Legislation in Focus: Bullying, Harassment and the FCA Conduct Rules

The Financial Conduct Authority has extended its conduct rules, the standards of behaviour it sets for people working in financial services, so that serious bullying, harassment and violence count as misconduct in around 37,000 more firms. The change took effect on 1 September 2026 and reaches regulated firms that are not banks. Until then it was often unclear when this behaviour amounted to a conduct rules breach in such a firm. Guidance on how the same behaviour bears on a person's fitness for their role took effect on the same day.

Key takeaways

• What changed. Before 1 September 2026 it was often unclear when serious bullying or harassment amounted to a conduct rules breach in a firm that is not a bank. Since that date the conduct rules reach it.
• Which firms. Banks were already covered. The change reaches around 37,000 other regulated firms, and it leaves out firms outside the regime, such as payments and e-money firms.
• Which behaviour. Unwanted conduct that violates somebody's dignity or creates a hostile environment for them, and violence. Discrimination and victimisation were not brought in, though the FCA asks firms to consider whether such conduct could still breach a conduct rule.
• What it means for a reference. No reference rule changed on 1 September 2026. What changed is the conduct a reference can be required to disclose.
• What it means for fitness checks. No new duty arrived, but the guidance now names two findings it did not name before, one from a tribunal or a court and one from a firm's own disciplinary process.

What the conduct rules are, and who they covered before

The conduct rules are a short set of standards the FCA writes for individuals rather than for firms. They sit inside the Senior Managers and Certification Regime, the rules that make named individuals personally accountable for what happens on their watch. They bind the people the Handbook calls conduct rules staff, which is not everybody a firm employs.

At a bank those rules already reached conduct across the business. In other regulated firms they reached it primarily where the behaviour was tied to the firm's financial services activity, and that link was hard to make for bullying between colleagues.

Announcing the change, the FCA said that "previously, it was often unclear when these types of behaviours would amount to a conduct rules breach in a firm other than a bank". The same conduct could therefore be a clear breach at a bank and an open question at an investment firm.

What it means to break a conduct rule

A firm that concludes somebody has broken a conduct rule takes on obligations that an ordinary disciplinary outcome does not create.

The firm may have to tell the regulator. Disciplinary action has a narrow meaning in this context, covering a formal written warning, suspension, dismissal, or cutting or clawing back pay. Where a firm takes such action against somebody and the reason is conduct that broke a conduct rule, it must notify the FCA.

For everybody below senior manager level those notifications go in once a year on a single form, and a firm with nothing to report sends nothing. Disciplinary action on its own does not trigger the duty, because the conduct also has to break a conduct rule.

The same facts bear on whether the person is fit and proper. The FCA's view is that the most important considerations are a person's honesty, integrity and reputation, their competence and capability, and their financial soundness.

Firms assess that at least once a year for senior managers and for certified staff, whose firm signs off each year that they are fit and proper for the role.

The record can also follow the person. Disciplinary action for a conduct rule breach is disclosable in a regulatory reference, which is the reference a regulated firm must give about a current or former employee when another regulated firm asks for one.

Most employers close a bullying case with the disciplinary outcome and the file stays in the building. At a regulated firm those same facts may reach the regulator, sit in a file the firm revisits every year, and follow the person to a future employer for six years, with no time limit where the misconduct is serious.

Why the FCA made the change

The FCA had been saying for years that this behaviour was already misconduct.

Megan Butler, then an executive director at the FCA, told a committee of MPs in September 2018 that "we view sexual harassment as misconduct which falls within the scope of our regulatory framework". The Treasury Committee reported in March 2024 that "there has been a disappointing lack of progress on sexual harassment and bullying, including serious sexual misconduct".

The FCA then surveyed over 1,000 investment banks, brokers and wholesale insurance firms and published the findings in October 2024. Across 2021 to 2023, bullying and harassment came out as the most recorded concern at 26%, with discrimination at 23%.

A further 41% fell into an "other" group, which the FCA said "indicates how difficult it can be to categorise issues of personal misconduct".

In March 2025 the FCA's chief executive, Nikhil Rathi, told the Treasury Committee that the regulator did "not currently plan to publish new rules on diversity and inclusion". In the same letter he said the FCA would continue to prioritise its work on non-financial misconduct, or NFM, which is the term the regulator uses for misconduct that is not of a clearly financial nature.

One half of the package was dropped and the other half went ahead.

The FCA confirmed the rule in July 2025 and gave firms fourteen months to prepare. Sarah Pritchard, its deputy chief executive, said then that "behaviour like bullying or harassment going unchallenged is one of the reddest flags", because a culture where it happens "can raise questions about a firm's decision making and risk management". The guidance followed in December 2025.

What the rule now covers

The rule catches unwanted conduct that has the purpose or effect of violating somebody's dignity, or of creating an intimidating, hostile, degrading, humiliating or offensive environment for them. It separately catches conduct that is violent towards them.

The people it protects are not only employees. The rule reaches conduct towards six groups.

• anyone who works for the firm or a company in its group
• anyone who performs a function for either
• anyone who provides services to either
• the employees of a service provider
• anyone who performs a function for that provider
• anyone carrying out an activity that forms part of the firm's own activity.

The rule itself never uses the word serious. The FCA's guidance supplies it, saying the rule "only covers conduct that is serious", and the guidance lists what the regulator will weigh in deciding. Among the nine factors are:

• whether the conduct is repeated or part of a pattern, and how long it went on
• the size of the impact on the person it was directed at, which the guidance limits to effects that are "serious and marked" rather than real but lesser
• the seniority of the person responsible, and whether they had control or influence over the other person's career
• whether they had been warned or disciplined for similar conduct before, by the firm, a previous employer, the police or a regulator
• whether the conduct is criminal, or would justify dismissal.

What the rule does not cover, and where banks stand

The rule does not work by naming categories of wrongdoing. It describes behaviour by what it does to a person, so conduct that humiliates or degrades a colleague is caught whatever label it carries.

Discrimination and victimisation were not brought inside the conduct rules for firms that are not banks. The FCA said the rule "covers sexual harassment but does not expand the scope of COCON in non-banks to cover other forms of conduct prohibited by the Equality Act, such as discrimination and victimisation". COCON is the FCA's Code of Conduct, which is where the conduct rules are written down.

In the same answer the FCA asked firms to keep thinking about it. They "should consider whether misconduct of these kinds, and other forms of NFM, may nevertheless be a potential breach of the conduct rules", and whether it does "will depend on whether the conduct falls within the scope of COCON as it applies to that firm".

The rule also leaves out a firm's business that has nothing to do with financial services, and the rule does not reach payments firms, e-money firms, investment exchanges or credit ratings agencies.

The rule says on its face that it applies to a firm inside the regime other than a bank. Banks are not exempt. The conduct rules at a bank were already wider, carrying no restriction based on whether conduct relates to a work colleague. Banks also sit inside the package, because the FCA applied its new harassment guidance to them expressly.

Does your fitness assessment need to change?

Nothing a firm must do changed here. The fitness rules are guidance from beginning to end, and the FCA describes the new material as "a clarification of our current approach to assessing fitness and propriety". It says firms are not expected to revisit assessments they have already made.

The list of matters a firm should have regard to gained two items on 1 September 2026. One covers a finding of harassment, victimisation or discrimination by a tribunal or a court. The other covers a finding of harassment, bullying, victimisation or discrimination following an internal disciplinary process.

That list has always been open-ended, describing matters that "include, but are not limited to" the ones written down. Separately, the offences a firm should weigh now expressly include offences of violence, sexual offences, and offences related to demographic characteristics such as racially motivated or aggravated offences.

The practical question is whether the annual fitness questionnaire a firm issues to senior managers and certified staff needs rewriting. No obligation changed, so nothing forces a rewrite. The guidance applies to every firm inside the regime, banks included, and names two findings for the first time.

The FCA publishes indicators of what a healthy fitness process looks like, and the two halves are worth reading together. It lists as positive that "F&P checks identify new issues with staff – some fail", and as negative that "F&P checks identify nothing new; a 'rubber stamp' exercise."

What a regulatory reference has to disclose

No rule about references changed on 1 September 2026. What changed is the conduct those rules can require a firm to disclose.

A firm does not have to ask for a regulatory reference every time it hires. It has to ask in three situations. The first is appointing somebody to a controlled function, which is a senior role the FCA approves itself. The second is issuing a certificate under the certification regime.

The third is appointing a board director, and that one applies only where the appointing firm is a core or an enhanced firm. In each case the firm must take reasonable steps to obtain regulatory references from the current employer and from everybody who employed the person in the past six years.

The mandatory template asks whether the firm has taken disciplinary action relating to conduct that "amounts to a breach of any individual conduct requirements" that applied to the person. The Handbook defines the individual conduct requirements, and the conduct rules are one of them.

The conduct rules widened on 1 September 2026, so the conduct capable of triggering that disclosure widened with them, and the reference rules did not have to change. The FCA put it this way in July 2025. "Serious, substantiated cases of poor personal behaviour will also need to be shared through regulatory references, in the same way financial misconduct currently is, making it harder for individuals to avoid consequences by moving from firm to firm."

Four further details matter to whoever completes the form.

• The firm giving a reference must disclose everything it is aware of that it reasonably considers relevant to the receiving firm's assessment of whether the person is fit and proper. That duty is wider than the template's questions.
• Most of what must be disclosed reaches back six years. For serious misconduct there is no time limit.
• Where a firm concluded that somebody broke a conduct rule but took no disciplinary action, the FCA's guidance says it should not go under the disciplinary question. It should go under the catch-all question where it would be reasonable to consider it relevant.
• A firm that has already given a reference must go back and correct it if it later takes disciplinary action that would have made the reference materially different. That duty runs for six years after the person leaves.

Does the change apply to older cases?

Partly, and the answer is different for the conduct rules, for a fitness assessment and for a reference.

The FCA says the new conduct rule does not have retrospective effect, and that misconduct occurring before 1 September 2026 should be handled under the version of the Handbook that was in force at the time. A reader should not take that as meaning the older behaviour sat outside the rules. The FCA also says the conduct rules at banks were already wider than at other regulated firms, and that the narrower scope elsewhere made it harder, rather than impossible, to link this behaviour to a firm's financial services activities.

Fitness is a separate question with a different answer. The FCA's position is that the version of the fit and proper test to apply is the one in effect at the date of the assessment, and that this may take account of earlier incidents. A firm assessing somebody now can therefore weigh a disciplinary finding of bullying from 2024.

The FCA published the position in a policy statement, not in the rules, and the FCA does not expect firms to revisit assessments they have already made.

For a reference the date is not the decider either. The disciplinary question turns on whether the conduct breached the rules as they stood at the time and whether the firm took disciplinary action. The wider duty to disclose anything relevant to fitness can reach a matter that was never a breach at all.

One question has no answer in any of this. The FCA has said nothing about conduct that began before September and carried on after it.

What has not changed

• No reference rule changed on 1 September 2026. Every recent change in that chapter dates from 24 April 2026 and came out of a separate review of the regime.
• The conduct rules still do not reach private and personal life, and the rule leaves a firm's non-financial-services business alone.

What to look at in your own checks

Where a firm appoints somebody to a senior role, certifies them, or puts them on the board, the reference request and the fitness file are where this change lands. Both were already part of the process, and what has moved is the range of conduct they can be asked to carry.

One deadline moved earlier in 2026, and the change came from the review of the regime rather than from the conduct rules. Since 24 April 2026 the FCA expects a firm answering a reference request to respond within four weeks, shortened from six.

The FCA's guidance says a firm asking for a reference should give the firm answering it enough information to know that these requirements apply and which ones.

The fitness and propriety declaration a candidate completes is the natural place to reach the matters the guidance now names, alongside the FCA regulated reference itself. Where the guidance's expanded list of offences is relevant to the role, a criminal record check reaches them.

The FCA was not the only one moving

Employers have owed a duty to take reasonable steps to prevent sexual harassment of their employees since 26 October 2024, under the Equality Act. Since 6 April 2026 a disclosure that sexual harassment has occurred, is occurring or is likely to occur counts as a qualifying disclosure for whistleblowing, which means the person making it is protected from being penalised for it.

Two further measures would strengthen that duty and make employers liable for harassment by third parties, and neither is law yet. The government has said both are expected from 30 October 2026, and on 4 September 2026 the legislation still recorded them as prospective with no commencement date.

What is still coming

The FCA has treated its own policy work here as finished. Its policy statement says the publication "brings our policy work on NFM to a close" and that the regulator "will now focus on how firms are tackling it in practice". It has promised no review, no survey and no date.

The FCA finished the first phase of its review in April 2026 and said that if the Treasury's proposed changes proceed, it expects to consult on a second phase later in the year. No such consultation had appeared by 4 September 2026. A bill before Parliament would remove the certification regime from the legislation altogether, including annual recertification, and it had not completed its passage by that date.

Next steps for employers

1. Establish whether the new rule reaches your firm. It applies to regulated firms that are not banks, and not to firms outside the regime.
2. Check that your policy on bullying and harassment says what happens next in regulatory terms, not only in employment terms, so a manager handling a case knows a notification and a future reference may follow.
3. Read the two new items in the fitness guidance against the questions your annual assessment already asks, and decide whether the questions reach them.
4. Agree who decides, and on what evidence, whether conduct that led to disciplinary action also broke a conduct rule. That judgement starts the notification and the reference disclosure.
5. For any case open now, work out which of those two things it triggers, and check whether you have already given a reference for anybody involved.

Key sources

1. FCA Handbook, COCON 1, the conduct rules and who they apply to, including the new rule in force from 1 September 2026. Read here
2. FCA Handbook, COCON 4, whose section 4.3 carries the guidance on harassment in force from 1 September 2026. Read here
3. FCA Handbook, SYSC 22, regulatory references, including the template and the six-year period. Read here
4. FCA Handbook, SUP 15.11, notification of conduct rule breaches and disciplinary action. Read here
5. FCA Handbook, FIT 1, the general guidance on fitness and propriety, including the list of offences a firm should weigh. Read here
6. FCA Handbook, FIT 2, the matters a firm should have regard to, including the two added on 1 September 2026. Read here
7. FCA, PS25/23, "Tackling non-financial misconduct in financial services: Guidance in the Code of Conduct (COCON) and the Fit and Proper test for Employees and Senior Personnel (FIT) sourcebooks", 12 December 2025. Read here
8. FCA, "FCA clarifies expectations on bullying, harassment and violence to deepen trust in financial services", 2 July 2025. Read here
9. FCA, "Culture and non-financial misconduct survey - findings", published 25 October 2024. Read here
10. FCA, "Fitness and Propriety (F&P)", the page carrying the positive and negative indicators quoted above. Read here
11. FCA, PS26/6, the Senior Managers and Certification Regime review, April 2026. Read here
12. Letter from Megan Butler, FCA, to the Women and Equalities Committee, 28 September 2018. Read here
13. Letter from Nikhil Rathi, FCA, to the Treasury Committee, 11 March 2025. Read here
14. Treasury Committee, "Sexism in the City", 8 March 2024. Read here
15. Equality Act 2010, section 40A, the duty to take reasonable steps to prevent sexual harassment. Read here
16. Employment Rights Act 2025, section 23, in force 6 April 2026, on disclosures about sexual harassment. Read here
17. Employment Rights Act 2025, section 20, which would strengthen the preventative duty and was not in force on 4 September 2026. Read here