As of 1 September 2026, serious bullying, harassment and violence at work are regulatory misconduct for firms and staff inside the Senior Managers and Certification Regime: the conduct rules now catch non-financial misconduct at nearly 38,000 non-bank SM&CR firms — insurers, brokers, wealth and asset managers, consumer credit businesses and many payments firms — matching the regime banks have lived under for years. Being FCA-regulated is not the test on its own: whether a firm and a given worker fall within COCON depends on the SM&CR perimeter and the staff categories it covers, which is the first thing to check. An investment manager who seriously harasses a colleague can now be in breach of COCON — with reporting to the FCA and disclosure in future regulatory references following their own tests rather than automatically. For firms that treated NFM as purely an HR matter, the change is live, not looming.
What the rules actually say
The core is a new conduct rule making serious bullying, harassment and violence against colleagues a breach of the individual conduct rules — deliberately anchored to behaviour within the firm's sphere: fellow employees, contractors, people working for the firm. Alongside it, the FCA finalised Handbook guidance (in force the same day) that answers the questions firms actually asked: a decision framework for when behaviour crosses from workplace friction into a conduct breach; how work social occasions are treated (the Christmas party is closer to the office than to private life); the confirmation that firms need not proactively monitor employees' social media; and how conduct in private life feeds not the conduct rules but fitness and propriety — the separate gate through which serious off-duty behaviour can still end a regulated career. Notably, the FCA's once-broader diversity and inclusion package was dropped along the way; NFM is the part that survived to become rules.
Why the regulator is here at all
The FCA's logic bears repeating to sceptical boards: a firm where misconduct toward colleagues goes unchallenged is a firm whose culture tolerates rule-breaking, and the speak-up channels that fail a harassment victim are the same channels that fail to surface mis-selling. NFM is treated as a leading indicator of conduct risk generally — which is why the enforcement interest runs through SM&CR: senior managers own culture under their statements of responsibility, breaches can feed fit-and-proper assessments, and the regulatory reference rules bring substantiated findings into an individual's next application where the reference requirements are met. Note the two regimes work differently: conduct in private life generally informs fitness and propriety rather than constituting a conduct-rule breach, and seriousness plus the work-related connection decide whether COCON bites at all. The era of quiet exits — misconduct settled with an NDA and a clean reference — is precisely what the reference regime exists to end, and firms drafting references now walk a line where both omission and overstatement carry risk.
What firms need to have in place now
The gap between an HR policy and regulatory compliance is process, and it is testable:
- Policies mapped to COCON — the disciplinary framework updated so NFM findings are assessed as potential conduct-rule breaches, not just HR outcomes, with the seriousness assessment documented against the FCA's guidance factors;
- Investigations that stand regulatory scrutiny — the same disciplines as any workplace investigation: fair process, evidence preserved, reasonable belief reasonably formed, outcomes minuted. An NFM investigation is now potentially evidence in a fitness assessment, a reference, and an FCA enquiry;
- Reporting wired in — conduct-rule breach notifications where the Handbook's triggers are met, reference obligations assessed against their own tests rather than assumed, and the internal MI so boards actually see NFM patterns (a governance expectation the second and third lines should test rather than assume);
- Training that lands — conduct-rules training refreshed to cover the new scope, for the population certified and senior managers above all;
- The cultural read — exit-interview themes, speak-up volumes, settlement patterns: the data that says whether the policy describes the firm or decorates it.
Two timing points matter for cases in flight: the rules are not retrospective — pre-September-2026 conduct is judged under the old framework, though it can still be relevant to fitness — and matters straddling the line need careful dating in any disciplinary or reference decision.
The realistic risk picture
The first enforcement wave will likely follow the pattern of every SM&CR extension: not a rush of cases, but a handful of exemplary ones where the firm's response — the ignored complaints, the recycled reference, the investigation that protected the rainmaker — is the aggravating feature. The cheap insurance is the audit now: policies, a sample of past cases re-examined against the new framework, reference and notification processes tested. Acumon runs exactly that review for regulated firms through our governance and internal audit practices, alongside financial services audit where conduct MI meets the board pack. The rule is ten days old; the expectations behind it are not, and the firms that treated culture as governance all along have nothing new to build.