This month, a rule change that has been years in the making finally took effect. From 1st September 2026, the Financial Conduct Authority’s (FCA) amended Code of Conduct sourcebook (COCON) brings serious work-related bullying, harassment and violence within scope across non-bank firms subject to the Senior Managers and Certification Regime (SM&CR). It is a firm signal of a wider shift: conduct that was once viewed primarily as an HR issue is increasingly being recognised as a governance and risk issue that demands board-level attention.
What the FCA has changed, and why
COCON 1.1.7FR is the new rule behind this change. Under it, non-bank firms must treat serious bullying, harassment or violence between colleagues as a Conduct Rules matter, provided the behaviour connects sufficiently to the individual’s work. Alongside this, the FCA has set out, through updated guidance, how this type of conduct should feed into fitness and propriety assessments.
The FCA’s reasoning is straightforward. Its leadership has been clear that bullying, harassment and other forms of non-financial misconduct can be indicators of deeper cultural patterns within an organisation. A workplace where such behaviour is tolerated or ignored may raise broader questions about decision-making, oversight, accountability and risk management. In other words, the regulator now views conduct as a leading indicator of organisational health rather than a standalone people issue.
Importantly, the FCA’s framework is not limited to assessing the impact on one individual. The context, wider effects and organisational response may all be relevant when firms assess whether a matter raises conduct, governance or fitness and propriety considerations.
What financial services firms now need to evidence
The practical effect is significant. Regulatory scrutiny is no longer confined to the behaviour itself. Managers and Senior Managers may face separate scrutiny where their oversight, decision-making or response falls below the standards expected of them. Firms may also face wider regulatory, employment law and governance consequences if concerns are not handled appropriately.
The FCA has been clear that firms should consider whether they need to update their approach to staff policies, conduct breach reporting, fit and proper assessments, regulatory references and manager responsibilities.
In practice, this means firms need to show their working, not simply state their intentions. Staff need training that is meaningful and memorable, reporting routes they trust enough to use before issues escalate, and cultures where speaking up is supported rather than quietly discouraged.
When concerns are raised, investigations need to be conducted fairly, thoroughly and by individuals with the appropriate competence, capacity and degree of independence for the circumstances. Boards and senior leaders also need sufficient oversight of the information coming through whistleblowing, grievance and investigation channels to understand emerging risks and themes, rather than relying on high-level annual reporting.
The conduct itself may also be relevant to an individual’s separate Fit and Proper assessment. The FCA has made clear that COCON and FIT operate independently, with FIT capable of taking account of a broader range of relevant misconduct when assessing whether an individual remains suitable to perform their role. This can have implications for certification decisions, regulatory references and continued participation in regulated activities.
Not the first change, and unlikely to be the last
The FCA’s rule is far from an isolated development. Just weeks later, on 30th October 2026, the Employment Rights Act 2025 raises the bar again for employers across England, Wales and Scotland, regardless of sector. The current duty to take “reasonable steps” to prevent sexual harassment becomes a duty to take “all reasonable steps”, a materially higher and more proactive standard.
Employers will also face liability for harassment of their staff by third parties, such as clients, contractors and members of the public, where the statutory conditions are met and the employer has failed to take all reasonable steps to prevent it. Together, these changes mean risk assessments, documented action and evidence of prevention, rather than simply having a policy in a handbook, will increasingly form the basis on which organisational compliance is judged.
Separately, since April 2026, disclosures relating to sexual harassment have been expressly included within the whistleblowing framework, strengthening protections for workers who raise concerns.
A global pattern
The UK is not acting alone.
Australia: Employers and organisations are now subject to a positive duty under the Sex Discrimination Act to take proactive steps to eliminate workplace sexual harassment, sex-based harassment, discrimination and related victimisation as far as possible. Separate reforms have also expanded the ability of workers to seek orders from the Fair Work Commission to stop workplace sexual harassment.
Singapore: The Workplace Fairness Act has been passed and is currently scheduled to take effect at the end of 2027, creating a formal statutory framework for addressing workplace discrimination and resolving related complaints.
Japan: Aspects of workplace protection are also being strengthened, including new employer obligations related to customer harassment and further measures aimed at preventing harassment in recruitment and employment settings.
The detail varies significantly between jurisdictions, but the broad direction of travel is consistent: more proactive prevention, better documentation, clearer accountability and stronger organisational governance around workplace conduct.
What this pattern means across sectors
It would be a mistake to view the FCA’s rule as a financial services issue alone and move on. The underlying principle, that workplace conduct is a governance issue requiring evidence, oversight and accountability, is now appearing across a range of legal and regulatory developments.
The financial services market often experiences regulatory change earlier and more visibly than other sectors. While the specific rules may differ, the broader expectations around culture, prevention, governance and accountability are becoming familiar across many areas of employment and organisational regulation.
Treating these developments as someone else’s compliance challenge may therefore prove to be short-term comfort.
The key takeaway
What connects the FCA’s rule, the Employment Rights Act changes and wider international developments is a simple idea: conduct is no longer viewed purely as an internal people issue. It is now recognised as a governance, culture and risk issue, and those issues ultimately require oversight at senior levels of the organisation.
HR remains critical to that response, but boards and executive teams need a credible and evidenced answer to a straightforward question:
How do we know, and how can we demonstrate, that we are managing this risk effectively?
That question is unlikely to disappear. Organisations that are building robust reporting, investigation, prevention and governance frameworks now will be far better placed than those that wait for the next regulatory deadline before taking action.
Let’s talk
If these changes raise questions about how your organisation currently evidences its approach to workplace conduct, we would welcome a conversation. Whether you are reviewing policies ahead of the Employment Rights Act changes, preparing for scrutiny under the FCA’s new rule, or simply want an independent view of where the gaps might be, we are happy to talk it through.
How we can help
Safecall helps organisations build positive speak-up cultures through comprehensive speak-up solutions, training and independent workplace investigations. As a Law Debenture company, we bring over 135 years of governance expertise to every engagement.
Get in touch with our expert team to talk through what this means for your organisation.