As of 1 September 2026, bullying, harassment and violence at work are regulatory misconduct across the whole FCA-regulated sector: the conduct rules now catch serious non-financial misconduct in nearly 38,000 non-bank firms — insurers, brokers, wealth managers, payments firms, consumer credit businesses — matching the regime banks have lived under for years. An investment manager who harasses a colleague is now in breach of COCON, reportable, and carrying the finding into every future job via regulatory references. For firms that treated NFM as purely an HR matter, the change is live, not looming.
What the rules actually say
The core is a new conduct rule making serious bullying, harassment and violence against colleagues a breach of the individual conduct rules — deliberately anchored to behaviour within the firm's sphere: fellow employees, contractors, people working for the firm. Alongside it, the FCA finalised Handbook guidance (in force the same day) that answers the questions firms actually asked: a decision framework for when behaviour crosses from workplace friction into a conduct breach; how work social occasions are treated (the Christmas party is closer to the office than to private life); the confirmation that firms need not proactively monitor employees' social media; and how conduct in private life feeds not the conduct rules but fitness and propriety — the separate gate through which serious off-duty behaviour can still end a regulated career. Notably, the FCA's once-broader diversity and inclusion package was dropped along the way; NFM is the part that survived to become rules.
Why the regulator is here at all
The FCA's logic bears repeating to sceptical boards: a firm where misconduct toward colleagues goes unchallenged is a firm whose culture tolerates rule-breaking, and the speak-up channels that fail a harassment victim are the same channels that fail to surface mis-selling. NFM is treated as a leading indicator of conduct risk generally — which is why the enforcement interest runs through SM&CR: senior managers own culture under their statements of responsibility, breaches feed fit-and-proper assessments, and regulatory references mean a substantiated NFM finding follows an individual to their next application. The era of quiet exits — misconduct settled with an NDA and a clean reference — is precisely what the reference regime exists to end, and firms drafting references now walk a line where both omission and overstatement carry risk.
What firms need to have in place now
The gap between an HR policy and regulatory compliance is process, and it is testable:
- Policies mapped to COCON — the disciplinary framework updated so NFM findings are assessed as potential conduct-rule breaches, not just HR outcomes, with the seriousness assessment documented against the FCA's guidance factors;
- Investigations that stand regulatory scrutiny — the same disciplines as any workplace investigation: fair process, evidence preserved, reasonable belief reasonably formed, outcomes minuted. An NFM investigation is now potentially evidence in a fitness assessment, a reference, and an FCA enquiry;
- Reporting wired in — conduct-rule breach notifications to the FCA, reference obligations honoured, and the internal MI so boards actually see NFM patterns (a governance expectation the second and third lines should test rather than assume);
- Training that lands — conduct-rules training refreshed to cover the new scope, for the population certified and senior managers above all;
- The cultural read — exit-interview themes, speak-up volumes, settlement patterns: the data that says whether the policy describes the firm or decorates it.
Two timing points matter for cases in flight: the rules are not retrospective — pre-September-2026 conduct is judged under the old framework, though it can still be relevant to fitness — and matters straddling the line need careful dating in any disciplinary or reference decision.
The realistic risk picture
The first enforcement wave will likely follow the pattern of every SM&CR extension: not a rush of cases, but a handful of exemplary ones where the firm's response — the ignored complaints, the recycled reference, the investigation that protected the rainmaker — is the aggravating feature. The cheap insurance is the audit now: policies, a sample of past cases re-examined against the new framework, reference and notification processes tested. Acumon runs exactly that review for regulated firms through our governance and internal audit practices, alongside financial services audit where conduct MI meets the board pack. The rule is ten days old; the expectations behind it are not, and the firms that treated culture as governance all along have nothing new to build.