Skip to main content
Ferretly Get the practical guide
FCA PS25/23 · Practical briefing

FCA non-financial misconduct: what changes on 1 September

A practical guide for compliance, HR and SMCR teams—covering COCON, FIT, what firms should review, and what the FCA says firms do not need to monitor.

Get the practical guide See the assessment workflow
  • FCA source-linked
  • COCON and FIT separated
  • No blanket-monitoring claim

Based on the FCA’s published policy statement and non-financial misconduct implementation materials. This page is practical information, not legal advice. Read the FCA source.

Source before interpretation Key points link back to published FCA material.
COCON is not FIT The guide keeps the two regulatory questions separate.
No surveillance narrative The FCA says firms need not monitor staff private lives.
Practical decision tools Review areas, decision steps and worked examples.
The short version

A conduct-rule change, not a licence to investigate private lives

From 1 September 2026, the FCA’s new rule makes specified serious misconduct toward colleagues capable of falling within COCON for non-bank firms when the required work connection is present. FIT remains a separate, relevance-based assessment.

01

COCON becomes clearer for non-bank firms

COCON 1.1.7FR explicitly addresses specified bullying, harassment and violence toward colleagues where the rule’s workplace connection and other tests are met. That is narrower than “all misconduct anywhere.”

02

FIT can consider broader conduct—but only when relevant

Fitness and propriety decisions may consider conduct beyond the workplace when it genuinely bears on the regulatory standards of the role. Relevance, reliability, materiality and procedural fairness still matter.

03

Operational readiness is the real task

Firms should review policies, reporting routes, fitness-and-propriety processes, regulatory-reference decisions and manager understanding—not create a blanket workforce-monitoring programme.

Keep the tests separate

COCON and FIT answer different questions

A defensible process starts by identifying which regulatory question is actually being asked before gathering or assessing information.

COCON

Did the conduct fall within the conduct rules?

Focus on the rule’s scope, the relationship to work and the specific behaviour described by the FCA.

  • Conduct toward a colleague
  • Work-link and reasonableness tests
  • Specified bullying, harassment or violence
  • Manager response to known workplace misconduct
FIT

Does reliable conduct evidence matter to fitness and propriety?

Focus on whether the evidence creates a material, non-speculative concern about the standards required for the person’s role.

  • Role-specific regulatory relevance
  • Reliability and context of the information
  • Materiality—not mere controversy
  • A fair opportunity to explain or correct
Operational checklist

What to review—and what not to invent

The practical opportunity is a more consistent process, not a more intrusive one.

Review now

Existing people and conduct controls

  • Conduct, bullying, harassment and speaking-up policies
  • How credible information reaches HR and SMCR decision-makers
  • Fitness-and-propriety assessment and certification records
  • Regulatory-reference and breach-reporting decision points
  • Manager training on escalation and reasonable steps
Not required

Blanket or speculative investigation

  • Continuous monitoring of every employee’s private life
  • Routine social-media trawling without a defined need
  • Investigating trivial, implausible or irrelevant information
  • Treating lawful controversial views as misconduct by default
  • Reopening every historic fitness-and-propriety decision
A proportionate decision flow

Three questions before information should influence a decision

Apply the test to the decision and role. Do not start with the tool or the data source.

01

Is it relevant?

Identify the COCON or FIT question, the role standard and the lawful reason for considering the information.

02

Is it reliable and material?

Check identity, source, context, age, formal findings and whether the concern is real rather than remote or speculative.

03

Is the response proportionate and fair?

Limit collection, protect irrelevant information, document the reasoning and give the person an appropriate chance to respond.

Worked examples

The context changes the answer

These examples illustrate a decision process; they are not substitutes for legal advice or the facts of a specific case.

Likely relevant

Repeated public threats aimed at a colleague

The identity, target, workplace link and context can be verified. Escalate through the firm’s conduct process and preserve the evidence and response.

Needs context

An external allegation about private conduct

Ask whether it is credible, supported by a formal finding and materially relevant to the role. Do not convert an allegation into a conclusion.

Normally insufficient alone

A lawful controversial opinion

The FCA says lawful expression of controversial views on social media does not, by itself, call fitness and propriety into question.

Where Ferretly may help

Evidence support for a defined assessment—not an employment decision

When a firm has identified a lawful and proportionate need, Ferretly can help review relevant publicly available content, preserve source context and produce a human-reviewed evidence record.

  • Scope the review to a role or credible trigger
  • Separate relevant evidence from protected or irrelevant information
  • Link findings to public sources and timestamps
  • Keep the final judgement with the authorised decision-maker
See the screening workflowGet the FCA guide
Take the practical version with you

Turn the rule into a review agenda for compliance and HR

Get the guide, source links, COCON-versus-FIT summary, decision flow and worked examples in one document.

Get the practical guide See a redacted report example
Frequently asked questions

FCA non-financial misconduct questions

When do the FCA’s new non-financial misconduct rules take effect?
The new COCON rule and related FIT guidance take effect on 1 September 2026. See the FCA’s PS25/23 policy statement.
Does the FCA require firms to monitor employees’ social media?
No. The FCA says firms do not need to monitor employees’ private lives or social media. A firm may still need a process for evaluating credible information that reaches it and is genuinely relevant to COCON or FIT.
Is all private-life misconduct relevant to fitness and propriety?
No. The question is whether reliable evidence creates a material, non-speculative concern about the standards required for the person’s role. The source, context, formal findings, age and opportunity to respond all matter.
Is a controversial social-media opinion enough to fail FIT?
Not by itself. The FCA states that lawful expression of controversial views on social media does not call someone’s fitness and propriety into question.
What should firms review before 1 September?
Review relevant conduct and people policies, speaking-up routes, fitness-and-propriety procedures, regulatory-reference decisions, reporting paths and manager understanding. The right scope depends on the firm and its existing controls.
Does Ferretly decide whether someone is fit and proper?
No. Ferretly can support a defined assessment by organising relevant public-source evidence and review context. The firm remains responsible for its lawful basis, process and final decision.