PS25/23: Tackling non-financial misconduct in financial services

Policy Statement PS25/23 Tackling non‑financial misconduct in financial services Guidance in the Code of Conduct (COCON) and the Fit and Proper test for Employees and Senior Personnel (FIT) sourcebooks December 2025

This relates to Consultation Paper 25/18 which is available on our website at www.fca.org.uk/publications Email: cp25-18@fca.org.uk Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000

3 Contents Foreword Page 4 Chapter 1 Summary Page 5 Chapter 2 Code of Conduct (COCON) Page 9 Chapter 3 Fit and Proper test (FIT) Page 19 Chapter 4 Implementation date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 25 Chapter 5 Cost Benefit Analysis Page 27 Annex 1 List of non‑confidential respondents Page 31 Annex 2 Abbreviations used in this paper . . . . . . . . . . . . . . . . . . . . . . . . . Page 34 Appendix 1 Made rules (legal instrument)

4 Foreword Trust in financial services is paramount. Where misconduct goes unchecked, it can harm individuals, firms and confidence in the sector. Tackling non‑financial misconduct (NFM) in financial services firms supports all 3 of our operational objectives – as well as supporting growth and international competitiveness by helping to improve the UK financial sector’s reputation, strengthening its access to global talent and increasing market and consumer confidence. In July 2025, we confirmed new rules to align the conduct rules in banks and non‑banks for cases of serious NFM, aiming to drive greater consistency across financial services. Those rules will come into force on 1 September 2026. In July, we also sought views on whether we should provide additional guidance to help firms apply our rules on NFM with clarity and confidence. We said we would only do so if there was clear support – recognising the increased costs of implementation and noting that guidance cannot cover every situation. Feedback to our consultation was overwhelmingly positive – 95% of respondents asked us to provide this additional guidance. We are therefore publishing it now, with minor amendments to reflect consultation feedback, so firms have plenty of time to prepare for the new rules coming into force next September. The guidance is designed to help firms make fair, consistent decisions and take decisive action when standards are breached. No guidance can cover every scenario, and firms will always need to exercise judgement. Some firms asked us to go even further and provide more case studies, but we are not doing this, as guidance cannot cover every scenario. The primary responsibility for preventing NFM, and dealing with it when it occurs, rests with firms themselves. We engage regularly with the Equality and Human Rights Commission, whose role is critical in this area. Our guidance complements, but does not replicate, its more extensive guidance on harassment and victimisation under the Equality Act. I want to thank trade bodies and industry groups for their constructive engagement. Their work to provide practical support to their members and guidance on workplace culture and NFM is vital to achieving lasting change. This publication brings our policy work on NFM to a close. We will now focus on how firms are tackling it in practice. Together, we can raise standards, increase accountability and build workplaces where people feel safe to speak up. This is good for firms, good for markets and good for consumers. Sarah Pritchard Deputy Chief Executive Financial Conduct Authority

5 Chapter 1 Summary 1.1 This policy statement (PS) is our response to consultation feedback and our final guidance on non‑financial misconduct (NFM) in financial services. 1.2 We are: • amending our Code of Conduct (COCON) sourcebook to explain how NFM can be a breach of the conduct rules and make it easier for SM&CR firms to interpret and consistently apply our rules • explaining how NFM forms part of the Fit and Proper test for Employees and Senior Personnel (FIT) sourcebook 1.3 On 2 July 2025, we published a policy statement and consultation paper (CP25/18) confirming we would expand the scope of COCON to more closely align the rules on NFM between banks and non‑banks. This means incidents of work‑related NFM in non‑banks will be within scope of COCON if either the individual responsible or the subject of the misconduct works in the financial services part of the business. 1.4 We also consulted on whether extra Handbook guidance in COCON and FIT was needed to help firms apply our rules. We set out advantages and disadvantages together with an updated cost benefit analysis (CBA). We said that we would only take the guidance forward if stakeholders clearly supported it. 1.5 95% of respondents agreed that new Handbook guidance was needed and would bring clear additional benefits. This message also came through strongly in our wider engagement with industry, trade bodies and legal practitioners. 1.6 No guidance can be exhaustive, so the firm’s judgement will always be essential. But nevertheless, respondents strongly agreed that the guidance would make it easier to interpret and apply our rules and avoid unnecessary costs. We want to provide reassurance that firms can take appropriate and decisive action to address misconduct under our rules. 1.7 Our regulatory framework does not duplicate existing legal obligations on firms, nor serve as a substitute for the criminal law or firms’ internal disciplinary processes. Neither do we provide alternative routes for employees who can seek redress through employment tribunals. Who this affects 1.8 This PS will be relevant to all firms with a Part 4A permission under the Financial Services and Markets Act 2000 (FSMA) and employees and individuals subject to COCON and FIT.

6 1.9 The guidance in this PS may also be of interest to other stakeholders, including: • regulated firms that do not have a Part 4A permission • industry groups/trade bodies • consumer groups and individual consumers • industry experts and commentators The wider context of this policy statement How it links to our objectives 1.10 Integrating NFM into our Handbook supports our objectives to protect consumers, uphold market integrity and promote effective competition, while facilitating the UK’s economic growth and global competitiveness. 1.11 Tackling NFM in firms helps foster healthy and inclusive workplace cultures where people are empowered to speak up and raise concerns. This supports our objectives by: • Supporting firms to make fair, consistent decisions and take decisive action when standards are breached. • Deterring wrongdoing that can harm individuals and create an unhealthy workplace culture. • Preventing the development of workplace cultures that facilitate further wrongdoing and regulatory breaches that harm consumers and damage market integrity. • Improving standards of behaviour by including NFM in regulatory references to ensure past misconduct is disclosed when individuals move firms. • Attracting and retaining a wider range of people in financial services, increasing diversity of thought and experience. • Fostering psychologically safe workplaces that nurture creativity and promote innovation in consumers’ interests. • Encouraging constructive challenge and better decision‑making, supporting good governance and responsible risk‑taking. • Upholding regulatory standards and public confidence in the financial sector. 1.12 These benefits will boost growth and global competitiveness by enhancing the UK financial sector’s reputation, increasing confidence and improving access to international talent. 1.13 The new guidance reflects the recommendations in the Chancellor’s November 2024 remit letter, as it clarifies our expectations for applying the conduct rules and assessing fitness and propriety. This supports appropriate risk‑taking, enabling the financial services sector to drive innovation, enhance competitiveness and contribute to sustainable economic growth. 1.14 Our finalised guidance helps to raise standards, increase accountability and build trust in financial services, in line with the FCA Strategy 2025 to 2030. Higher market and consumer confidence will underpin innovation, informed risk‑taking and economic growth.

7 Summary of feedback and our response 1.15 We received 79 responses from firms, trade associations, law firms, consultancies, interest groups and 2 private individuals. 77 respondents agreed new Handbook guidance in the COCON and FIT sourcebooks was needed to help firms apply our rules. Two firms disagreed, saying the FCA should not seek to regulate matters subject to employment law. 1.16 Overall, 69 respondents agreed the COCON and FIT guidance we consulted on would help them to apply our rules. We received a lot of constructive feedback on the draft instrument, together with suggestions for further enhancement. 1.17 Respondents asked us to clarify aspects of the scope of COCON and how the guidance applied to banks. They wanted us to ensure our guidance is fully aligned with employment law and to harmonise terminology across the Handbook. Most agreed that managers should take reasonable steps to protect staff from NFM, but some were concerned they might face disproportionate liability. We address these points in Chapter 2. Several respondents asked us to include flow diagrams in the Handbook to guide users through the COCON rules, which we have now done (see Appendix 1). 1.18 Most respondents welcomed greater clarity on assessing fitness and propriety, particularly in relation to misconduct in private life. However, many raised practical issues with, or asked for more guidance on, how firms should handle unproven allegations, social media activity, repeated minor breaches and how they should consider ethical obligations and our statutory objectives. We address these matters in Chapter 3. 1.19 We have considered all the feedback and are proceeding with a revised version of the COCON and FIT guidance proposed in CP25/18. We have made changes to address the main areas of feedback, including: • new examples and flow diagrams to help apply COCON consistently • clearer alignment with employment law • clarifying that managers’ accountability is relative to their knowledge and authority • withdrawing or amending examples and factors that risked imposing disproportionate burdens • clarifying that firms are not expected to investigate trivial or implausible allegations or breach privacy law when assessing fitness and propriety 1.20 We set out more details of the feedback and our response in Chapters 2 to 5. 1.21 As the amendments are minor, they do not require us to revise our cost benefit analysis or compatibility statement. 1.22 Some of the feedback focused on aspects of the Senior Managers and Certification Regime (SM&CR) that were outside the scope of this consultation. We will consider how best to deal with this feedback as part of our wider work on streamlining the SM&CR. 1.23 The Prudential Regulation Authority (PRA) is not taking forward any of the proposals in its 2023 consultation (CP18/23), including those on staff fitness and propriety. Instead, it will expect dual‑regulated firms to consider our guidance when assessing these.

8 Equality and diversity considerations 1.24 As a public body, we have a duty under the Equality Act 2010 (Equality Act) to ‘have due regard’ to the need to: eliminate discrimination, harassment, victimisation and any other conduct prohibited by or under the Equality Act; advance equality of opportunity between persons who share a relevant protected characteristic and those who do not; and to foster good relations between people who share a protected characteristic and those who do not. 1.25 We consider that integrating NFM into our Handbook will help advance our equality objectives by reducing instances of harassment and discrimination within financial services firms and encouraging firms to create more inclusive working environments. 1.26 Respondents agreed, with some highlighting the need for firms to take a proportionate approach, especially in cases involving disability, neurodivergence or human rights. 1.27 We have engaged with the Equality and Human Rights Commission to ensure our regulatory framework complements its efforts to address workplace NFM in financial services firms. Our approach aligns with, but does not duplicate, employers’ obligations under the Equality Act and the duty to protect workers from sexual harassment introduced by the Worker Protection (Amendment of Equality Act 2010) Act 2023 (WPA). We have also ensured our guidance does not duplicate provisions in the Employment Rights Bill. Next steps 1.28 All firms affected by these changes should familiarise themselves with the new guidance at Appendix 1. The guidance will come into force on 1 September 2026 at the same time as the new rule at COCON 1.1.7FR. See Chapter 2 of CP25/18 for more information on the rule. 1.29 Firms have a duty under section 64B FSMA to notify conduct rules staff about the rules and take all reasonable steps to make sure they understand how they apply to them (COCON 2.3).

9 Chapter 2 Code of Conduct (COCON) 2.1 This chapter sets out the feedback received on potential new guidance in the Code of Conduct sourcebook (COCON), and our response. COCON sets out conduct rules for staff and provides guidance about those rules. We can take enforcement action for serious breaches of COCON. 2.2 We will consider a range of factors when deciding whether to investigate a potential breach of our rules or take action if there has been a breach. We particularly consider whether the action or potential action from any investigation would be an impactful deterrent. We set out our investigation opening criteria on our website. 2.3 In this chapter, ‘NFM’ refers to the types of serious misconduct described in the new rule at COCON 1.1.7FR. Broadly, these are bullying, harassment and violence, unless otherwise stated. Consultation proposals 2.4 We want our rules and guidance to be both proportionate and effective. So, we asked whether new Handbook guidance was needed in COCON and FIT to help firms apply our rules. 2.5 We also consulted on potential new guidance for the COCON sourcebook, including: • guidance and examples to illustrate the scope of COCON • factors to consider when determining whether NFM breaches the conduct rules • examples of reasonable steps for managers to protect staff against NFM • a new example of conduct that would breach individual conduct rule 1 (whistleblower detriment) 2.6 We asked: Question 1: To what extent do you agree that new Handbook guidance in COCON and FIT is needed to help firms apply FCA rules? 2.7 Respondents strongly agreed (95%) that new Handbook guidance was needed in COCON and FIT to help firms apply our rules, particularly in respect of NFM and misconduct in private life. 2.8 We asked: Question 2: To what extent do you agree the draft COCON guidance would help you to apply our rules? Question 3: Do you have any comments on the draft COCON guidance?

10 Feedback on COCON 2.9 Nearly all respondents (87%) supported the draft COCON guidance we consulted on, despite its estimated costs. They agreed the new guidance would help firms apply our rules with greater clarity and consistency. 2.10 Given the strong support for our proposals, we have proceeded to publish a revised version of the COCON guidance that takes account of feedback received. We describe the feedback and our response below. Additional guidance 2.11 Most respondents supported the draft guidance, but many asked us to provide additional guidance, case studies and examples to support consistent application in firms. Our response Each case of NFM is unique, and it is not possible to provide enough examples or case studies to address the wide range of scenarios firms may encounter. Doing so could also risk undermining the fact‑specific judgement a firm needs to exercise in the precise circumstances of each case. In response to requests for additional guidance, we have made a small number of targeted changes in areas that will add clear value. For example, we have included new examples to illustrate the scope of COCON and provided further guidance to support application of the new rule. This includes a suite of flow diagrams illustrating how COCON applies and the process for determining whether NFM breaches our rules. Application to banks 2.12 Eight respondents asked us to clarify why the guidance applied to all SM&CR firms when the new rule at COCON 1.1.7FR only applied to non‑banks. They asked us to explain why there wasn’t a separate NFM rule for banks. 2.13 There were also several requests for us to simplify the guidance to reduce the use of cross‑references. Our response The scope of the conduct rules at banks is wider than for other regulated firms, where it applies primarily to conduct that forms part of, or is for the purpose of, the financial services activities of the firm. This made it harder to establish that, at non-banks, incidents of NFM such as bullying, harassment and violence, were, in each case, sufficiently linked to financial services activities to be covered by the conduct rules.

11 The rule change we published in July 2025 expands the scope of COCON in non‑banks to align with that in banks for NFM such as bullying, harassment and violence. This means NFM towards colleagues will be within scope of the conduct rules when it occurs in relation to the performance of the individual’s role. It will no longer be restricted to conduct that forms part of, or is for the purpose of, financial services activities. This brings non‑banks more closely into alignment with banks to promote a more consistent approach to NFM across financial services. In line with our existing regulatory remit, NFM that only relates to a part of a non‑bank’s business that does not involve SMCR financial activities will remain out of scope of COCON. We have moved the NFM guidance into a separate section to minimise the need for cross‑references. We have also made it clear why the guidance on the new rule at COCON 1.1.7FR is relevant to banks even though the scope rule change does not apply to them. We do this by applying the relevant part of the rule to banks as guidance. This means banks can use the guidance to help them determine whether conduct that can broadly be described as bullying or harassment, or violence, towards a work colleague – as described in the new rule – is a breach of individual conduct rule 1 or 2. Alignment with employment law 2.14 Eleven respondents welcomed our increased alignment with employment law but noted that there were still some areas of divergence. They were concerned this would increase firm burdens. 2.15 Some respondents suggested ways in which to improve our alignment with employment law and reduce firm burdens. For example, by making it clear that purpose was equally as important as intent and specifying that witnesses could also be the subjects of misconduct. Our response There are some important differences between our rules and employment law. Our statutory power to make conduct rules for individuals working in financial services derives from section 64A FSMA rather than from employment legislation. COCON sets minimum standards of good personal conduct that individuals, not firms, can be held accountable for, but does not define specific acts as a regulatory breach. Integrating the new rule and guidance into our existing regulatory framework means identifying whether NFM is in scope of our rules and if it is a breach of one of the individual conduct rules. There is no parallel for these rules in employment law. For example, determining whether misconduct is a breach of individual conduct rule 1 means establishing whether there was a failure to act with integrity. This concept does not form part of employment law.

12 Where possible, we have revised the guidance to further align with relevant provisions in employment and equality law. These include an example suggested by a respondent to demonstrate that the purpose of the conduct is as important as its effect. This shows how an individual can breach COCON even if their hostile and intimidatory communication is intercepted before it reaches the intended subject. 2.16 Many respondents supported the proposed guidance on managers’ responsibility to protect staff from NFM. They agreed that managers played a key role in setting standards of conduct and culture and preventing misconduct. 2.17 However, 19 respondents, including 13 trade bodies, were concerned that the guidance placed disproportionate liability on individual managers, particularly if they had not known that NFM had taken place. A few suggested the guidance went beyond the requirements of the Equality Act and the WPA by creating individual rather than corporate liability. Our response As stated above (under paragraph 2.15), there are key differences between employment law and our regulatory framework. Under the SM&CR, managers in regulated firms are already held individually accountable for their conduct, competence and decisions. The new guidance aims to explain what that means in the context of workplace NFM while setting clear limits on their accountability. The guidance highlights the important role managers play in fostering healthy and inclusive workplace cultures where people are empowered to speak up and raise concerns. It sets out examples of reasonable steps a manager might take to protect staff from NFM, and to respond appropriately when it occurs, and clarifies circumstances in which it would not be reasonable to expect a manager to act. In response to feedback, we have revised the guidance to make it clearer that we would not expect a manager to be held responsible for failing to stop NFM if they could not reasonably have known about it. We have also clarified that we would not consider it reasonable to hold them responsible if they did not have authority to act in the particular case. We have not defined the term ‘manager’ as the meaning will vary from firm to firm. However, we have clarified that it is not limited to a line manager only. Definitions and terminology 2.18 Eleven respondents, including trade bodies and legal practitioners, asked us to define ‘non‑financial misconduct,’ and some suggested we adopt a consistent definition of NFM across both COCON and FIT.

13 2.19 Some asked us to clarify our use of ‘bullying’ in the CP as this word does not feature in the new COCON rule itself. 2.20 Several respondents asked whether the new COCON rule included other conduct contrary to the Equality Act, such as discrimination and victimisation. Our response ‘Non‑financial misconduct’ includes a wide range of behaviour, essentially any misconduct not of a clearly financial nature. It is not possible to list all types of misconduct that might amount to a breach of COCON (or of fitness standards in FIT), as each case requires individual judgement based on its specific circumstances. We used the words ‘bullying’ and ‘harassment’ in the CP as shorthand terms to describe unwanted conduct that has the purpose or effect of violating a colleague’s dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them. We consider this approach is likely to be compatible with firms’ internal disciplinary policies on bullying and harassment. The rule covers sexual harassment but does not expand the scope of COCON in non‑banks to cover other forms of conduct prohibited by the Equality Act, such as discrimination and victimisation. Under section 109 of the Equality Act, employers must take all reasonable steps to prevent their employees from carrying out harassment, discrimination or any other conduct contrary to the Act. However, firms should consider whether misconduct of these kinds, and other forms of NFM, may nevertheless be a potential breach of the conduct rules. This will depend on whether the conduct falls within the scope of COCON as it applies to that firm and, if so, whether it could amount to a breach of an individual conduct rule. Scope of COCON 2.21 Several respondents asked us to clarify aspects of the guidance relating to the scope of COCON. For example, 15 respondents, including 7 trade bodies and 3 law firms, asked for additional guidance on the exception described at COCON 1.1.7FR(5). This says that conduct is not within the scope of the new rule if it only relates to a business of the firm that does not involve SMCR financial activities. 2.22 Many respondents welcomed the flow diagrams in CP25/18 and suggested we include them in the Handbook.

14 Our response The scope of COCON is normally narrower for non‑banks because the rules are limited to those activities of a firm that are related to regulated activities or other SMCR financial activities. The new rule at COCON 1.1.7FR expands the scope of COCON to make bullying, harassment and similar behaviour between staff subject to the wider scope rules that apply to banks. We have added a table of scenarios suggested by respondents to illustrate the way the exclusion at COCON 1.1.7FR(5) applies. One of these relates to staff in a shared function where certain individuals deal with the financial services business and others with the non‑financial services business. This shows that the conduct will be in scope if either the perpetrator or the subject deals with the financial services business of the firm. However, the conduct would be out of scope if both individuals worked in a separate function that did not deal with the financial services business at all. We have also created a suite of flow diagrams to guide firms through the application rules in COCON 1. These set out the steps for determining whether any type of conduct is in scope of COCON and potentially a breach of the conduct rules. They include a decision tree, adapted from CP25/18, to help firms decide if NFM is a rule breach. 2.23 Some respondents asked for more guidance on the boundary between work and private life. A few queried whether the table of examples at COCON 1.3.7G related solely to the new NFM rule and, if so, why it included misconduct against clients, which is excluded from the rule. Some respondents expressed concern that the guidance on social events extended the scope of COCON into private life. Our response The table of examples at COCON 1.3.7G helps illustrate the boundary between work and private or personal life and applies to all firms and all potential breaches of the conduct rules. Under section 64A of FSMA, private or personal life is entirely out of scope of our power to make and enforce conduct rules for individuals. Our guidance does not seek to change this position. The new NFM rule relates only to work‑related misconduct against a colleague. However, work‑related misconduct towards clients may be in scope of COCON under the current rules. The guidance seeks to articulate scenarios where conduct outside the workplace may nevertheless be closely enough connected to work to fall within the scope of our rules. For example, misconduct at a training event, award ceremony or workshop organised by a client. In each case, the question is whether the conduct relates ‘to the performance […] of qualifying functions’ (section 64A(4) FSMA).

15 We included some examples suggested by respondents to our 2023 consultation to support decision‑making in further areas, particularly around social occasions and social media. However, no guidance can be exhaustive and firms will still need to exercise their judgement on a case‑by‑case basis. 2.24 Three respondents were concerned by our proposal to amend the guidance on senior manager conduct rule 4 (SC4) (You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice). We proposed to delete the current guidance at COCON 4.2.29G(2) as it incorrectly suggested that information relating to an individual SMF manager themselves might be out of scope of our disclosure rules. 2.25 We also proposed to add new guidance to say the fact that conduct in private or personal life was outside the scope of COCON did not mean that a senior manager conduct rules staff member may not be required to disclose such information under SC4. This aimed to clarify that relevant staff may be required to disclose information about their private or personal life if it is material to an assessment of their fitness and propriety under FIT. However, two legal practitioners and a trade body considered this was intrusive and potentially in conflict with COCON’s statutory limits. 2.26 We consulted on related amendments to COCON in CP25/21 on the SM&CR. This included detailed guidance on the kinds of personal information an SMF manager should disclose to the FCA under SC4. For example, if they were subject to insolvency proceedings or were prosecuted for, or convicted of, any offence involving fraud, dishonesty or one of the other serious offences listed in FIT. Our response Our proposals were intended to clarify an area of ambiguity rather than extend the scope of COCON into private life. We want to make sure the Handbook provides accurate guidance on our rules. So, we have decided to make the changes we consulted on. This includes deleting existing guidance that gave a misleading impression of individual SMF managers’ disclosure obligations and publishing new guidance at COCON 1.3.3G. This makes it clear that senior manager conduct rules staff may be required to disclose information about their private or personal life under SC4 if it would be material to an assessment of their fitness and propriety. 2.27 A few respondents asked for further clarification on territorial scope. The new rule at COCON 1.1.7FR does not change the geographical scope of COCON. However, COCON applies in different ways to different types of staff depending on their role and where they are based.

16 Example COCON 1.1.10R(2)(b) means that COCON only applies to the conduct outside the UK of an employee who works for a UK firm (who is not an SMF manager or material risk taker) insofar as it concerns their dealing with a client in the UK. The new rule does not change the way in which COCON applies to such employees. So, COCON would not apply to incidents of NFM towards a colleague by such an employee, regardless of whether that colleague was located inside or outside the UK. ‘Serious’ misconduct 2.28 Eight respondents, including 4 trade bodies, asked for more guidance on the meaning of the word ‘serious,’ to help firms understand the threshold for a breach under the new rule. Two respondents suggested we harmonise the meaning of words such as ‘serious’ and ‘significant’ across the Handbook. Our response The primary responsibility for preventing NFM, and dealing with it when it occurs, rests with firms themselves. We consider firms are best placed to assess the unique circumstances of each case. So, we would treat a firm’s judgement about whether misconduct is serious enough to amount to a breach as complying with our rules, if the firm’s judgement is reasonable. The seriousness threshold for the new rule at COCON 1.1.7FR is aligned with the threshold for harassment in the Equality Act. The seriousness of the conduct is expressed in the language of the rule and the words that describe the purpose or effect of the unwanted conduct (for example, ‘violating dignity,’ ‘degrading’ and ‘humiliating’). We have provided guidance on factors to take into account when deciding whether NFM is serious enough to amount to a breach of our rules. We explained the different ways in which the words ‘serious’ and ‘significant’ were used in SYSC 22 and SUP 15 in Chapter 3 of CP25/18. There is guidance on the meaning of these words in the relevant sourcebooks. As stated above (under paragraph 2.11), no guidance can be exhaustive or replace the need for a firm to exercise its own judgement. 2.29 Some respondents raised concerns about one of the items on the draft list of factors for determining whether conduct was serious enough to amount to a breach of COCON. This said, ‘whether the subject of the misconduct has specific characteristics or vulnerabilities, particularly if this is a factor in the conduct in question.’ 2.30 Respondents considered this guidance unhelpfully vague and difficult to apply. They asked us either to provide a clear definition or to refer to protected characteristics instead.

17 Our response We previously consulted on a version of this guidance that read, ‘whether the conduct is related to a protected characteristic under the Equality Act 2010’ (in CP23/20). However, many respondents told us this would be difficult and costly for firms to apply. They highlighted the challenges of making quasi‑legal judgements that are normally only made by an employment tribunal. Most respondents to both consultations agreed that NFM targeted at an individual’s protected or other personal characteristics was likely to be serious. However, both versions of the guidance we consulted on have raised significant challenges for implementation. Having considered all the feedback, we have withdrawn the proposed factor relating to ‘specific characteristics or vulnerabilities.’ We remind firms that the guidance is not exhaustive. 2.31 Three respondents disagreed that minor misconduct that had not been subject to formal disciplinary action could be a breach of the conduct rules and recommended setting a common threshold of ‘serious’ misconduct for all conduct rule breaches. Our response The new guidance does not set a separate, higher threshold for NFM conduct rule breaches. Instead, it reflects the level of seriousness inherent in the wording of the new rule. Minor incidents of poor workplace behaviour that do not have the purpose or effect described in the new rule (eg ‘violating dignity,’ ‘degrading,’ ‘humiliating’) will not breach our rules. Under section 64C FSMA, an authorised firm must notify us if it takes disciplinary action against a member of conduct rules staff for a breach of our rules. ‘Disciplinary action’ means: • the issuing of a formal written warning • suspension or dismissal of the person • reduction or recovery of any of the person’s remuneration Misconduct that is dealt with informally or through lesser disciplinary measures is not reportable to us under SUP 15. We consulted on draft guidance to clarify breach thresholds in CP25/21 and are currently considering the feedback on this topic. We will explore potential opportunities to simplify conduct rule breach reporting as part of our wider review of the SM&CR.

18 Historic NFM 2.32 A few respondents asked us whether cases of historic NFM that come to light after the rule change should be considered under the current rules or those in place at the time of the events. Our response The new rule at COCON 1.1.7FR comes into force on 1 September 2026 and does not have retrospective effect. So, NFM that occurs before that date should be handled in line with the version of the Handbook in force at the time. We do not expect firms to undertake any retrospective analysis to check they have correctly determined conduct rule breaches in the past. However, if it does come to a firm’s notice that it has incorrectly determined a conduct rule breach under the rules that applied at the time, it should rectify its past notification in line with our rules (SUP 15).

19 Chapter 3 Fit and Proper test (FIT) 3.1 This chapter sets out the feedback received on potential new guidance in the Fit and Proper test for Employees and Senior Personnel sourcebook (FIT), and our response. FIT sets out factors to which we and firms should have regard when assessing whether an individual is fit and proper to perform their role. 3.2 In this chapter, the meaning of the term ‘NFM’ is not limited to the same types of misconduct discussed in Chapter 2. This is because the FCA, and firms, should consider all relevant matters which have arisen in the UK or elsewhere when determining a person’s honesty, integrity and reputation (FIT 2.1). Conduct both inside and outside the workplace may be relevant to fitness and propriety, consistent with the approach of other UK regulators. Consultation proposals 3.3 We proposed to add guidance to the FIT section of our Handbook to explain the relevance of NFM and other forms of conduct to fitness and propriety. The guidance would help firms take account of factors such as: • regulatory breaches, eg of COCON • conduct connected to work • behaviour in private or personal life • conduct on social media 3.4 We asked: Question 4: To what extent do you agree the draft FIT guidance would help you assess fitness and propriety? Question 5: Do you have any comments on the draft FIT guidance? Feedback on FIT 3.5 Most respondents (87%) agreed the guidance we consulted on would help them assess fitness and propriety. Many welcomed the additional clarity it would provide on our expectations and requirements, despite its estimated costs. 3.6 Given the strong support for our proposals, we have proceeded to publish a revised version of the FIT guidance that takes account of feedback received. We describe the feedback and our response below.

20 Investigating unproven allegations about private life 3.7 Sixteen respondents, mostly trade bodies and law firms, asked for more guidance on when and how firms would be expected to investigate events in an individual’s private life. 3.8 We were asked to define ‘a good reason’ to look into an individual’s private life. Respondents highlighted the difficulty, costs and legal risks of investigating unsubstantiated allegations or rumours about an individual’s private life. Our response We agree that a firm is generally best placed to determine whether an allegation merits further investigation on a case‑by‑case basis. We have added guidance to help firms assess whether they need to take steps to investigate allegations about an individual’s private life. For example, we have made it clear that firms are not expected to investigate trivial or implausible allegations or those it would be more appropriate for the relevant law enforcement or other authorities to investigate. We have also made it clear that any investigation should comply with all applicable laws. We have clarified that firms do not need to look into any allegations that, even if true, would not be relevant to fitness and propriety. Conduct in private life is relevant to fitness and propriety if it shows there is a material risk that the individual will breach regulatory standards and requirements. We have made it clear that a ‘material risk’ is one that is not remote or speculative. Conduct in private life that would breach regulatory standards if it were repeated at work, for example, violence or sexual misconduct, will be relevant if there is a material risk of such repetition. However, we have also made it clear that it should not automatically be assumed that private life conduct will be repeated at work. Conduct in private life may be relevant – even if it is unlikely to be repeated at work – if it is so serious there is a material risk of damaging public confidence in the UK’s financial system and financial services industry. Conduct that attracts a criminal conviction may be especially relevant to fitness and propriety, particularly if a custodial sentence is imposed. This is subject to consideration of relevant matters such as the type of offence, how old it is and evidence of rehabilitation since the date of the offence. 3.9 Sixteen respondents, including 9 trade bodies, expressed concerns about the draft guidance on firms’ reporting obligations under SUP 10C.14.18R. This said, ‘The fact that a firm has not been able to establish the truth of an allegation … does not mean that the firm should not report it to the FCA if, were it established to be true, it would reasonably be material to an assessment of fitness and propriety.’

21 3.10 Respondents strongly disagreed that firms should report unproven allegations to the FCA, arguing that this was unfair to individuals and exposed firms to litigation risk. Our response The draft guidance aimed to link the new guidance in FIT with our existing notification requirements at SUP 10C.14.18R. These say, ‘a firm that becomes aware of information that would reasonably be material to the assessment of the fitness and propriety of an FCA‑approved SMF manager, or of a candidate to be one, must inform us as soon as practicable and in any case, within seven business days.’ The detailed requirements set out in Form D are not limited to matters of established fact. For example, a firm is required to notify us if the SMF manager is the subject of any ongoing criminal investigation or disciplinary proceedings. This ensures we are promptly alerted to potential risks to consumers or markets and can take appropriate supervisory or enforcement action. We treat information about unproven allegations with all due caution and update our records accordingly when the firm notifies us of the outcome. The feedback on this topic suggests there is a risk of misinterpretation that could lead to disproportionate compliance activity and unnecessary firm burdens. So, we have deleted the sentence that caused the most concern (see paragraph 3.9), while retaining the cross‑reference to the notification rule at SUP 10C.14.18R. Social media 3.11 Most respondents welcomed the inclusion of guidance on social media and our explicit confirmation that firms do not need to proactively monitor their employees’ social media accounts. 3.12 However, 18 respondents, including 13 trade bodies, asked for more guidance on when firms would be expected to respond to allegations about social media activity in private life. They asked us to clarify the materiality threshold and whether it differed from that for ‘real life’ conduct. Our response We have clarified that the materiality threshold for social media conduct is consistent with other private life conduct as set out under paragraph 3.8 above. An individual’s social media activity in their private life will be relevant to their fitness and propriety it if indicates a material risk that they will breach regulatory standards and requirements. Examples could include threats of violence, or clear involvement in criminal activities, or conduct that shows a material risk that they will carry out bullying or harassment at work.

22 This means that firms are not required to investigate allegations about private life social media activity that are trivial, implausible, non‑material, irrelevant to fitness or where the conduct is unlikely to be repeated at work in a way that would breach regulatory standards. 3.13 Six respondents raised concerns about the draft guidance on the expression of controversial or offensive views on social media. This said, ‘Subject to the other points in this section, a person can lawfully express views on social media even if they are controversial or offensive, without calling into question their fitness under FIT, even if colleagues at work are upset by those views.’ 3.14 Respondents highlighted the potential negative impact of an individual’s private life social media activity on a firm’s staff, culture and reputation. Some questioned whether the guidance was inconsistent with our wider regulatory approach to NFM. Our response We want to give firms more confidence and clarity about when they can and should take action under our regulatory framework. We do not seek to restrict individuals’ legal rights of expression. We have made minor revisions to the guidance to reduce the risk of misinterpretation. For example, we deleted the word ‘offensive’ to avoid giving the impression that such conduct will never be relevant to fitness and propriety. However, we retained the important principle that individuals may lawfully express their views on social media without calling their fitness and propriety into question. This does not mean lawful expression of controversial views cannot be relevant to fitness and propriety. We have clarified that lawfully expressed views may be relevant to fitness and propriety for the same reasons as any other private life conduct. For example, they would be relevant if there was a material risk of the views being repeated at work in a way that would amount to a breach of the conduct rules. Nothing in our guidance would prevent a firm from taking appropriate disciplinary action for breaches of its social media or other internal policies. Ethical obligations 3.15 Seven respondents, including trade bodies and legal experts, questioned the guidance that said conduct in an individual’s private life may be relevant to fitness if ‘it demonstrates a willingness to disregard ethical or legal obligations.’ 3.16 They considered this would require firms to make subjective judgements about individuals’ personal ethical stances on matters of public and political interest. They warned that this could lead to inconsistent and potentially unfair decision‑making.

23 Our response We have considered the feedback but disagree that the guidance will require a firm to judge whether an individual is, or is not, an ethical person. Instead, the guidance says that repeated misconduct in private life can show that an individual lacks regard for ethical considerations. Upholding ethical considerations is a key part of acting with integrity. A firm’s decision would be based on objective evidence of repeated misconduct rather than a subjective assessment of the individual’s personal ethics, beliefs or morality. Repeated minor breaches 3.17 We proposed to provide guidance on how incidents of minor misconduct in private life can become relevant to fitness and propriety if they are repeated. We included an example of frequently repeated minor driving offences to illustrate this point. 3.18 Seven trade body and legal respondents expressed concerns about using minor motoring offences as an example. Some thought this set excessively high standards for conduct in private life. 3.19 Respondents also highlighted the logistical challenges of finding out about employees’ driving convictions. Adopting a consistent and fair approach would entail widespread proactive monitoring and background checks. Our response The guidance explains that repeated minor breaches may be relevant to fitness and propriety because they can show a disregard for complying with the law that could be reflected in the individual’s attitude to compliance with our rules. We consider that evidence that individuals have repeatedly ignored the law is likely to be relevant when assessing their fitness and propriety. However, feedback showed the specific example of minor motoring offences was unclear and might impose unintended burdens on firms. So, we have decided not to use this example in the final guidance. We expect firms to continue to make reasonable judgements about what kinds of offences, or how often they are repeated, might indicate that a person is dishonest or lacks integrity, and whether or not they are fit and proper. This is something firms already need to do.

24 Statutory objectives 3.20 Three respondents considered it was inappropriate to expect firms to assess an individual’s fitness and propriety against our statutory objectives. For example, a small firm might find it difficult to judge whether an individual’s conduct was inconsistent with our statutory objectives, particularly if there was no evidence of impact on public confidence. Our response Our statutory objectives help to define the standards of fitness and propriety that apply to regulated individuals. They are fundamental to how we interpret our statutory remit when determining whether an individual is fit and proper to perform a role. However, we accept that it would not be reasonable to expect firms to carry out their own fit and proper assessments in the same way. We have added guidance to reassure firms that we do not expect them to apply our statutory objectives as a self‑standing criterion when assessing fitness and propriety.

25 Chapter 4 Implementation date 4.1 This chapter sets out the feedback received on the proposed implementation date on which any new guidance would come into force, and our response. Consultation proposal 4.2 We proposed that any new COCON and FIT guidance should come into force on the same date as the new COCON rule – 1 September 2026 – to give firms sufficient time to update their policies and procedures. 4.3 We asked: Question 6: Do you agree that the new Handbook guidance – if made – should come into effect at the same time as the new COCON rule (1 September 2026)? Question 7: If no, when do you think any new Handbook guidance should come into effect? Feedback on the implementation date 4.4 Most respondents (80%) agreed that the guidance should come into force on the same date as the new rule, 1 September 2026. Nine respondents (11%) did not answer this question. 4.5 A few respondents said the guidance should come into force earlier or we should allow firms to implement it prior to 1 September 2026. 4.6 One trade body recommended bringing the FIT guidance into force later – at the end of 2026 – so that small and medium sized firms would have more time to update their processes. Our response In our view, it would not be appropriate to bring the COCON guidance on the new rule into legal force before the rule, as the rule does not have retrospective effect. However, we are publishing it now so that firms will have a full 8 months in which to amend their policies and processes where required. The new guidance in FIT is a clarification of our current approach to assessing fitness and propriety. However, we do not expect firms to revisit their past assessments. It is established that the version of FIT to

26 be applied is that in effect at the date of the assessment, though this may take account of earlier incidents. Most respondents agreed that all the guidance should come into effect at the same time. So, we will bring both the COCON and the FIT guidance into force on the same date as the new COCON rule, 1 September 2026. All affected firms should familiarise themselves with the new guidance at Appendix 1.

27 Chapter 5 Cost Benefit Analysis 5.1 This chapter sets out the feedback received on the cost benefit analysis (CBA) in CP25/18 and our response. Approach to the CBA 5.2 In CP23/20, we provided a CBA of our proposed rules and guidance for the wider D&I proposals, as well as our proposals on NFM. The cost estimates were based on 358 responses to our 2022 cost survey of 2,877 firms in a wide range of sectors and of different sizes. Firms were asked to estimate the additional costs of updating their current regulatory activities to align with our indicative policy concepts. 5.3 In light of the broad range of feedback received on CP23/20, anticipated legislative developments and wanting to avoid additional burdens on firms, we publicly confirmed in March 2025 that we would not take forward the D&I proposals. However, we continued to prioritise our proposals to tackle NFM which were set out in CP25/18. 5.4 In CP25/18, we updated our NFM cost estimates to reflect changes to the scope of our work, policy, external environment since 2022 and the firm population. To inform these updates, we contacted a representative sample of 67 firms and received detailed survey responses from 18 of these. We also held 2 focus groups with 10 firms. We used new data sources to improve our approach to scaling costs to industry. 5.5 We subsequently estimated total industry costs for the rule and guidance at £75m for one‑off implementation and £40m annual ongoing, spread across 37,805 SM&CR firms. The average cost per firm was estimated at £2,000 (implementation) and £1,050 (ongoing), though actual costs would vary from firm to firm. Of this figure, guidance was estimated at £50m (implementation) and £25m (ongoing). Table 1 Estimated total and average per firm costs of rule and guidance Total cost to industry Average cost per firm Policy element Implementation Ongoing (annual) Implementation Ongoing (annual) COCON rule £25m £15m £650 £400 COCON guidance £20m £10m £550 £250 FIT guidance £30m £15m £800 £400 Combined total cost £75m £40m £2,000 £1,050 5.6 We considered the combined benefits of the rule and guidance would outweigh the costs, deliver better overall outcomes than the rule alone and would be proportionate.

28 Our response to feedback on the CBA 5.7 We asked: Question 8: Do you have any comments on the costs and benefits of the guidance discussed in Chapter 3? Overview 5.8 Just under half of respondents (37/79), including 14 trade bodies and 11 authorised firms, commented on the CBA. All but one supported the policy aims and agreed guidance was needed. However, 20 respondents raised concerns that costs would be higher than estimated. Our response Our cost estimates are based on 2 firm surveys, as discussed in paragraphs 5.2 to 5.6. Respondents to CP25/18 did not raise any novel cost areas not covered by our earlier work on the CBA. However, some of the areas respondents highlighted as creating additional costs for their firm were not directly attributable to our proposals as they did not relate to regulatory requirements and would not be included. While some respondents suggested firm costs would be higher, the estimates they provided fell within the range of cost survey data from which we derived the per firm averages and were therefore already reflected in our estimates as set out in Table 1. Most respondents, including those who raised cost concerns, agreed guidance was needed to promote clarity, consistency and higher standards, while avoiding unnecessary extra costs. This was reinforced through our wider stakeholder engagement during the consultation period. We have carefully reviewed the feedback and made targeted revisions to the guidance to address key concerns, improve clarity and avoid disproportionate firm burdens. We are only publishing this guidance because there was clear support for us to do so – from 95% of respondents. We remain confident that our assessment of the costs and benefits of our proposals is valid, particularly as no new information was provided that would warrant changes to our methodology or estimates. We summarise the detailed feedback and our response below.

29 Feedback on the CBA 5.9 Most respondents, including those with cost concerns, agreed the guidance would bring benefits, including: • Greater clarity and consistency in applying our rules • Improved governance, culture and risk management • Better outcomes for customers and markets • Lower operational costs, legal risks and reliance on consultants 5.10 Seventeen respondents agreed the benefits of the guidance would outweigh the costs, even if their costs increased. Seven firms said they expected minimal additional costs as the guidance aligned with their current approach or would offset increases. 5.11 Twenty respondents, including 12 trade bodies, believed actual costs would exceed estimates, though all but 2 agreed that guidance was needed. Two noted the estimates were based on 2022 data, which may not reflect current conditions. One trade body suggested carrying out a new CBA. Two others said costs would be higher for smaller firms with limited in‑house resources. Our response Our cost estimates are based on 2 firm surveys and the average per firm costs reflect the full range of estimates received. As shown in Table 4 of CP25/18, the average per firm cost varies according to the size of the firm. We recognise that some firms, particularly larger firms, will incur costs higher than these averages, and that some firms, including larger firms, may face minimal additional costs. The per firm averages in Table 1 (above) reflect a high number of small firms in the SM&CR population, which we generally expect to incur lower costs. For example, over 90% of SM&CR firms have fewer than 50 employees and 65% have fewer than 10, so scaling costs by firm size results in low per firm averages. Our supervisory approach takes account of the size, nature, scale and complexity of a business. While recognising the potential costs of an NFM case, we note that incidence rates at smaller firms are relatively low. Our 2024 Culture and NFM survey found that firms with 50 employees might expect to see on average 1 incident every 2 years. 5.12 Respondents identified areas where they considered costs would rise, including: • policy and procedure updates • staff and manager training • system changes and compliance monitoring • HR technology and analytics • investigations, consultancy and tribunal defence • record‑keeping, reporting and ongoing compliance

30 Our response In our 2022 cost survey, we asked firms to estimate the additional costs of aligning with our indicative policy approach. We would expect them to have included all relevant regulatory activities in paragraph 5.12. Respondents to both our consultations did not identify any unexpected cost areas. Our proposals aim to integrate NFM considerations into firms’ existing processes for meeting our regulatory expectations and requirements. Firms already have internal disciplinary policies and processes for handling NFM and assessing whether misconduct may be relevant for regulatory purposes. Some of the cost areas highlighted by respondents did not appear to be directly attributable to our regulatory requirements. For example, taking disciplinary action in response to NFM, engaging external investigators and defending tribunal claims. Therefore, these costs were not reflected in our CBA. 5.13 Several respondents requested more examples, templates and training materials to further reduce their costs. Our response We have provided more guidance and examples where feedback indicated uncertainty or risk of inconsistency with employment law. However, guidance cannot cover every scenario and firm judgement will remain important. We encourage firms to continue working with their trade associations and industry standard setters to develop practical guidance on workplace culture and tackling NFM.

31 Annex 1 List of non‑confidential respondents Affinity Allianz UK Association for Financial Markets in Europe Association of British Insurers Association of Financial Mutuals Association of Foreign Banks Association of Mortgage Intermediaries Bloomberg LP British Insurance Brokers’ Association British Private Equity and Venture Capital Association Building Societies Association Capita Cartlidge Morland Chartered Insurance Institute City Hive City HR Association City of London Law Society Regulatory Law Committee Compare the Market Consumer Credit Trade Association Diversity Project Employers’ Initiative on Domestic Abuse Employment Lawyers Association European Leveraged Finance Association European Venues and Intermediaries Association

32 Finance & Leasing Association Gallagher Golden Charter Limited Hargreaves Lansdown Howden Group Hymans Robertson LLP In Partnership Irish League of Credit Unions Legal and General Lewis Silkin LLP Lloyds Banking Group plc Lloyd’s Market Association London & International Insurance Brokers’ Association Marsh Ltd MSCI Limited National Franchised Dealers Association NewDay Personal Assurance Services Limited Personal Investment Management & Financial Advice Association Phoenix Group Managed Services Pinsent Masons Resolve Human Resources Limited Royal Bank of Canada Shield FC Simmons and Simmons LLP SolasOS Squire Patton Boggs (UK) LLP

33 SSIR Partners Ltd Standard Chartered Bank The Alternative Investment Management Association The Broker Club The International Underwriting Association The Investing and Saving Alliance The Investment & Life Assurance Group The Investment Association The Society of Lloyds TP ICAP UBT (EU) Ltd UK Finance Vanquis Banking Group Willis Limited

34 Annex 2 Abbreviations used in this paper Abbreviation Description CBA Cost Benefit Analysis COCON Code of Conduct sourcebook CP Consultation Paper D&I Diversity and Inclusion Equality Act Equality Act 2010 FCA Financial Conduct Authority FIT Fit and Proper test for Employees and Senior Personnel sourcebook FSMA Financial Services and Markets Act 2000 NFM Non‑financial misconduct PRA Prudential Regulation Authority PS Policy Statement SC4 Senior manager conduct rule 4 SM&CR Senior Managers and Certification Regime SMCR financial activities FCA glossary term SMF Senior Management Function SMF manager FCA glossary term SUP Supervision sourcebook WPA Worker Protection (Amendment of Equality Act 2010) Act 2023

Appendix 1 Made rules (legal instrument)

FCA 2025/60 NON-FINANCIAL MISCONDUCT (No 2) INSTRUMENT 2025 Powers exercised A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the powers in section 139A (Power of the FCA to give guidance) of the Financial Services and Markets Act 2000 (“the Act”). Commencement B. This instrument comes into force on 1 September 2026, immediately after the Non￾Financial Misconduct Instrument 2025 comes into force. Amendments to the Handbook C. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2). (1) (2) Glossary of definitions Annex A Code of Conduct sourcebook (COCON) Annex B Fit and Proper test for Employees and Senior Personnel sourcebook (FIT) Annex C Citation D. This instrument may be cited as the Non-Financial Misconduct (No 2) Instrument 2025. By order of the Executive Regulation and Policy Committee of the FCA 9 December 2025

FCA 2025/60 Page 2 of 47 Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text. Amend the following definition as shown. employee … (4) (for the purposes of SUP 15.11 (Notification of conduct rule breaches and disciplinary action) and COCON) has the meaning in section 64A(6) of the Act (Rules of conduct) which, in summary, says an employee of a person (the ‘employer’) includes a reference to a person who: (a) personally provides, or is under an obligation personally to provide, services to the employer under an arrangement made between the employer and the person providing the services or another person; and (b) is subject to (or to the right of) supervision, direction or control by the employer as to the manner in which those services are provided. However, where a Handbook provision in (4) refers to certification employees, (3) still applies to the definition of certification employee and (in the guidance in COCON where the context requires) an employer may include a person who is not authorised. …

FCA 2025/60 Page 3 of 47 Annex B Amendments to the Code of Conduct sourcebook (COCON) In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. 1 Application and purpose 1.1 Application 1.1.1 G Under section 64A of the Act, the FCA may make rules about the conduct of certain persons working in firms. COCON contains those rules. 1.1.1-A G COCON 1 Annex 2 (What COCON covers) contains flow diagrams explaining how COCON 1.1 works. … To what conduct does it apply? (Relationship between the exclusions) … 1.1.5C G (1) The effect of COCON 1.1.5BR(1) COCON 1.1.5BR is that: shown in section 3 of COCON 1 Annex 2 (What conduct COCON applies to). (a) conduct that is not excluded from the scope of COCON by COCON 1.1.7AR to COCON 1.1.7FR but is outside the scope of COCON 1.1.6R to COCON 1.1.7R is outside the scope of COCON; and (b) conduct that is excluded from the scope of COCON by one of the rules in COCON 1.1.7AR to COCON 1.1.7FR but is within the scope of COCON 1.1.6R to COCON 1.1.7R is outside the scope of COCON. (2) The effect of COCON 1.1.5BR(2) is that conduct of a member of the conduct rules staff of a firm: (a) is outside the scope of COCON even if it is excluded by only one of the rules in COCON 1.1.7AR to COCON 1.1.7FR; and (b) is outside the scope of: (i) Rule 4 in COCON 2.1 (You must pay due regard to the interests of customers and treat them fairly) even if the only rule excluding it is COCON 1.1.7ER; and

FCA 2025/60 Page 4 of 47 (ii) Rule 6 in COCON 2.1 (You must act to deliver good outcomes for retail customers) even if the only rule excluding it is COCON 1.1.7CR. … To what conduct does it apply? (Other limitations: Non-banks: Harassment) 1.1.7F R … 1.1.7G G COCON 4.3 (Specific guidance on harassment) gives guidance on the kind of conduct covered by COCON 1.1.7FR, including the point that COCON 1.1.7FR only covers conduct that is serious. … Where does it apply? 1.1.8B R … 1.1.8C G The effect of COCON 1.1.8BR is shown in section 4 of COCON 1 Annex 2 (Territorial scope). … Insert the following new section, COCON 1.3, after COCON 1.2 (Investments). The text is all new and is not underlined. 1.3 Scope of COCON Introduction 1.3.1 G This section deals with the restrictions on the scope of COCON based on: (1) the activities of the firm in COCON 1.1.6R to COCON 1.1.7R (To what conduct does it apply? (Limitations in the Act)) (COCON 1.3.2G to COCON 1.3.9G deal with this); (2) the SMCR financial activities of a firm in COCON 1.1.7AR (To what conduct does it apply? (Other limitations: Non-banks)) (COCON 1.3.10G to COCON 1.3.16G deal with this); and (3) COCON 1.1.7BR (To what conduct does it apply? (Other limitations: Benchmark firms)) (COCON 1.3.17G deals with this). COCON does not cover private or personal life 1.3.2 G COCON 1.1.6R to COCON 1.1.7R limit the application of COCON to conduct that relates to a function carried out by a member of the conduct rules staff where in turn that function relates to the carrying on of an activity by the firm. The firm’s activity may be a regulated activity or an

FCA 2025/60 Page 5 of 47 unregulated activity. This limitation on the scope of COCON applies in relation to all firms. 1.3.3 G (1) The effect of COCON 1.1.6R to COCON 1.1.7R is that conduct relating to the conduct rules staff member’s private or personal life is outside the scope of COCON. (2) However, this does not mean that a senior conduct rules staff member is not required to disclose information about their private or personal life under COCON 2.2.4R (SC4). A senior conduct rules staff member should disclose such matters if they are material to an assessment of fitness and propriety under FIT. 1.3.4 G Factors that point towards conduct being within the scope of COCON 1.1.6R to COCON 1.1.7R include: (1) the conduct occurred when the conduct rules staff member was present on the firm’s premises; (2) the conduct occurred when the conduct rules staff member was working on the firm’s business; (3) the conduct involved a client, a professional acquaintance, another member of the firm’s staff or someone the conduct rules staff member had dealt with on behalf of their firm; (4) the conduct was carried out using equipment supplied by or made available by the firm or by involving the firm’s staff; (5) the conduct arose in a business context, including an official or an informal event organised or supported by the firm or in which the firm participates, whether it is held at the firm’s premises or at another location; (6) the position of the conduct rules staff member as a conduct rules staff member of the firm helped them to carry out the conduct; or (7) the purpose (misguided or not) of the conduct was to benefit the firm. 1.3.5 G (1) Whether conduct is within the scope of COCON depends on the specific facts of each case. It is therefore not possible to set out scenarios in the Handbook and say whether in all cases the conduct in question will be within the scope of COCON. (2) Paragraph (1) means that: (a) the list of factors in COCON 1.3.4G is not exhaustive; and (b) the presence or absence of one of the factors in COCON 1.3.4G is not by itself conclusive.

FCA 2025/60 Page 6 of 47 (3) Another result of (1) is that: (a) when the table in COCON 1.3.7G says that conduct is generally within the scope of COCON, that means that the facts of the scenario are ones that point towards the conduct coming within the scope of COCON; and (b) when the table in COCON 1.3.7G says that conduct is generally outside the scope of COCON, that means that the facts of the scenario are ones that point against the conduct coming within the scope of COCON, but that in an individual case all the other features of the case are also relevant. 1.3.6 G (1) The table in COCON 1.3.7G sets out examples of when a person’s conduct is outside the scope of COCON because it is part of their private or personal life and when it is not excluded for that reason (subject to COCON 1.3.5G). (2) As explained in Note (2) to the table, conduct to which ‘Yes’ applies is not necessarily within the scope of COCON as it may be excluded by one of the other scope rules in COCON 1.1 (Application). For example, it may be excluded by the exclusion in COCON 1.1.7AR (To what conduct does it apply? (Other limitations: Non-banks)). (3) Another example of the point in (2) is that if M (as referred to in the notes to the table) is based in an overseas office of the firm and carries out the conduct from there (or from their home in the country where the overseas office is located), the conduct will be outside the scope of COCON under COCON 1.1.10R (Where does it apply?) unless M comes within COCON 1.1.9R (which deals with senior conduct rules staff members and material risk takers) or within COCON 1.1.10R(2)(b) (which deals with clients in the United Kingdom). 1.3.7 G Table: Private or personal life and COCON Description of conduct Whether generally within the scope of COCON 1.1.6R to COCON 1.1.7R Misconduct by M in relation to a fellow member of the workforce while both are on their firm’s premises. Yes Misconduct by M in relation to a fellow member of the workforce Yes

FCA 2025/60 Page 7 of 47 while M is working remotely for their firm. Misconduct by M in relation to a family member while M is working remotely for their firm. No Misconduct by M in relation to a member of the public while M is commuting to or from their firm’s place of business for work. No Misconduct by M in relation to a fellow member of the workforce when both are travelling to a meeting in which they will represent their firm. Yes Misconduct by M in relation to a client at a business meeting in which M is representing their firm. Yes Misconduct by M in relation to a fellow member of the workforce at a social occasion organised by their firm. Yes Misconduct by M in relation to a fellow member of the workforce at a social occasion organised by M or another member of the workforce in their personal capacity. No However: (1) An occasion organised by a manager may be within the scope of COCON, taking into account that the manager’s direct reports may feel obliged to attend. (2) If the event takes place after a firm event but at a separate location or venue, it may be within the scope of COCON if it is a continuation of the first event or if the conduct started at the first event and continued in the new venue. Otherwise, COCON is likely to cease to apply because the connection between the event and the activities of the firm has been lost. Misconduct by M at a social occasion, a meeting, a round table, an awards ceremony, a training Yes

FCA 2025/60 Page 8 of 47 course or a workshop, in each case organised by a client of their firm, another firm, an industry body, a training organisation or a regulator, in which they will represent their firm or where the main reason for the invitation is their working for their firm. M is a member of a profession (such as an accountant, actuary or lawyer) and practises that profession in their job with their firm. M carries out misconduct at an event organised by a third party to meet the professional requirements of that profession or by the regulator of that profession. Yes M publishes material on a personal social media account (including sending it on a messaging app) held by M. As this table only covers whether conduct takes place in M’s private life (and hence is outside the scope of COCON under COCON 1.1.6R to COCON 1.1.7R), this example assumes that the publication would otherwise breach COCON. This is an example of how it is not possible to give a definitive answer to a scenario based on a single element. Factors to take into account include: • whether the material is directed at a fellow member of the workforce (if it is, that points towards the conduct being within scope); • whether there is another connection between M and the subject of the misconduct that is not based on M’s work with their firm (if there is such a connection, that may point away from the application of COCON); • whether it is part of a course of conduct that includes other incidents that are more closely connected with M’s work at the firm; • whether the content of the social media posts is related to work at the firm; • whether M uses a work-issued device. The fact that M uploads the posts during working hours or while on the firm’s premises is not a strong factor

FCA 2025/60 Page 9 of 47 pointing towards the application of COCON. If the conduct takes place over the firm’s systems (for instance through the firm’s e-mail system) it is likely to be within the scope of COCON. Notes (1) ‘M’ refers to the member of a firm’s conduct rules staff carrying out the conduct in question. (2) ‘Yes’ means that, in accordance with COCON 1.3.5G(3)(a), the scenario is based on a factor that points towards the conduct being within COCON 1.1.6R to COCON 1.1.7R and thus within the scope of COCON unless excluded by COCON 1.1.1AR to COCON 1.1.5AR (To whom does it apply?), COCON 1.1.7AR to COCON 1.1.7FR or by COCON 1.1.8BR to COCON 1.1.11CR (Where does it apply?). (3) ‘No’ means that, in accordance with COCON 1.3.5G(3)(b), the scenario is based on a factor that points towards the conduct being outside COCON 1.1.6R to COCON 1.1.7R and thus outside the scope of COCON. 1.3.8 G However, conduct excluded from COCON as described in the table in COCON 1.3.7G can still be relevant to fitness and propriety, as described in FIT 1.3 (Assessing fitness and propriety). 1.3.9 G The scope of COCON is not limited to conduct that is authorised by the firm or carried out with a view (misguided or not) that it is for the firm’s benefit. Conduct is not excluded from the scope of COCON just because the firm forbids it (for instance, in a staff handbook) or it is calculated to harm the firm. Thus, for example, the following conduct is within the scope of COCON 1.1.6R to COCON 1.1.7R: (1) misappropriating a client’s or the firm’s assets; (2) providing false or inaccurate details about the member of the conduct rules staff’s training, qualifications, past employment record or experience; (3) misusing the assets or confidential information of a client or the firm to make a personal profit; (4) misconduct against a client; (5) harassment of a fellow member of the workforce; and (6) maliciously sabotaging a firm’s information technology systems or altering or erasing its data.

FCA 2025/60 Page 10 of 47 SMCR financial activities 1.3.10 G COCON 1.3.11G to COCON 1.3.16G deal with a conduct rules staff member for whom the scope of COCON is limited to conduct in relation to their firm’s SMCR financial activities by COCON 1.1.7AR. 1.3.11 G When COCON is restricted to SMCR financial activities, it covers more than conduct involving direct dealings with counterparties and customers (and potential ones) or their assets at the point of sale or at the time of the transaction or service. It can also cover matters such as the following: (1) conduct arising out of such direct dealings, such as record-keeping, valuations and reporting; (2) after-sale or post-transaction activities such as settlement, queries, dealing with the exercise of rights by the firm or the customer, complaints, cancellations, renewals and generally dealing with the customer or counterparty through the lifecycle of the product or relationship; (3) designing and operating policies and procedures relating to the conduct of the firm’s relationship with counterparties and customers, such as: (a) product or services design; (b) policies and procedures about what services and products to sell or buy; (c) policies and procedures about product distribution; (d) policies and procedures for the conduct of the relationship between the firm and a customer in relation to products and services already sold or delivered; and (e) policies and procedures for the monitoring of customer outcomes for products and services already sold or delivered; and (4) management and monitoring of these activities. 1.3.12 G COCON is not restricted to the activities in COCON 1.3.11G. For example, it covers: (1) participation in meetings of the firm’s governing body and its committees and other management forums; (2) conduct in relation to internal systems, controls and operations supporting the activities in COCON 1.3.11G;

FCA 2025/60 Page 11 of 47 (3) conduct in relation to acquisition and management of resources used to support the activities in COCON 1.3.11G; and (4) conduct in relation to systems and controls to monitor and control risks such as liquidity, operational, solvency, market and trading risks. 1.3.13 G (1) Conduct of an individual is not within the scope of COCON just because it is carried on in relation to an activity of their firm that is connected to an SMCR financial activity that is carried on by the firm but that is not itself an SMCR financial activity. (2) For example, the misconduct of the employee in the following examples is not within the scope of COCON: (a) A firm’s main business is to sell physical goods. It sells some of them on credit and so has permission for consumer credit. An employee steals some of the firm’s stock. (b) A firm’s main business is to sell cars. It also sells connected insurance and so has permission for insurance distribution activities. An employee commits a serious driving offence while moving one of the cars the firm sells. (3) However, conduct in (2) is relevant to the fitness and propriety under FIT of the employee, if the employee is subject to FIT. 1.3.14 G (1) COCON 1.1.7FR says that the restriction of the scope of COCON to conduct in relation to a firm’s SMCR financial activities under COCON 1.1.7AR does not apply to harassment or similar conduct in relation to a fellow member of the workforce. Instead, COCON 1.1.7FR(5) excludes such conduct if it clearly only relates to a part of the firm’s business that does not carry on regulated activities or other SMCR financial activities, as illustrated further in the table in COCON 1.3.15G. (2) COCON 1.3.15G gives examples of how the exclusion in COCON 1.1.7FR(5) applies to conduct of a conduct rules staff member in relation to a fellow member of the workforce when a firm has both a financial services business and a non-financial services business. (3) The example relates to internal audit. The example corresponds to the example in SYSC 25.3.4G (Management responsibilities maps: Exclusion of non-financial services activities for some firms). 1.3.15 G Table: Application of COCON to a firm with mixed businesses Description of business Whether generally within the scope of COCON

FCA 2025/60 Page 12 of 47 (1) F’s internal audit function covers its entire business without separating the parts that deal with its financial services business and its other business. The conduct rules staff member carrying out the misconduct and the subject of the misconduct work in the internal audit function. The conduct is within scope. (2) Same as (1) except that the subject of the misconduct works outside the internal audit function. The conduct is within scope even if the subject of the misconduct works for the non￾financial services part of the business. (3) F separates the part of its internal audit function that deals with its financial services business from the part that deals with the other part of its business. Both the conduct rules staff member carrying out the misconduct and the subject of the misconduct work in the part of the internal audit function that does not deal with the financial services business. The conduct is outside scope. It would be within scope if either the conduct rules staff member carrying out the conduct or the subject of the conduct work in the part of the internal audit function that deals with the financial services business. (4) F’s internal audit function covers its entire business as described in (1). Within the function, certain individuals deal with the financial services business, and other individuals deal with the non￾financial services business. The conduct rules staff member carrying out the misconduct deals with the financial services part of F’s business and the subject of the misconduct deals with the non-financial services business or vice versa. The conduct is within scope. (5) F’s internal audit function covers F’s and the rest of its group’s entire business without separating the parts that deal with the group’s financial services business and the group’s other business. The conduct rules staff member carrying out the misconduct works in the internal audit function and the subject of the misconduct works in another company in F’s group. The conduct is within scope.

FCA 2025/60 Page 13 of 47 (6) F’s internal audit function covers the whole of its group’s activities. F separates the part of the internal audit function that deals with the group’s financial services business from the part that deals with the other part of the group’s business. The conduct rules staff member carrying out the misconduct works in the part of the internal audit function that does not deal with the financial services business. The subject of the misconduct works in another company in the firm’s group. The conduct is outside scope. It is outside scope even if the subject of the misconduct’s job involves SMCR financial activities carried out by another company in F’s group. This is because, even if the conduct relates to SMCR financial activities, it does not relate to SMCR financial activities carried on by F. Notes (1) When the table says that conduct is outside scope, that means that COCON 1.1.7FR does not apply and instead COCON 1.1.7AR or COCON 1.1.7BR applies. (2) When the table says that conduct is within scope, that means that COCON 1.1.7FR applies and the conduct is within the scope of COCON unless excluded by COCON 1.1.1AR to COCON 1.1.5AR (To whom does it apply?) COCON 1.1.6R to COCON 1.1.7R (To what conduct does it apply? (Limitations in the Act)) or by COCON 1.1.8BR to COCON 1.1.11CR (Where does it apply?). (3) See COCON 4.3.16G (Subject of the misconduct) for the meaning of the phrase ‘subject of the conduct’. (4) ‘F’ refers to the firm for which the member of the conduct rules staff carrying out the conduct in question works. 1.3.16 G The flow diagram in COCON 4 Annex 1 3.7G gives further guidance on how COCON 1.1.7FR works. Benchmark firms 1.3.17 G COCON 1.1.7FR also applies to a pure benchmark SMCR firm to which the restrictions in COCON 1.1.7BR apply. The flow diagram in COCON 4 Annex 1 3.7G gives further guidance on how COCON 1.1.7FR works for such a firm. Insert the following new Annex, COCON 1 Annex 2, after COCON 1 Annex 1 (Guidance on the role and responsibilities of non-executive directors of SMCR firms). The text is all new and is not underlined. 1 Annex 2 How the application rules in COCON 1.1 (Application) work

FCA 2025/60 Page 14 of 47 Section 1: Purpose of this Annex and introduction 1 Annex 2 1.1 G The purpose of this Annex is to describe how COCON 1.1 (Application) works in the form of flow diagrams. 1 Annex 2 1.2 G COCON does not apply unless all the following conditions are met: (1) the person whose conduct is in question is of a kind to whom COCON applies (section 2 of COCON 1 Annex 2 deals with this); (2) the conduct is of a kind to which COCON applies (section 3 of COCON 1 Annex 2 deals with this); and (3) the conduct is within the territorial scope of COCON (section 4 of COCON 1 Annex 2 deals with this). 1 Annex 2 1.3 G In this Annex: (1) ‘P’ means the person whose conduct is in question; (2) ‘F’ means the firm P works for; (3) the ‘consumer duty rule’ means Rule 6 in COCON 2.1; and (4) the ‘harassment rule’ means COCON 1.1.7FR. 1 Annex 2 1.4 G If a flow diagram in one section of this Annex says that COCON does not apply, there is no need to look any further in that flow diagram or in any later flow diagram or section of this Annex. 1 Annex 2 1.5 G This Annex deals with the 3 sets of rules in COCON 1.1 (Who?, What? and Where?) in the same order as COCON 1.1. However, a person wanting to see whether conduct is within the scope of COCON can apply them in any order. For example, if conduct takes place outside the UK, a person may wish to apply the territorial scope rules first. If the answer is that the conduct is outside the territorial scope of COCON, COCON does not apply and there is no need to look at any other part of COCON 1.1. 1 Annex 2 1.6 G COCON 4 Annex 1 contains more detailed flow diagrams dealing with conduct within the harassment rule. Section 2: Who does COCON apply to? 1 Annex 2 2.1 G This section deals with the types of people COCON applies to. It is guidance on COCON 1.1.1AR to COCON 1.1.5AR. 1 Annex 2 2.2 G Flow diagram: Who COCON applies to

FCA 2025/60 Page 15 of 47 1 Annex 2 2.3 G The flow diagram in COCON 1 Annex 2 2.2G does not cover COCON 1.1.4R(2). 1 Annex 2 2.4 G COCON 1.1.4R(2) says that the only senior manager conduct rule in COCON 2.2 that applies to a director of a UK SMCR firm who is not an SMF manager and does not perform the functions of one is rule SC4. In particular, that means that the only senior manager conduct rule that applies to many non￾executive directors is SC4. Section 3: What conduct COCON applies to: Introduction 1 Annex 2 3.1 G This section deals with the types of conduct COCON applies to. It is guidance on COCON 1.1.5BR to COCON 1.1.8AR. In particular, it explains COCON 1.1.5BR. 1 Annex 2 3.2 G COCON 1 Annex 2 3.4G contains the first part of the flow diagram. If this part of the flow diagram says that COCON does not apply, that means that the conduct in question is not within the scope of COCON. There is no need to go further in the flow diagram. 1 Annex 2 3.3 G After that, the flow diagram splits into 3 parts, depending on what kind of firm F is. What conduct COCON applies to: Questions applicable to all firms

FCA 2025/60 Page 16 of 47 1 Annex 2 3.4 G Flow diagram: What conduct COCON applies to: Questions applicable to all firms 1 Annex 2 3.5 COCON 1.3.2G to COCON 1.3.9G contain guidance on COCON 1.1.6R to COCON 1.1.7R as referred to in the flow diagram in COCON 1 Annex 2 3.4G. What COCON applies to: SMCR banking firms 1 Annex 2 3.6 G Flow diagram: SMCR banking firms

FCA 2025/60 Page 17 of 47 What COCON applies to: Firms other than SMCR banking firms and benchmark administrators 1 Annex 2 3.7 G Flow diagram: Firms other than SMCR banking firms or benchmark administrators

FCA 2025/60 Page 18 of 47 What COCON applies to: Benchmark administrators 1 Annex 2 3.8 G Flow diagram: Benchmark administrators

FCA 2025/60 Page 19 of 47 Section 4: Territorial scope 1 Annex 2 4.1 G This section deals with the territorial scope of COCON. It is guidance on COCON 1.1.8BR to COCON 1.1.11DR. 1 Annex 2 4.2 G Flow diagram: Territorial scope

FCA 2025/60 Page 20 of 47 Section 5: Topics not covered 1 Annex 2 5.1 G This Annex does not cover the effect described in COCON 1.1.11BG (effect on the territorial scope of COCON of the Regulated Activities Order) or COCON 1.1.12R (requirements of an EU measure passed or made before IP completion day). Amend the following as shown. 4 Specific guidance on conduct rules 4.1 Specific guidance on individual conduct rules

FCA 2025/60 Page 21 of 47 Rule 1: You must act with integrity 4.1.1 G The following is a non-exhaustive list of examples of conduct that would be in breach of rule 1. … (19) … (20) Subjecting a fellow member of the workforce to significant detriment for complying with rule 3 in COCON 2.1 or rule SC4 in COCON 2.2, or for using the firm’s whistleblowing procedures. While this paragraph may in practice usually be most relevant to a manager, this kind of misconduct can be carried out by any member of the workforce. (21) Harassment of a fellow member of the workforce (see COCON 4.3 (Specific guidance on harassment) for more on this). Rule 2: You must act with due skill, care and diligence … 4.1.3 G The following is a non-exhaustive list of examples of conduct by any conduct rules staff that would be in breach of rule 2. … (6) … (7) Harassment of a fellow member of the workforce (see COCON 4.3 (Specific guidance on harassment) for more on this). Acting with due skill, etc as a manager (rule 2): General 4.1.3A G In COCON 4.1.4G to COCON 4.1.8-DG, the term ‘manager’ is not limited to a line manager. [Editor’s note: the amended subheading ‘Acting with due skill, etc as a manager (rule 2): General’ also applies to COCON 4.1.5G to COCON 4.1.8G.] … 4.1.8 G … Acting with due skill, etc as a manager (rule 2): Harassment in the workforce 4.1.8-A G A manager should try to prevent harassment and other kinds of misconduct referred to in COCON 4.3.1G (Purpose) that breaches COCON. What a manager should do in a particular situation will depend on the exact facts. A manager will not be in breach of rule 2 if they have acted reasonably. There

FCA 2025/60 Page 22 of 47 will often be a number of different reasonable courses of action that can be taken in a particular case. 4.1.8-B G The following is a non-exhaustive list of examples of conduct by a manager in relation to misconduct referred to in COCON 4.1.8-AG that would breach rule 2: (1) failing to take reasonable steps to protect staff against misconduct of that kind, including failing to: (a) intervene to stop such behaviour where appropriate if the manager knows or should reasonably have known of it; (b) appropriately operate the firm’s policies, systems and controls to detect and prevent such behaviour; and (c) (if the manager has sufficient authority to do this) set up and maintain such policies, systems and controls; (2) failing to take seriously or to deal appropriately with complaints of misconduct of the type referred to in COCON 4.1.8-AG; and (3) failing to take reasonable steps to provide a safe environment for people to raise concerns about such treatment. 4.1.8-C G In considering whether a manager has breached rule 2 for any of the reasons in COCON 4.1.8-BG, the FCA will take into account whether it was reasonable for the manager to take action in the circumstances and whether there were any limits or constraints on the manager’s ability to act. For example: (1) the relevant policies and processes may be set elsewhere in the firm or its group; (2) whether or not the manager has the authority to take action in the particular case may be relevant; and (3) it may be the firm’s policy that the firm’s human resources function deals with allegations of misconduct. 4.1.8-D G A firm may allocate responsibility for fair treatment of its staff to a particular senior manager or central function. If it does, this does not absolve other managers of their regulatory responsibilities. COCON 4.1.8-AG is relevant to all the managers referred to in this paragraph. … 4.2 Specific guidance on senior manager conduct rules …

FCA 2025/60 Page 23 of 47 SC4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice … 4.2.29 G In determining whether or not a person’s conduct complies with rule SC4 in COCON 2.2.4R, the factors which the FCA would expect to take into account include: (1) whether it would be reasonable for the individual to assume that the information would be of material significance to the regulator concerned; and (2) whether the information related to the individual themselves or to their firm; and [deleted] (3) whether any decision not to report the matter was taken after reasonable enquiry and analysis of the situation. … Insert the following new section, COCON 4.3, after COCON 4.2 (Specific guidance on senior manager conduct rules). The text is all new and is not underlined. 4.3 Specific guidance on harassment Purpose 4.3.1 G This section describes when behaviour that can broadly be described as bullying, harassment, being offensive or insulting or causing distress and similar behaviour in relation to a work colleague is a breach of Individual Conduct Rule 1 (COCON 2.1.1R) or Individual Conduct Rule 2 (COCON 2.1.2R). 4.3.2 G Although this section does not cover every kind of misconduct between members of the workforce of a firm that might be a breach of Individual Conduct Rule 1 or Individual Conduct Rule 2, it does describe when behaviour of the kind in COCON 4.3.1G will be a breach of those rules. Summary 4.3.3 G COCON 3.1 (General factors for assessing compliance) is the starting point for deciding whether there has been a breach of COCON. Subject to that, behaviour of the kind in COCON 4.3.1G is a breach of Individual Conduct Rule 1 or Individual Conduct Rule 2 if: (1) the conduct is of the type described in COCON 1.1.7FR(4); and (2) the conduct in question involves:

FCA 2025/60 Page 24 of 47 (a) a lack of integrity (in the case of Individual Conduct Rule 1); or (b) a failure to act with due skill, care and diligence (in the case of Individual Conduct Rule 2). 4.3.4 G The flow diagrams in COCON 4 Annex 1 (How COCON applies to harassment) explain COCON 4.3.3G in more detail and show how to decide whether conduct within COCON 4.3.1G is a breach of COCON. Application to banks 4.3.5 G (1) This section applies to an SMCR banking firm as well as to other kinds of SMCR firm. (2) This section cross refers to COCON 1.1.7FR (To what conduct does it apply? (Other limitations: Non-banks: Harassment)) even though that rule does not apply to an SMCR banking firm. (3) The reason that this section cross-refers to that rule in the case of SMCR banking firms as well as other kinds of SMCR firm is that behaviour of the kind in COCON 4.3.1G is only capable of coming within COCON if it is of a kind described in COCON 1.1.7FR(4). This is the case for both an SMCR banking firm and for any other kind of SMCR firm. (4) Therefore this section applies COCON 1.1.7FR(4) to an SMCR banking firm as guidance for the purpose of this section. (5) The rest of COCON 1.1.7FR is not relevant to an SMCR banking firm. Harassment 4.3.6 G The factors to take into account in deciding whether conduct comes within COCON 1.1.7FR(4) include: (1) whether it is serious (see COCON 4.3.7G to COCON 4.3.11G); (2) its effect (see COCON 4.3.12G to COCON 4.3.14G); (3) its purpose (see COCON 4.3.15G); and (4) the factors in COCON 4.3.16G to COCON 4.3.18G. Seriousness 4.3.7 G COCON 1.1.7FR(4) only covers conduct that is serious.

FCA 2025/60 Page 25 of 47 4.3.8 G The factors that the FCA will take into account when deciding whether misconduct in relation to a fellow member of the workforce is serious enough to amount to a breach of COCON include: (1) whether the conduct is repeated or part of a pattern; (2) the duration of the conduct; (3) the size of the impact on the subject of the conduct (the rule applies to effects which are serious and marked, and not to those which are, though real, of lesser consequence); (4) the seniority of the person whose conduct is in question; (5) the difference in seniority between the person whose conduct is in question and the subject of the conduct and whether the person whose conduct is in question has control or influence over the other’s career; (6) mitigating and aggravating factors even if they take place subsequently (the factors in FIT 1.3.10G(3) to (7) (Breaches of requirements of the regulatory system) are relevant here also); (7) whether the person whose conduct is in question has been warned or disciplined for similar conduct by the firm, a previous employer, the police or a regulator; (8) whether the person whose conduct is in question has previously undertaken not to do the act or engage in the behaviour in question; and (9) whether the conduct is criminal (particularly if it is of the kind described in FIT 1.3.22G (Offences)) or would justify dismissal. 4.3.9 G Although matters occurring after the conduct in question are generally relevant to mitigation or aggravation rather than to whether conduct is a breach of a rule in the first place, COCON 4.3.8G(6) includes such matters because one of the elements in judging whether conduct is serious enough to be a breach of COCON is whether the conduct is repeated or part of a pattern. 4.3.10 G Whether or not misconduct has been the subject of a formal complaint is not generally relevant to the seriousness of that conduct. The fact that it has been the subject of such a complaint may be relevant evidence, for instance in helping to show what the effect of the conduct was. 4.3.11 G As respects COCON 4.3.8G(8): (1) The mere fact that the person whose conduct is in question has, in accordance with the firm’s general policy, undertaken to comply with the firm’s staff handbook or other internal policies for staff and

FCA 2025/60 Page 26 of 47 the conduct in question breaches a requirement of such policies is unlikely to be of great significance. (2) The fact that, before the misconduct in question, the firm has warned the individual in question about conduct of that type or has required the individual to undertake not to repeat conduct of that type is likely to be significant. Effect of the conduct 4.3.12 G In deciding whether conduct has the effect in COCON 1.1.7FR(4)(a), it is necessary to take into account all the circumstances of the case. COCON 4.3.13G and COCON 4.3.14G cover 2 factors that are always relevant. 4.3.13 G One of those factors is the perception of the subject of the misconduct. The result of this subjective question is that if the subject of the conduct does not perceive their dignity to have been violated, or any of the other things referred to in COCON 1.1.7FR(4)(a) to have occurred, then the conduct should not be found to have had that effect. 4.3.14 G The second of the factors referred to in COCON 4.3.12G is whether it is reasonable for the conduct to have had the effect in COCON 1.1.7FR(4)(a). The result of this objective question is that if it was not reasonable for the conduct to be regarded as violating the dignity of the subject of the conduct or creating any of the other effects in COCON 1.1.7FR(4)(a), then it should not be found to have done so. Purpose of the conduct 4.3.15 G The purpose of conduct as well as its effect is relevant to whether it is of the type described in COCON 1.1.7FR(4)(a). COCON 1.1.7FR(4)(a) covers conduct whose purpose is to violate dignity or to cause any of the other effects described in that rule even if the conduct does not actually have that effect. For example, a person may breach COCON if they send a hostile and intimidatory communication that is intercepted by the employing firm before it is received by the person to whom it is sent. Subject of the misconduct 4.3.16 G (1) If behaviour has the effect described in COCON 1.1.7FR(4)(a) on an individual listed in COCON 1.1.7FR(3), it can still be a breach of COCON if it is targeted at someone else or it is not targeted at anyone. (2) Thus, a person’s conduct can breach COCON by reason of its effect on a witness to that conduct. (3) References in this section to the subject of conduct or misconduct and similar phrases should be interpreted accordingly. Single incident

FCA 2025/60 Page 27 of 47 4.3.17 G Conduct can come within COCON 1.1.7FR(4) whether it consists of a single incident, several incidents or a course of conduct. Physical acts 4.3.18 G Conduct within COCON 1.1.7FR(4) covers a wide range of behaviour. It is not limited to words, communications and gestures. For example, it can also cover physical violence. Individual Conduct Rule 1 4.3.19 G (1) Conduct only breaches Individual Conduct Rule 1 if it involves a lack of integrity. (2) A person does not show a lack of integrity merely because they act without due care. A lack of integrity involves an element of intention, recklessness or turning a blind eye (for example, being aware that something is likely but avoiding confirming it). 4.3.20 G While this section does not set out a complete explanation of what integrity means, one consequence of COCON 4.3.19G is that misconduct in relation to a fellow member of the workforce falls outside the scope of rule 1 if the conduct rules staff member: (1) thought that: (a) there was an appropriate reason for the conduct; and (b) the conduct and its intended effect were proportionate to the intended aim of the conduct; or (2) did not intend to have an effect on the subject of the misconduct of the kind described in COCON 1.1.7FR(4), did not know that they were doing so and was not reckless about the effect of their conduct. 4.3.21 G A belief of the kind referred to in COCON 4.3.20G(1) should be reasonable. An unreasonable belief that conduct is justified may itself show a lack of integrity. For example, the fact that the individual carrying out the conduct in question believes that sexual harassment is not blameworthy is not a reason for Individual Conduct Rule 1 not to apply. 4.3.22 G Conduct excluded from rule 1 under COCON 4.3.19G may fall under rule 2 instead. Individual Conduct Rule 2 4.3.23 G (1) Conduct only breaches Individual Conduct Rule 2 if it involves a lack of due skill, care and diligence. (2) For example, a conduct rules staff member carrying out conduct falling within COCON 1.1.7FR(4)(a) will not breach the rule if a

FCA 2025/60 Page 28 of 47 reasonable person with the skills that the conduct rules staff member carrying out the conduct has and ought to have: (a) would have thought that the conduct would not have the effects described in COCON 1.1.7FR(4) on the subject of the conduct; or (b) would have thought that the conduct was justified. Repeated conduct 4.3.24 G (1) A conduct rules staff member may in principle rely on COCON 4.3.23G on more than one occasion. (2) Nevertheless, repeated instances of the same misconduct could make it less likely that the conduct rules staff member did not know that it would have the effects described in COCON 1.1.7FR(4) (in the case of Individual Conduct Rule 1) or that it would be reasonable to believe that (Individual Conduct Rule 2). (3) If they have been warned about the behaviour or someone has complained to them about it, it is less likely that they could reasonably think that it is justified. Insert the following new annex, COCON 4 Annex 1, after the new COCON 4.3 (Specific guidance on harassment), as inserted by this instrument. The text is all new and is not underlined. 4 Annex 1 How COCON applies to harassment Section 1: Purpose of this Annex and introduction 4 Annex 1 1.1 G The purpose of this Annex is to describe how COCON applies to behaviour of the kind in COCON 4.3.1G in the form of flow diagrams. It does not cover when behaviour by a manager relating to such conduct may be a breach of COCON or the senior manager conduct rules in COCON 2.2. 4 Annex 1 1.2 G Such behaviour does not breach COCON unless all of the following conditions are met: (1) the person whose conduct is in question is of a kind to whom COCON applies (section 2 of COCON 4 Annex 1 deals with this); (2) the conduct is of a kind that comes within COCON (section 3 of COCON 4 Annex 1 deals with this); (3) the conduct is within the territorial scope of COCON (section 4 of COCON 4 Annex 1 deals with this); and

FCA 2025/60 Page 29 of 47 (4) the conduct is a breach of one of the rules in COCON 2.1 (Individual conduct rules) (section 5 of COCON 4 Annex 1 deals with this). 4 Annex 1 1.3 G In this Annex: (1) ‘P’ means the person whose conduct is in question; (2) ‘F’ means the firm P works for; and (3) ‘the harassment rule’ means COCON 1.1.7FR. 4 Annex 1 1.4 G This Annex deals with the 3 sets of rules in COCON 1.1 (Who?, What? and Where?) in the same order as COCON 1.1. However, a person wanting to see whether conduct is within the scope of COCON can apply them in any order. For example, if conduct takes place outside the UK, a person may wish to apply the territorial scope rules first. If the answer is that the conduct is outside the territorial scope of COCON, COCON does not apply and there is no need to look at any other part of COCON 1.1. 4 Annex 1 1.5 G This Annex is based on the flow diagrams in COCON 1 Annex 2 (How the application rules in COCON 1.1 (Application) work) with parts not relevant to the harassment rule removed and with more detail about harassment added. Section 2: Who does COCON apply to? 4 Annex 1 2.1 G This section deals with the types of people COCON applies to where the question is whether behaviour of the kind in COCON 4.3.1G comes within COCON. 4 Annex 1 2.2 G Flow diagram: Who COCON applies to

FCA 2025/60 Page 30 of 47 Section 3: What does COCON apply to? 4 Annex 1 3.1 G This section deals with what behaviour of the kind in COCON 4.3.1G comes within COCON. 4 Annex 1 3.2 G COCON 4 Annex 1 3.4G contains the first part of the flow diagram. If this part of the flow diagram says that COCON does not apply, that means that the conduct in question is not within the scope of COCON. There is no need to go further in the flow diagram. 4 Annex 1 3.3 G There is then a second flow diagram (COCON 4 Annex 1 3.7G), which applies when P works for any kind of SMCR firm except for an SMCR banking firm. 4 Annex 1 3.4 G Flow diagram: Conduct COCON applies to: Flow diagram applying to all firms

FCA 2025/60 Page 31 of 47 4 Annex 1 3.5 G COCON 1.3.2G to COCON 1.3.9G contain guidance on COCON 1.1.6R to COCON 1.1.7R as referred to in the flow diagram in COCON 4 Annex 1 3.4G. 4 Annex 1 3.6 G (1) As explained in COCON 4 Annex 1 1.1G, this Annex only covers misconduct in respect of a work colleague. (2) COCON 1.1.7FR(3) (To what conduct does it apply? (Other limitations: Non-banks: Harassment)) deals with that restriction in the case of an SMCR firm that is not an SMCR banking firm and that restriction is reflected in the flow diagrams in this Annex. (3) COCON 1.1.7FR(3) does not apply to an SMCR banking firm. In the case of an SMCR banking firm, the rules in COCON do not have a restriction based on whether conduct relates to a work colleague. Therefore, the flow diagrams in this Annex do not reflect the restriction of the scope of this Annex described in (1) in the case of an SMCR banking firm. 4 Annex 1 3.7 G Flow diagram: Conduct COCON applies to: Firms other than SMCR banking firms

FCA 2025/60 Page 32 of 47 4 Annex 1 3.8 G If the result of applying the flow diagram in COCON 4 Annex 1 3.7G is that reference is made to this paragraph, the conduct is not within the harassment rule. In turn, that normally means that the conduct is not a breach of COCON. 4 Annex 1 3.9 G However, the conduct can still be a breach of COCON in accordance with the flow diagram in COCON 4 Annex 1 3.10G. 4 Annex 1 3.10 G Flow diagram: Where the harassment rule does not apply

FCA 2025/60 Page 33 of 47 Section 4: Territorial scope of COCON 4 Annex 1 4.1 G This section deals with the territorial scope of COCON. 4 Annex 1 4.2 G Flow diagram: Territorial scope

FCA 2025/60 Page 34 of 47 Section 5: Final questions 4 Annex 1 5.1 G This section deals with the remaining questions to be asked when deciding whether behaviour of the kind in COCON 4.3.1G is a breach of COCON. 4 Annex 1 5.2 G Flow diagram: Remaining questions

FCA 2025/60 Page 35 of 47 4 Annex 1 5.3 G COCON 4.3.6G to COCON 4.3.18G deal with whether conduct is of the kind described in COCON 1.1.7FR(4)(a). 4 Annex 1 5.4 G COCON 4.3.17G to COCON 4.3.18G deal with aspects of whether conduct is of the kind described in COCON 1.1.7FR(4)(b). 4 Annex 1 5.5 G COCON 4.3.19G to COCON 4.3.24G deal with whether conduct otherwise comes within Individual Conduct Rule 1 or Individual Conduct Rule 2.

FCA 2025/60 Page 36 of 47 Annex C Amendments to the Fit and Proper test for Employees and Senior Personnel sourcebook (FIT) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 General … 1.3 Assessing fitness and propriety General matters [Editor’s note: the new subheading ‘General matters’ applies to FIT 1.3.1G to FIT 1.3.5G.] 1.3.1 G … … 1.3.3 G (1) An assessment of fitness and propriety should take into account all the factors of the particular case. It would be impossible to produce a definitive list of all the matters that would be relevant to a particular determination. The criteria in this section and in FIT 2.1 to FIT 2.3 are not intended to be a definitive list of matters to be considered. (2) The criteria listed in this section and in FIT 2.1 to FIT 2.3 are guidance and will be applied in general terms when the FCA is determining a person’s fitness and propriety. It would be impossible to produce a definitive list of all the matters which would be relevant to a particular determination. (3) A firm assessing the fitness and propriety of staff being assessed under FIT should be guided by substantially the same criteria as the ones in this section and in FIT 2.1 to FIT 2.3 (to the extent applicable to the firm), recognising that this is not intended to be a definitive list of matters to be considered. (4) A firm should carry out any assessment of fitness and propriety fairly and in accordance with privacy, employment and other relevant law. … 1.3.5 G … Breaches of requirements of the regulatory system 1.3.6 G (1) Breaches (or the risk of future breaches) of the requirements of the regulatory system are obviously relevant to fitness and propriety

FCA 2025/60 Page 37 of 47 under the regulatory system and thus to FIT because they are part of the regime under which fitness and propriety under FIT is assessed. (2) Such breaches will often take place in an individual’s work life but, as explained in FIT 1.3.11G, such conduct may also occur outside work. 1.3.7 G (1) Breaches of the regulatory system include: (a) breach of COCON or APER; (b) (where a firm is required to try to ensure that someone in the position of the member of the staff being assessed under FIT meets a particular standard) failure to meet that standard; and (c) involvement in a breach by the firm of the requirements of the regulatory system. (2) A requirement in (1)(b) might be one relating to the particular position the member of the staff being assessed under FIT holds. It may also be one covering a firm’s workforce generally or a certain section of it to which the member of the staff being assessed under FIT belongs, such as the competent employees rule. 1.3.8 G A breach of COCON or of other requirements of the regulatory system can be relevant to fitness and propriety under FIT 2.1 (Honesty, integrity and reputation) or FIT 2.2 (Competence and capability). 1.3.9 G (1) One of the purposes of the fitness and propriety requirement is to ensure that firms themselves meet the requirements of the regulatory system. Ensuring that its staff are fit and proper will help to ensure that the firm itself meets the threshold conditions and will comply with the standards of the regulatory system. (2) Thus, conduct by a member of a firm’s staff being assessed under FIT may show that member to be unfit if: (a) it results in the firm not meeting the standards in (1); or (b) it is a factor that points towards the firm not meeting those standards, even if the position of the member of the firm’s staff being assessed under FIT in the firm is not sufficiently significant for their misconduct to mean that the firm does not meet those standards. 1.3.10 G A breach of the requirements of the regulatory system does not automatically mean that a member of the staff being assessed under FIT is not fit and proper. An assessment should be made on a case-by-case basis. In the case of COCON, relevant factors include:

FCA 2025/60 Page 38 of 47 (1) the seriousness of the breach, taking into account matters such as the following (some of the other sub-paragraphs of this paragraph also contain factors relevant to seriousness): (a) whether the breach involved dishonesty, breach of trust or violence; (b) whether the individual knew that their conduct was a breach of COCON or their firm’s internal requirements but carried on the conduct anyway; (c) the vulnerability of those affected by the breach; (d) whether the breach was of Individual Conduct Rule 1 (You must act with integrity: see COCON 2.1.1R), although not every breach of that rule means that the individual is unfit; (e) the harm done; and (f) the factors in column (2) of row (A) of the table in SYSC 22.5.11G (Table: Examples of factors to take into account when deciding whether old misconduct is sufficiently serious to disclose); (2) how recent the breach was (the fact that the breach happened a long time ago may lessen the weight of that breach); (3) steps (including training) taken by the member of staff being assessed under FIT since the breach to address the behaviours involved in the breach or otherwise to address the causes of the misconduct; (4) (in the case of a breach caused by lack of competence) whether that lack has been remedied by subsequent training or experience; (5) other evidence of rehabilitation; (6) remorse and insight into the seriousness of the breach; (7) absence of the mitigating factors in (3) to (6); (8) the individual’s past disciplinary and performance record; (9) the individual’s record of breaching COCON or other requirements of the regulatory system; (10) the individual’s health, disability and life events which may have been a factor in the breach; (11) whether the breach was repeated or part of a pattern;

FCA 2025/60 Page 39 of 47 (12) the seniority of the individual (the fact that the individual held a senior position may make the breach more serious than it would be if they held a junior position); (13) the likelihood of recurrence of the relevant conduct – for instance, whether the conduct was a one-off lapse; and (14) the relevance of the breach to the role for which the member of staff being assessed under FIT is being assessed. 1.3.11 G Breaches of the requirements of the regulatory system are relevant to fitness and propriety even if they take place outside work. Thus, for example, it would be relevant to an individual’s fitness if they carried on a regulated activity outside work without being authorised as required. 1.3.12 G (1) The FCA’s statutory objectives are a key factor in deciding whether something is relevant to whether a person is fit and proper. Conduct that is inconsistent with the FCA’s statutory objectives is likely to show that the person concerned is not fit and proper. (2) Maintaining public confidence in the financial system and financial services industry in the United Kingdom is part of the FCA’s statutory objectives. Therefore, conduct of a type that is likely to damage such public confidence is likely to mean that the person concerned is not fit and proper. (3) However, the FCA accepts that it would be reasonable for a firm not to apply the factors in FIT 1.3.12G as a self-standing criterion when assessing fitness and that the FCA is in a better position to make judgements of this kind than a firm. 1.3.13 G (1) Misconduct may mean that a person is not fit and proper even if that misconduct does not have such great effects that it measurably prejudices the FCA’s statutory objectives by itself. (2) For example, fraud is inconsistent with the FCA’s statutory objectives and is likely to mean that the person committing it is not fit and proper even if it is small-scale. Conduct connected to work 1.3.14 G (1) Breaches of the law or of requirements not forming part of the regulatory system committed during the course of work carried out by a member of the staff being assessed under FIT for their firm or a previous employer may mean that the person concerned is not fit and proper. (2) Such requirements may include requirements of other regulatory authorities (including a previous regulator), clearing houses and exchanges, professional bodies, or government bodies or agencies.

FCA 2025/60 Page 40 of 47 Relevance of behaviour in private or personal life 1.3.15 G (1) COCON is limited to conduct related to a firm’s activities (see COCON 1.1.6R to COCON 1.1.7R) and sometimes only to a part of its activities (for example, see COCON 1.1.7AR). An assessment of fitness and propriety should not be limited in that way. (2) That means that conduct is potentially relevant to an assessment of fitness and propriety even though COCON 1.3 (Scope of COCON) says that it is generally outside the scope of COCON because: (a) it relates to the person’s private or personal life; or (b) it does not have a sufficient connection with SMCR financial activities or other activities of the firm in question. (3) For example, conduct described in the table in COCON 1.3.7G (Table: Private or personal life and COCON) as generally being outside the scope of COCON may be relevant to fitness and propriety. 1.3.16 G (1) Conduct that: (a) takes place in the private or personal life or other activities outside the regulatory system of a member of staff being assessed under FIT; and (b) shows that there is a material risk that the person will breach the standards and requirements of the regulatory system), may show that the member of the staff being assessed under FIT is not fit and proper. (2) Conduct that: (a) takes place in the private or personal life or other activities outside the regulatory system of a member of the staff being assessed under FIT; and (b) if repeated in the role for which they are being assessed, would breach the standards and requirements of the regulatory system, may show that they are not fit and proper if there is a material risk it will be repeated in that role. (3) Two examples are dishonesty and lack of integrity. Honesty and integrity are both key qualities that staff being assessed under FIT should have. Thus, conduct outside the regulatory system that is dishonest or shows a lack of integrity is always relevant to fitness and propriety under FIT. (4) Similarly, violence or sexual misconduct by a member of the staff being assessed under FIT in their private or personal life or in work

FCA 2025/60 Page 41 of 47 outside the regulatory system may show that there is a risk of similar misconduct in relation to: (a) customers or counterparties of their firm; or (b) people working for their firm, which, as explained in COCON 4.3 (Specific guidance on harassment), may be a breach of the rules in COCON. (5) Likewise, a breach of standards or requirements that are similar to ones applying under the regulatory system is relevant to fitness and propriety under FIT. (6) Conduct in an individual’s personal or private life may be relevant if it demonstrates a willingness to disregard ethical or legal obligations or to do the things in FIT 1.3.17G(1)(a)(ii) or FIT 1.3.17G(1)(a)(iii). (7) However: (a) it should not be assumed that simply because a member of the staff being assessed under FIT engages in conduct in their private life, there is a material risk that they will repeat such conduct in their regulated role; and (b) a remote or speculative risk that the member of the staff being assessed under FIT will breach the standards and requirements of the regulatory system is not sufficient for these purposes and instead it is a material risk that should be taken into account. (8) Even if a breach of a law or standards and requirements by a member of the staff being assessed under FIT would not otherwise be relevant to their fitness and propriety, repeated breaches may raise doubts as to whether they will follow the requirements of the regulatory system (see (6)). 1.3.17 G (1) Misconduct in a person’s private or personal life or in their working life outside the regulatory system may be relevant to their fitness and propriety even if there is little or no risk of it being repeated in their work for their firm. Conduct in an individual’s personal or private life may be relevant if: (a) it demonstrates a willingness to: (i) disregard ethical or legal obligations; (ii) abuse a position of trust; (iii) exploit the vulnerabilities of others; and/or (b) it is sufficiently serious such that, were the person permitted to work at a firm, it could undermine public confidence in the

FCA 2025/60 Page 42 of 47 regulatory system (or any part thereof) or otherwise impact the FCA’s statutory objectives. (2) A custodial sentence imposed by the court (even if suspended) is likely to mean that the matter is sufficiently serious, but this is subject to consideration of other relevant matters including how old the offence is and rehabilitation since the date of the offence. (3) The reason for (1) and (2) is that the person’s working in the role for which they are being assessed may damage public confidence in the financial system and financial services industry in the United Kingdom and consequently be inconsistent with the FCA’s statutory objectives. (4) One reason for the effect in (3) is that if the regulatory system allows persons to carry on working in those circumstances it would reflect negatively on the rigour and quality of the standards expected of those working in such positions and in turn on the quality of those who work in such positions. The regulatory standards that apply to a person working for one firm are likely to reflect on the regulatory standards applying generally. 1.3.18 G (1) In the FCA’s view, misconduct of the type in FIT 1.3.17G can mean that the person concerned is not fit and proper even if it cannot be shown that the misconduct will by itself cause direct and discernible damage to public confidence in the financial system and financial services industry in the United Kingdom or to confidence in their firm on the part of customers or those who deal with the firm. (2) As with other kinds of misconduct (see FIT 1.3.13G), it is sufficient if the misconduct is of a type that is inconsistent with the FCA’s statutory objectives. (3) In addition, the fact that a person only works for a small firm and that their misconduct does not significantly damage the confidence of the firm’s clients or those who deal with the firm or itself damage confidence in the financial services industry more generally does not prevent the reflection on the standards of the regulatory system described in FIT 1.3.17G(4). 1.3.19 G The factors in FIT 1.3.17G(1)(a) may in some cases be relevant to fitness and propriety because they show that there is a material risk that the member of the staff being assessed under FIT will repeat that conduct in a work context or otherwise breach the standards and requirements of the regulatory system. Relevance of behaviour in private or personal life: No duty to monitor 1.3.20 G (1) Generally, a firm need not monitor the private lives of its staff who are subject to the standards in FIT to see whether there is something that is relevant to fitness under FIT. A firm need only look into the private life of a member of the staff being assessed under FIT if there

FCA 2025/60 Page 43 of 47 is a good reason to – for instance, if the firm becomes aware of an allegation which, if true, would call into question their fitness under FIT, including having regard to FIT 1.3.17G(1). (2) This means, for example, that the FCA would not expect a firm to investigate allegations relating to a member of the staff being assessed under FIT’s private life if: (a) those allegations are trivial and therefore would not impact the member of the staff being assessed under FIT’s fitness and propriety under FIT; (b) those allegations, even if true, would not otherwise show a material risk that the person will breach the requirements and standards of the regulatory system (subject to FIT 1.3.17G); or (c) the firm reasonably considers the allegation to be implausible. (3) Even if a firm is aware of an allegation against a member of the staff being assessed under FIT relating to their private life, the firm may have a limited ability to investigate. In any case, it is likely that it will be more appropriate for the relevant law enforcement or other authorities to investigate. These points may mean that it will not be appropriate for the firm to investigate (subject to (5)). (4) Therefore, the FCA accepts that it is likely that a firm will often rely on: (a) matters of the kind described in FIT 2.1.3G (Honesty, integrity and reputation) or FIT 2.2.1G(4) (Competence and capability); (b) criminal convictions; or (c) the findings of a court, tribunal, regulator, arbitrator, public enquiry or other body whose responsibility it is to make findings of the relevant kind, in deciding whether or not a member of the staff being assessed under FIT has carried out wrongdoing in their private life of a kind that is relevant to fitness and propriety. (5) Nevertheless, a firm should consider what steps it can reasonably take to investigate and assess the possible impact on the fitness and propriety of a member of the staff being assessed under FIT of a matter in (1). For example, the firm should, where appropriate, ask for an explanation from the member of the staff being assessed under FIT concerned. (6) The FCA will not necessarily limit its assessments of fitness and propriety in the way described in (4).

FCA 2025/60 Page 44 of 47 (7) Firms are reminded of their obligations under SUP 10C.14.18R (Notifications about fitness, disciplinary action and breaches of COCON). (8) In accordance with FIT 1.3.3G(4) (General matters), a firm should carry out any investigation that it does undertake fairly and in accordance with privacy, employment and other relevant law. Relevance of behaviour in private or personal life: Social media 1.3.21 G (1) FIT 1.3.21G deals with the use of social media (including a messaging app) by a member of the staff being assessed under FIT in their private or personal life. (2) The factors in this section and the rest of FIT apply to establishing when social media activity is relevant to fitness and propriety under FIT in the same way as they do to establishing the relevance of other kinds of conduct. (3) Thus, for example, if a person’s social media activity in their private life indicates a material risk that the person will breach the requirements and standards of the regulatory system, FIT 1.3.16G explains that such activity will be relevant to their fitness and propriety. Examples could include threats of violence or clear involvement in criminal activities or conduct that shows a material risk of misconduct that would breach COCON of the kind in COCON 4.3 (Specific guidance on harassment). (4) If, on the other hand, a person’s social media activity in their private life does not indicate a material risk that the person will breach the requirements and standards of the regulatory system, FIT 1.3.16G means that (subject to FIT 1.3.17G) the social media activity is unlikely to be relevant to their fitness and propriety and so nothing in FIT requires a firm to concern itself with it. (5) Subject to the other points in FIT 1.3.21G and the rest of FIT 1.3, a person can lawfully express their views on social media even if they are controversial, without calling into question their fitness under FIT, and even if colleagues at work disagree with or are upset by those views. (6) FIT 1.3.20G means that a firm generally need not monitor the social media activity in their private lives of its staff who are subject to the standards in FIT. Offences 1.3.22 G When taking into account offences, the FCA will give (and a firm should give) particular consideration to offences of dishonesty, fraud, financial crime or an offence under legislation relating to companies, building societies, industrial and provident societies, credit unions, friendly societies, banking, other

FCA 2025/60 Page 45 of 47 financial services, insolvency, consumer credit companies, insurance, consumer protection, money laundering, market manipulation and insider dealing, offences of violence, sexual offences and offences related to a person’s or a group’s demographic characteristics such as racially motivated or aggravated offences, whether or not committed in the United Kingdom. 1.3.23 G The FCA will (and a firm should) take account of the effect of a conviction for a criminal offence on a person’s fitness on a case-by-case basis, taking into account the seriousness of, and circumstances surrounding, the offence, the explanation offered by the convicted person, the relevance of the offence to the role, the passage of time since the offence was committed and evidence of the individual’s rehabilitation. 1.3.24 G Offences in FIT 1.3.22G are not just relevant if committed in a work context. As described in this section (particularly FIT 1.3.16G to FIT 1.3.18G), conduct in the private or personal life or in the working life outside the regulatory system of a member of the staff being assessed under FIT may be relevant to their fitness and propriety. 2 Main assessment criteria 2.1 Honesty, integrity and reputation 2.1.1 G In determining a person’s honesty, integrity and reputation, the FCA will have regard to all relevant matters including, but not limited to, those set out in FIT 2.1.3G which may have arisen either in the United Kingdom or elsewhere. The FCA should be informed of these matters (see SUP 10A.14.17R and SUP 10C.14.18R), but will consider the circumstances only where relevant to the requirements and standards of the regulatory system. For example, under FIT 2.1.3G(1), conviction for a criminal offence will not automatically mean an application will be rejected. The FCA treats each candidate’s application on a case-by-case basis, taking into account the seriousness of, and circumstances surrounding, the offence, the explanation offered by the convicted person, the relevance of the offence to the proposed role, the passage of time since the offence was committed and evidence of the individual’s rehabilitation matters referred to in FIT 1.3.23G. 2.1.1A G A firm determining the honesty, integrity and reputation of staff being assessed under FIT, should consider all relevant matters, including those set out in FIT 2.1.3G, which may have arisen either in the United Kingdom or elsewhere. Firms should inform themselves of relevant matters, including checking for convictions for criminal offences (where possible) and contacting previous employers who have employed that candidate or person. If any staff being assessed under FIT has a conviction for a criminal offence, the firm should consider the seriousness of and circumstances surrounding the offence, the explanation offered by that person, the relevance of the offence to the proposed role, the passage of time since the offence was committed and evidence of the individual’s rehabilitation matters referred to in FIT 1.3.23G. …

FCA 2025/60 Page 46 of 47 2.1.3 G The matters referred to in FIT 2.1.1G to which the FCA will have regard, and to which a firm should also have regard, include, but are not limited to: (1) whether the person has been convicted of any criminal offence; this must include, where provided for by the Rehabilitation Exceptions Orders to the Rehabilitation of Offenders Act 1974 or the Rehabilitation of Offenders (Northern Ireland) Order 1978 (as applicable), any spent convictions; particular consideration will be given to offences of dishonesty, fraud, financial crime or an offence under legislation relating to companies, building societies, industrial and provident societies, credit unions, friendly societies, banking, other financial services, insolvency, consumer credit companies, insurance, consumer protection, money laundering, market manipulation and insider dealing, whether or not in the United Kingdom described in FIT 1.3.22G; … (3) whether the person has been the subject of, or interviewed in the course of, any existing or previous investigation (particularly into a matter of the kind referred to in FIT 1.3.22G) or disciplinary proceedings, by the appropriate regulator, by other regulatory authorities (including a previous regulator), clearing houses and exchanges, professional bodies, or government bodies or agencies; (4) whether the person is or has been the subject of any proceedings of a disciplinary or criminal nature (particularly of the kind referred to in FIT 1.3.22G) or of a disciplinary nature, or has been notified of any potential such proceedings or of any investigation which might lead to those proceedings; … (11) whether the person has been dismissed, or asked to resign and resigned, from employment or from a position of trust, fiduciary appointment or similar; (11A) whether the person has been asked to resign and resigned, from employment or from a position in (11). Whether the FCA considers (or a firm should consider) a resignation to be relevant will depend on the circumstances – for example, if a person is asked to resign in circumstances that cast doubt over their honesty or integrity; … (13) whether, in the past, the person has been candid and truthful in all their dealings with any regulatory body and whether the person demonstrates a readiness and willingness to comply with the requirements and standards of the regulatory system and with other legal, regulatory and professional requirements and standards.;

FCA 2025/60 Page 47 of 47 (14) whether the person has been found by a tribunal or court to have been engaged in harassment, victimisation or discrimination; and (15) whether the person has been found to have carried out harassment, bullying, victimisation or discrimination following an internal disciplinary process. 2.2 Competence and capability 2.2.1 G In determining a person’s competence and capability, the FCA, in accordance with FIT 1.1.2G, will have regard to all relevant matters including but not limited to: … (3) whether the person has adequate time to perform the controlled function and meet the responsibilities associated with that function.; and (4) any of the matters in FIT 2.1.3G (Honesty, integrity and reputation) so far as relevant to competence and capability, such as a finding by a court, disciplinary hearing or enquiry that the person has been negligent or demonstrated lack of skill in a relevant respect. 2.2.1A G In determining a person’s the competence and capability to perform an FCA designated senior management function or an FCA certification function of staff being assessed under FIT, a firm, in accordance with FIT 1.1.2G, should have regard to all relevant matters including but not limited to: … (3) whether the person has adequate time to perform the function in question and meet the responsibilities associated with that function.; and (4) the matters in FIT 2.2.1G(4). …

© Financial Conduct Authority 2025 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 2-008536 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts