01
What firms should review
- Conduct policies and escalation routes
- How workplace links are assessed
- FIT evidence and decision records
- Manager response to known misconduct
FCA PS25/23 · UK financial services
Turn the FCA’s non-financial misconduct rules into a defensible process.
A practical briefing for Compliance, HR and SMCR teams—covering the 1 September 2026 change, the line between COCON and FIT, and the evidence controls that matter.
Effective 1 September 2026Source-linkedPractical, not legal advice
Based on the FCA’s published policy statement and implementation materials. Read the FCA source.
Built for cross-functional readiness
Compliance
HR & Employee Relations
SMCR & Governance
What changes
A conduct-rule change—not a licence to investigate private lives.
From 1 September 2026, specified serious misconduct toward colleagues can fall within COCON for non-bank firms when the required work connection is present. FIT remains a separate, relevance-based assessment.
Important boundary
What the FCA is not asking firms to do
The FCA says firms do not need to monitor employees’ private lives or social media, and do not need to investigate information that is trivial, implausible or irrelevant.
Two distinct tests
COCON and FIT answer different questions.
COCON
Did the conduct fall within the conduct rules?
- Conduct toward a colleague
- Work-link and reasonableness tests
- Specified bullying, harassment or violence
- Manager response to known workplace misconduct
FIT
Does reliable evidence matter to fitness and propriety?
- Role-specific regulatory relevance
- Reliability and surrounding context
- Materiality—not mere controversy
- A fair opportunity to explain or correct
Assessment workflow
A repeatable path from signal to recorded decision.
Keep evidence, judgement and accountability separate at every stage.
1
Scope
Define the rule, role and decision question before collecting evidence.
2
Verify
Confirm identity, source, date and context; do not treat allegation as fact.
3
Assess
Apply COCON or FIT deliberately and record relevance and materiality.
4
Decide
Use authorised human judgement and preserve rationale and response.
Worked examples
The context changes the answer.
Work-linked
Repeated public threats aimed at a colleague
The target, workplace link and context can be verified. Escalate through the firm’s conduct process and preserve evidence and response.
External allegation
Private conduct reported by a third party
Ask whether it is credible, supported by a formal finding and materially relevant to the role. Do not convert an allegation into a conclusion.
Lawful expression
A controversial opinion on social media
The FCA says lawful expression of controversial views does not, by itself, call fitness and propriety into question.
Common questions
FCA non-financial misconduct FAQs.
When do the new rules take effect?
The new COCON rule for relevant non-bank firms takes effect on 1 September 2026.
Does the FCA require social-media monitoring?
No. The FCA expressly states firms do not need to monitor employees’ private lives or social media.
Does Ferretly decide whether someone is fit and proper?
No. Ferretly supports evidence review; the authorised people in the firm make and record the decision.
Start with the framework