New UK conduct rules targeting non-financial misconduct (NFM) across financial services firms — including insurers, brokers and mutuals — took effect on New rules and guidance to help tackle NFM came into effect on 1 September 2026. The Financial Conduct Authority (FCA) rule, COCON 1.1.7FR, sits alongside expanded guidance on the Fit and Proper test (FIT), published under PS25/23. Together, the changes reset how insurance firms must document and act on workplace conduct concerns that fall outside classic financial wrongdoing.
What COCON 1.1.7FR actually changes
The rule change is narrow but consequential. Non-financial misconduct includes behaviour that is not of a clearly financial nature such as bullying, harassment and violence. Where NFM is serious and goes unchecked, it can harm individuals, firms and confidence in financial services. To address that risk, A new rule, COCON 1.1.7FR, extends the scope of the conduct rules in non-banking firms to cover bullying, harassment or violence against colleagues, where it relates to an individual’s role.
Crucially, the regulator has drawn firm boundaries around how far the rule reaches. The new rule applies where there is a sufficient work-related link. It does not apply retrospectively or extend our regulatory remit beyond Senior Managers and Certification Regime (SM&CR) financial activities. For insurers already managing SM&CR accountability maps, that means the new conduct-rule exposure attaches to the same population of certified staff and senior managers, not a wider workforce overnight. Group risk and compliance committees will still want a paper trail showing how the work-related link was assessed in each case, since the boundary is a judgement call rather than a bright line.
Why the FIT test matters separately
COCON is not the only lever the regulator is pulling. FIT allows firms to consider any relevant misconduct, wherever it occurs, when assessing fitness and propriety. The FCA has been explicit that the two regimes should not be conflated. COCON and FIT operate separately. The new COCON rule focuses on certain work-related misconduct, while the new FIT guidance clarifies how firms can take a broader range of NFM into account when assessing fitness and propriety.
For compliance teams, that distinction matters in practice: a conduct-rule breach report and a fitness-and-propriety judgement can now proceed on different evidentiary tracks, even when both stem from the same underlying incident. Underwriting and claims functions that rely on approved-persons registrations should expect the two assessments to be logged, and defended, separately. In practical terms, a single complaint about a manager could now generate two distinct regulatory files: one testing whether a conduct rule was breached, and another testing whether the individual remains fit to hold their approved role.
What the new guidance tells firms to do — and not do
We have published new Handbook guidance ( PS25/23 ) to help firms apply COCON and FIT with clarity and confidence, reducing the need for external advice. The scope is broad: The guidance, which was strongly supported by respondents to our consultation, covers: The boundary between work and private life. How NFM can breach the conduct rules. Reasonable steps for managers. Fitness and propriety assessments, including private life, social media and unproven allegations.
On the obligations side, the regulator expects firms to have already acted. Firms should have considered whether they needed to update their approach to: Staff policies. Conduct breach reporting. Fit and proper assessments. Regulatory references. Firms should also ensure staff and managers understand how the changes apply to them.
The guidance also sets limits on what firms are expected to do proactively. It does not require them to Carry out retrospective analysis to check whether they correctly determined past conduct rule breaches. Revise past fitness and propriety assessments. Monitor employees’ private lives or social media accounts. Investigate allegations about employees’ private lives if they are trivial, implausible or irrelevant. That carve-out is likely to reassure HR and legal functions that feared an open-ended monitoring mandate.
The road from CP25/18 to PS25/23
The September rules did not appear overnight. In July 2025, we published CP25/18 (PDF) on tackling NFM in financial services, which changed our rules to better capture NFM in non-banks and consulted on whether extra Handbook guidance was needed. The guidance will come into force on 1 September 2026 at the same time as the new rule at COCON 1.1.7FR. The regulator’s own guidance page tracks that timeline: First published: 23/03/2026 Last updated: 01/09/2026, from initial drafting through to the live rule. For firms that responded to the consultation, the interval between those milestones was the window to build the internal processes now expected to be operating in practice.
What this means for insurers, brokers and mutuals
For UK insurers, brokers and mutuals, the immediate task is procedural rather than headline-grabbing. Compliance and HR functions need whistleblowing and grievance channels, SM&CR fit-and-proper files, and regulatory reference templates that visibly reflect the COCON/FIT split described above — not a single merged conduct file. The distinction the FCA draws between a narrow conduct rule and a broader propriety test echoes recent enforcement themes, including the regulator’s growing scrutiny of internal culture signals raised through leadership channels. It also lands in a supervisory environment where the PRA has shown it will penalise process and reporting failures even without fraud, as seen in a recent PRA enforcement action over data-reporting failures. Firms rolling out new NFM procedures this quarter would do well to align them with the same governance rigour behind the PRA’s parallel push to streamline branch reporting obligations, since overlapping FCA and PRA expectations increasingly converge on the same accountability records.
