On 1 September 2026, the FCA’s new regime for non-financial misconduct comes into force.

Few sensible people will object to the proposition that serious bullying, harassment or violence has no place in a financial services business. Firms should protect their employees, deal properly with complaints and take appropriate action against individuals guilty of serious misconduct.

But that is not really where the controversy lies.

The more difficult question is whether the Financial Conduct Authority – a regulator established to regulate financial services – should increasingly concern itself with the wider character, behaviour and private lives of the people working within the industry.

There is a danger that the FCA is moving from being a financial regulator to becoming something altogether different: a regulator of personal morality.

What is changing?

From 1 September 2026, the FCA’s Conduct Rules will expressly capture certain serious non-financial misconduct in non-bank firms.

The FCA describes non-financial misconduct as behaviour which is not clearly financial in nature, including bullying, harassment and violence.

The new COCON rule is intended to bring serious work-related misconduct more clearly within the regulatory regime.

On one level, that is understandable. If a senior manager systematically bullies junior employees or sexually harasses colleagues, it is perfectly legitimate to ask whether that behaviour says something about the person’s integrity and suitability to hold a position of responsibility.

The difficulty is that the regulatory implications do not stop at the office door.

When the regulator follows you home

The most controversial aspect of the FCA’s approach concerns fitness and propriety.

The FCA makes an important distinction between COCON and FIT. The Conduct Rules generally require a sufficient connection with work. Fitness and propriety assessments are considerably wider.

The FCA’s guidance expressly provides that misconduct in someone’s private or personal life may be relevant to whether they are fit and proper.

Private behaviour can potentially become relevant where, for example, it demonstrates a willingness to disregard ethical or legal obligations, abuse a position of trust or exploit the vulnerabilities of others.

More strikingly, private misconduct may also be relevant where it is sufficiently serious that allowing the individual to continue working in financial services could undermine public confidence in the regulatory system.

That represents a significant regulatory proposition.

We are no longer simply asking: “Can this individual competently and honestly perform their regulated role?”

We are potentially asking: “Is this the sort of person whom the FCA considers suitable to be associated with the financial services industry?”

Those are very different questions.

Who appointed the FCA as judge of character?

There is an obvious case for taking account of dishonesty.

Someone convicted of fraud outside work plainly raises legitimate questions about whether they should be trusted with clients’ money.

Likewise, serious violence or sexual offending may quite reasonably raise fitness and propriety issues.

But once the principle is established that private conduct can determine someone’s professional livelihood because of what that behaviour supposedly says about their character, drawing the boundary becomes much more difficult.

Regulators are then inevitably required to make moral judgments.

How serious was the behaviour? How long ago did it happen? Was it an isolated incident? Has the individual changed? What does it reveal about their character? Would the public disapprove? Could allowing them to remain in financial services undermine confidence in the industry?

These are extraordinarily subjective questions for a financial regulator to answer.

The FCA itself acknowledges that firms should not necessarily make public-confidence judgments as a standalone fitness criterion and says that the FCA is better placed to make judgments of that kind.

That may provide some reassurance to firms. It also illustrates the problem.

The FCA is effectively asserting that it is institutionally better placed to determine when someone’s personal behaviour is sufficiently objectionable that their continued participation in financial services damages the reputation of the regulatory system.

That is a substantial expansion of regulatory judgment.

The problem of the perfect employee

Financial regulation already imposes extensive obligations concerning competence, honesty, integrity, financial soundness and regulatory compliance.

The more broadly ‘fitness and propriety’ is interpreted, however, the greater the risk that regulated individuals are expected to satisfy a standard of personal behaviour that would never be imposed on people working in most other industries.

Why should an accountant, mortgage adviser or financial planner potentially face career-ending regulatory consequences for private misconduct when someone carrying out an identical job outside the FCA perimeter might simply face the ordinary consequences of employment law or the criminal law?

Regulated status should carry responsibilities. It should not require sainthood.

People make mistakes. They have arguments. Relationships break down. Allegations are made. People behave badly at times. Social-media posts written years earlier can resurface.

There must be a meaningful distinction between conduct demonstrating that somebody cannot safely or honestly perform a regulated financial role and conduct which merely demonstrates that the individual is imperfect.

Allegations are not findings

There is also a practical problem for firms.

Employers may receive allegations about employees’ conduct outside work. Those allegations can be disputed, exaggerated or malicious.

The FCA has sensibly attempted to address this. Its guidance says firms are not expected to monitor employees’ private lives or social-media accounts, nor investigate private-life allegations that are trivial, implausible or irrelevant.

That limitation is welcome. But firms still have to exercise judgment when something potentially serious comes to their attention.

The compliance department of a financial adviser could therefore find itself considering allegations concerning an employee’s behaviour at a Christmas party, in a relationship, on social media or in some other aspect of their life far removed from advising clients.

Compliance officers are not police officers. They are not judges.

Nor should regulated firms become miniature courts tasked with determining every disputed allegation about an employee’s personal behaviour.

Yet the consequences of getting the decision wrong can be significant.

Regulatory references make the stakes higher

The implications can extend beyond the employee’s current job.

Non-financial misconduct may affect fitness and propriety assessments, Conduct Rule reporting and regulatory references.

That means a decision made by one employer may potentially follow an individual through their career.

There is an entirely legitimate regulatory objective behind this. The FCA understandably wants to prevent serious offenders simply moving from firm to firm.

But there is a corresponding danger.

A regulatory system designed to prevent “rolling bad apples” must not create rolling allegations.

Once damaging information enters the regulatory ecosystem, individuals may find it extremely difficult to escape its consequences even where allegations were disputed or never established to a criminal standard.

Fair process therefore matters enormously.

What exactly is the FCA protecting?

The FCA’s justification ultimately comes back to confidence in financial services.

There is force in that argument. Public confidence plainly matters.

But “public confidence” can also become an extremely elastic concept.

Almost any sufficiently unattractive behaviour by somebody working in financial services could theoretically be said to reflect badly upon the industry.

Taken too far, that reasoning gives a regulator an almost unlimited mandate.

The proper question should therefore be whether there is a genuine regulatory nexus between the behaviour and the individual’s suitability to perform the regulated role.

Dishonesty plainly has one. Abuse of clients plainly has one. Misuse of confidential information plainly has one. Serious abuse of power within a regulated business may have one.

But the further the FCA travels into purely private conduct, the stronger the justification for regulatory intervention ought to become.

A chilling effect

There is also a wider cultural issue.

Financial services employs hundreds of thousands of people with different political views, religions, lifestyles, senses of humour and attitudes.

Regulation should not create an atmosphere in which employees believe their regulator is indirectly policing lawful private behaviour.

Nor should firms feel obliged to monitor social media or investigate gossip simply because they fear criticism from the FCA if an allegation subsequently becomes public.

The FCA expressly says firms do not need to monitor employees’ private lives or social-media accounts.

Firms should take the regulator at its word.

The worst possible outcome would be an unofficial compliance culture considerably more intrusive than the rules themselves require.

Serious misconduct deserves serious consequences

None of this amounts to defending bullying, harassment or violence.

Serious misconduct should have consequences.

The question is who should impose them and why.

Criminal behaviour belongs primarily within the criminal justice system.

Workplace harassment belongs within employment law and proper HR procedures.

Professional misconduct belongs within professional disciplinary regimes.

Financial misconduct belongs squarely within FCA regulation.

There will inevitably be overlap between those categories.

But regulatory convenience should not be allowed to erase the boundaries altogether.

The FCA should regulate finance, not virtue

There is a legitimate core to the FCA’s reforms.

Nobody wants genuinely dangerous, dishonest or abusive individuals moving freely around financial services simply because their misconduct was technically ‘non-financial’.

But there is an equally legitimate concern about regulatory mission creep.

The FCA possesses enormous power over the livelihoods of individuals working in regulated financial services. A finding that somebody lacks fitness and propriety can effectively destroy a career.

Such power should be exercised cautiously.

The test should not become whether somebody is a good person according to the prevailing standards of the regulator.

It should remain whether there is reliable evidence demonstrating that the individual’s behaviour is sufficiently relevant and sufficiently serious to make them unsuitable to perform a regulated financial role.

That distinction matters.

Because once a financial regulator starts judging not merely what people do professionally, but who they are personally, the question is no longer simply whether standards in financial services are being raised.

It is whether the regulator has forgotten where regulation should end.