Fewer than 7% of the roughly 37,000 firms now subject to Britain’s toughest workplace conduct regime have ever actually handled a case like this. Four weeks in, that inexperience isn’t a private HR problem anymore. It’s a regulatory one.
The Financial Conduct Authority (FCA)’s new conduct rule, COCON 1.1.7FR, came into force on 1 September 2026. Non-bank financial services firms have been subject to the FCA’s conduct rules for years, but only where misconduct was linked to a firm’s regulated activities. The new rule removes that link requirement for the conduct that matters most: serious bullying, harassment and violence towards colleagues now count as regulatory matters even when they have nothing to do with a firm’s regulated business. Asset managers, brokers, insurers and consumer credit firms now sit under conduct rule obligations that have applied to banks in this form for years.
The FCA has confirmed the change to conduct rule breaches is not retrospective. Firms are not expected to reopen past decisions about whether a conduct rule was breached. Conduct from before September can still be weighed under the separate fitness and propriety test, which has never been retrospective in that sense. Since commencement, every firm newly captured by the expanded rule must be able to identify, investigate and, where warranted, report this conduct with the rigour previously reserved for market abuse or mis-selling.
No enforcement action, supervisory statement or guidance change citing the new rule has been reported since it took effect. That is not a surprise. FCA investigations typically run for years before reaching a public outcome, so an early absence of headline cases says little about how seriously the regulator is taking this.
What the rule actually requires
COCON 1.1.7FR extends conduct rule scope so that, in the words of law firm Slaughter and May, “it is no longer necessary for the misconduct to form part of, or be for the purpose of, the firm’s regulated activities.” It is enough that conduct occurs in relation to the performance of an individual’s role, including at work social events, conferences and client functions.
The rule covers bullying, harassment (including sexual harassment) and violence towards colleagues. Discrimination is not a separate ground under this rule. Discriminatory conduct is caught only where it also takes the form of bullying, harassment or violence, though firms should still consider whether it breaches the conduct rules in other ways.
Three tests determine whether an incident engages the rule:
- Was the conduct serious.
- Was it reasonable for it to have the effect described.
- Which conduct rule, typically Conduct Rule 1 (integrity) or Conduct Rule 2 (skill, care and diligence), does it engage.
Seriousness is deliberately undefined by fixed criteria. The regulator has said it depends on context: repetition, duration, impact, seniority of the perpetrator, dishonesty, criminality and prior warnings all weigh into the assessment. As Slaughter and May put it, “not every act of unpleasantness is a regulatory matter,” which places significant interpretive weight on firms’ own judgement calls. Alongside COCON, the Fit and Proper test (FIT) allows firms to weigh a broader range of non-financial misconduct, including conduct outside work, when assessing whether an individual remains fit to hold a senior manager or certified role.
The regulator has also drawn firm boundaries around private life and social media. COCON does not reach into an employee’s personal life unless the conduct raises a genuine, non-speculative concern for the firm’s regulatory standing, such as dishonesty, abuse of trust or a serious risk to regulatory confidence. There is no general monitoring obligation, and firms are told not to investigate allegations that are trivial, implausible or irrelevant.
The readiness gap this rollout is walking into
The scale of that inexperience is worth sitting with. Industry research conducted with Mishcon de Reya, whose sample size was not published, found that 77% of firms surveyed believed the new rules would have only limited impact on their business, even though fewer than 7% had any substantive experience managing staff misconduct generally. Of firms that attended a related industry webinar, 84% said they would need external support to get their processes ready in time. The FCA’s own guidance was partly designed to cut against that last number, aiming to help firms apply the rules “with clarity and confidence, reducing the need for external advice.”
That gap is not evenly distributed. The FCA’s own 2024 baseline survey of 984 wholesale firms, covering banks, brokers and insurers already in scope, found that a high proportion of smaller firms (0 to 49 employees) reported no incidents at all across 2021, 2022 and 2023. Medium sized firms actually reported the highest incident rate of the three bands, 18.7 per 1,000 employees, ahead of large firms at 16.5 and far above small firms at 9.1. The regulator was careful to note that a low incident count is not evidence of a healthy culture. It may simply reflect under-detection rather than an absence of misconduct.
The same survey exposed structural gaps that newly captured firms are likely to share or exceed. 38% of respondents said their board or board level committee received no management information on non-financial misconduct at all, and 33% had no formal governance structure for deciding outcomes and disciplinary action, though the FCA notes this figure may include some respondents without a regulated entity level board. Not all firms even had a current whistleblowing policy in force. If those numbers held among sophisticated wholesale banks and insurers already subject to the rule, the operational deficit among 37,000 newly captured firms, many with no conduct rule experience whatsoever, is likely to be more acute.
| Governance element | FCA baseline finding (existing in scope firms) | Implication for newly captured firms |
|---|---|---|
| Board level reporting on non-financial misconduct | 38% of firms had none | Likely lower among firms new to conduct rule regimes |
| Formal governance structure for outcomes | 33% had none | Cross functional HR, legal and compliance protocols largely absent |
| Substantive experience managing misconduct cases | Fewer than 7% of firms surveyed | Core readiness gap driving demand for external support |
| Regulatory reference disclosure practice | 92% said they would include findings, but volumes remain small (43 references in 2023) | Untested process for many firms |
A test case that predates the rule
The most prominent recent ruling on personal conduct in UK finance has nothing to do with COCON 1.1.7FR, and that is worth being explicit about. On 14 September 2026, the Upper Tribunal upheld the FCA’s ban on hedge fund manager Crispin Odey, though it reduced his fine from £1.83m to £1.53m after finding no justification for an uplift for aggravating factors. The FCA’s press release describes Odey as having bullied and threatened his executive directors and twice dismissed Odey Asset Management’s executive committee to derail a disciplinary process concerning his conduct towards female staff. Therese Chambers, the FCA’s executive director of enforcement and market oversight, said the findings show “a complete disregard for proper governance” that leaves Odey “unfit to work in financial services.”
The case was brought and decided under the FCA’s existing integrity and fitness and propriety framework, for conduct that predates the new rule by years. It is not a COCON 1.1.7FR enforcement action. But commentators have drawn a direct line between the case and what the new rule is designed to address. Claire Cross of Corker Binning, a former FCA enforcement lawyer, has noted the findings “raise many of the very issues that the new non-financial misconduct framework is designed to address.” For newly captured firms, the ruling is a useful signal of the FCA’s underlying seriousness about governance failures around personal conduct, even without being a precedent under the new rule itself.
Supervisory calibration: proportionate, but not indefinitely patient
The FCA’s institutional posture is explicitly proportionate and risk based. It targets supervisory attention toward firms and business models where misconduct would cause the most harm, using intelligence gathered from complaints data, whistleblowers and its Supervision Hub. Having finished its policy work with Policy Statement PS25/23, the regulator has said its supervisory focus will now centre on how firms are actually putting the rules into practice.
That does not mean immediate enforcement sweeps. The FCA has been explicit about what firms do not need to do:
- No retrospective reassessment of past conduct rule breach determinations.
- No monitoring of private lives or social media.
- No action on trivial or implausible allegations.
But it has equally said it will act where firms fail to adhere to its rules, and will draw on its supervisory work, including its Regulatory Priorities reports, Dear CEO letters where warranted, and direct engagement with individual firms, to follow up on the survey and supervisory data it already holds. For newly captured firms, near term supervisory attention is likely to fall on whether basic infrastructure exists at all: a whistleblowing channel, a defined escalation path, and board level visibility that incidents are being tracked.
Building the plumbing: what firms are doing now
Legal advisers converging on similar action points suggest a reasonably consistent implementation playbook is emerging across the newly captured population. Priorities cluster around five areas:
- Staff communications and training, so employees understand how the new rule applies to them under section 64B of the Financial Services and Markets Act (FSMA) and COCON 2.3.
- Cross functional protocols linking human resources, legal and compliance, so incidents are triaged consistently.
- Procedurally fair investigation standards capable of surviving both regulatory and employment tribunal scrutiny.
- Scenario based manager training addressing when reasonable steps have or have not been taken.
- Revised regulatory reference processes that can capture serious, substantiated findings without overreach.
Firms are also having to draw a harder line between the narrower COCON test, confined to work related conduct, and the broader FIT assessment, which can pull in private life conduct only where it creates a genuinely material regulatory concern. Under-scoping exposes firms to supervisory criticism, while over-scoping risks employment law and privacy claims from staff who feel their personal lives are being policed.
Regulatory references become the enforcement mechanism that matters
Perhaps the most consequential downstream change is on regulatory references. Serious, substantiated non-financial misconduct findings must now be captured in references in the same way financial misconduct already is, closing a loophole that allowed individuals to move between firms with a clean record despite known conduct issues.
The FCA’s baseline data shows this practice is still relatively immature even among experienced firms. References containing non-financial misconduct information rose from 16 in 2021, to 21 in 2022, to 43 in 2023, across the entire wholesale banking, broking and insurance population. Firms must distinguish between mandatory disclosures, where a conduct rule breach has been established and disciplinary action taken, and other fitness and propriety information that may be included only where relevant, fair and accurate. Legal advisers flag genuine litigation exposure here: claims for negligent misstatement in references, or for reputational and psychiatric harm arising from investigation processes, sit in areas of uncapped compensation.
What comes next
Enforcement action citing COCON 1.1.7FR specifically is unlikely for some time. FCA investigations that reach a public outcome have historically taken years to conclude, and the regulator’s own no retrospection commitment further limits what an early case could look like. The Odey ruling shows the FCA is willing to pursue serious governance and integrity failures under its existing tools, but it is not evidence of how the new rule itself will be applied.
The more immediate marker to watch is the FCA’s Annual Public Meeting on 6 October 2026, one of the first public forums where the regulator could comment on how the rollout is landing. Beyond that, the real test of this rollout will show up first in ordinary supervisory activity: whether newly captured firms can demonstrate that a whistleblowing channel, a clear escalation path and board level visibility actually exist, not in any early enforcement headline.
