The Financial Conduct Authority (FCA)’s new non-financial misconduct (NFM) rule, coming into force in September 2026, will significantly reshape how firms assess conduct under the FCA Conduct Rules and Fit and Proper test (FIT).

In this series, we consider how inappropriate behaviours such as bullying and harassment are relevant to assessments of fitness and propriety under the Fit and Proper test for Employees and Senior Personnel and the Code of Conduct sourcebook (COCON) in the FCA Handbook.

This is the final article in our three-part series. You can access our first and second articles in this series. In this concluding instalment, we turn to a critical operational question: how will HR, legal and compliance need to adapt workplace investigations to meet the requirements of the new rule?

Breaking down the silos

It has, to date, been commonplace for allegations of bullying or harassment to be handled entirely within the HR function, with little or no involvement from legal or compliance. The investigation would follow the firm's grievance or disciplinary procedure, a finding would be reached, and any sanction would be determined by reference to employment law principles and the firm's internal policies. The compliance team might only become aware of the matter if it escalated to a dismissal or if the individual happened to be a Senior Manager.

The new rule makes this approach untenable. Where an allegation of NFM is made against an individual who is subject to the Conduct Rules (which, in practice, captures the vast majority of employees within an authorised firm) the investigation should, from the outset, be conducted with an awareness that the outcome may have regulatory as well as employment law implications.

This does not mean that every workplace grievance or disciplinary issue must become a full-scale regulatory investigation. It does, however, mean that firms need a robust triage mechanism capable of identifying, at an early stage, those cases that may engage the firm's regulatory obligations to enable both disciplinary and regulatory findings to be reached. A well-designed triage process should consider:

  • the seniority and regulatory status of the individuals involved;
  • the nature and severity of the allegations;
  • whether the conduct, if substantiated, could affect the individual's fitness and propriety; and
  • whether the matter may need to be disclosed in a regulatory reference or even to the regulator.

Scoping the investigation

Once a matter has been triaged and identified as potentially engaging the firm's regulatory obligations, the scope of the investigation must be carefully considered.

From an employment law perspective, the investigation will need to follow the firm's disciplinary or grievance procedure, comply with the requirements of the Advisory, Conciliation and Arbitration Service (ACAS) Code of Practice, and be conducted in a manner that is fair and reasonable having regard to the size and resources of the employer. These requirements are well understood and will be familiar to many.

The regulatory angle, however, introduces a number of additional considerations. The investigation will need to assess not only whether the alleged conduct occurred, but also whether it amounts to a breach of individual Conduct Rules, most likely COCON 1 and COCON 2. It will also need to consider whether the conduct, if substantiated, would call into question the individual's fitness and propriety to perform their role, and whether it may need to be reported to the FCA.

These are questions that an HR led investigation may not be equipped to address without input from the compliance function. The terms of reference for the investigation should therefore be drafted so that they are sufficient for both disciplinary and regulatory findings to be reached. This is likely to require additional training for internal investigators and checks to ensure external investigators have sufficient understanding of the regulatory framework to gather the evidence needed to inform both the employment law and the regulatory assessment.

The standard of proof and assessment of severity

The FCA has made clear that not every instance of inappropriate behaviour will amount to a breach of the Conduct Rules or render an individual unfit and improper so firms should not automatically assume this. The assessment must take into account factors such as the severity of the conduct, whether it was isolated or part of a pattern of behaviour, the seniority of the individual concerned, and the impact on the affected persons. We cover this in more detail in the second of our articles in this mini-series. Firms will need to develop clear internal frameworks for making these assessments consistently, drawing on guidance from both the FCA and the PRA, where applicable.

This means that the investigation report should set out not only the factual findings and the basis on which they were reached, but also:

  • an assessment of the regulatory implications of those findings, including whether the conduct amounts to a Conduct Rule breach;
  • whether it affects the individual's fitness and propriety; and
  • what, if any, notifications or disclosures are required.

Witness handling and confidentiality

The FCA has emphasised that firms should foster a culture in which individuals feel able to speak up without fear of retaliation, and this extends to participation in workplace investigations. Firms should ensure that their investigation procedures include appropriate safeguards for vulnerable participants, including clear communication about the process, the availability of support (such as employee assistance programmes or access to a companion), and robust protections against victimisation.

At the same time, firms must be transparent with participants about the potential regulatory implications of the investigation. Where the outcome of an investigation may need to be disclosed to the FCA or included in a regulatory reference, individuals should be made aware of this at an appropriate stage. Firms will need to think carefully about striking the right balance between transparency and protecting confidentiality.

Record-keeping and the regulatory reference

When an individual who is the subject of an investigation subsequently moves to another firm, the former employer will be required to disclose relevant information, including the outcome of any disciplinary proceedings related to NFM, in the regulatory reference.

This has significant implications for investigation record-keeping. Firms must ensure that investigation files are maintained in a manner that is sufficiently detailed and well-organised to enable accurate and timely disclosure in a regulatory reference, potentially years after the investigation has concluded.

Firms should also be mindful of the interaction between their record-keeping obligations and data protection requirements. The retention of detailed investigation records must be justified under data protection legislation, and individuals must be informed about the purposes for which their personal data will be processed and retained. Firms should have in place a clear and defensible data retention policy that specifically addresses regulatory investigation records.

Training and awareness

Training and awareness will be crucial not only to HR professionals, legal and compliance but also line managers who may be the first point of contact for complaints of NFM, and senior managers who may be called upon to make decisions about disciplinary outcomes and regulatory notifications.

Training should cover:

  • the scope of the new rule;
  • the firm's triage and investigation procedures;
  • the interaction between employment law and regulatory obligations; and
  • the practical skills needed to conduct investigations that are fair, thorough, and capable of withstanding scrutiny both internally, from a corporate governance perspective and externally, before an employment tribunal and the regulator.

Firms should also consider whether their existing investigator panels, both internal and external, have the cross-disciplinary expertise needed to handle matters that engage both employment law and regulatory considerations.

How can we help?

At Gowling WLG, we help clients translate the new rules into practical, workable frameworks. This includes conducting gap analyses across policies, procedures and governance structures, ensuring alignment between disciplinary processes, Conduct Rules assessments and fitness and propriety evaluations. We focus not just on technical compliance, but on helping firms evidence reasonable and proportionate decision-making – something the FCA has made clear will be critical.

When allegations of NFM arise, our joined-up approach comes into its own. We support clients with triaging issues at the outset, determining whether and when regulatory thresholds may be engaged, and structuring investigations that can withstand challenge from multiple angles.

Our employment and regulatory specialists work together to navigate the overlap between COCON, FIT and employment law obligations, while our disputes team anticipate how decisions may be tested in tribunal proceedings, litigation or enforcement action.

Beyond reactive support, we help firms get ahead of the risk. This includes designing and delivering tailored training workshops for HR, legal and compliance teams and senior managers; stress-testing frameworks through scenario planning; and refining regulatory reference processes to ensure consistency and accuracy. You can register your interest for our workshops.

For tailored advice on navigating the FCA’s evolving expectations around non-financial misconduct, contact Jonathan Chamberlain, Guy Stevenson, Emma Bufton or a member of the team.