framework that doesn't fit.

The firms that will be best placed on 1 September are those that start now: reviewing Conduct Rules training content, testing whether disciplinary and HR records would withstand regulatory scrutiny, and giving the board a clear, current picture of where responsibility for these matters sits.

Oakbridge Agility works with financial sector boards to translate regulatory change like PS26/6 into governance that actually holds up under scrutiny, proportionate, well-evidenced, and built for firms without large compliance teams. If you would like a straightforward review of how prepared your board and processes currently are for the 1 September 2026 changes, get in touch with our team today to arrange a readiness conversation.

For the FCA's own guidance on non-financial misconduct, visit fca.org.uk/firms/culture-governance/non-financial-misconduct.

This article is provided for general information and does not constitute regulatory or legal advice. Firms should seek advice specific to their circumstances.