This Autumn brings two significant developments:
- From 1 September 2026, new FCA rules bring serious non-financial misconduct (including harassment and bullying) more squarely within the regulatory framework for non-bank firms.
- From 30 October 2026, the duty to prevent sexual harassment is strengthened, and employers can also be liable for harassment by third parties such as customers, clients and contractors.
Taken together, these changes signal a clear shift towards greater accountability for workplace culture.
Non-financial misconduct becomes a regulatory issue
Historically, serious bullying or harassment might have resulted in a disciplinary process but would not necessarily have engaged the FCA conduct rules. From 1 September 2026, that is changing for many regulated firms. Serious work-related bullying, harassment and violence may now amount to a breach of the FCA’s Code of Conduct.
COCON describes harassment as:
“unwanted conduct that has the purpose or effect of violating an individual’s dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment.”
Unlike Equality Act harassment, the conduct does not need to be linked to a protected characteristic. Equally, however, an act of unlawful harassment under the Equality Act will not automatically amount to a breach of COCON.
Examples likely to be caught include serious, systemic bullying, repeated humiliation of a colleague, or a pattern of degrading treatment — as opposed to a single lapse in judgment that is quickly addressed.
To determine whether is a breach of COCON, firms need to work through a number of separate questions:
- Is the conduct sufficiently work-related to engage COCON at all?
- Is it sufficiently serious to justify regulatory concern, rather than being solely an HR matter?
- Does it amount to a breach of a conduct rule and, if so, which one and why?
For HR and compliance teams, the challenge will be ensuring investigations are designed to answer both employment law and regulatory questions, where appropriate.
Ultimately, whether a notification to the FCA is required will depend on the firm’s assessment of the conduct and the disciplinary outcome.
Managers may themselves face scrutiny where concerns have been raised but not appropriately addressed, with the focus on what they knew, what authority they had, and whether their response was reasonable. Managerial accountability is not limited to responding once a complaint is made; managers may also be expected to act on warning signs. Firms should be able to evidence not only their policies, but how concerns were escalated, investigated and acted upon.
The FCA has stressed that the new rules should not turn every workplace dispute into a regulatory matter, and that private life conduct generally falls outside the conduct rules, though it may still be relevant to fitness and propriety. Nor do the changes automatically apply across an entire organisation simply because part of the business is regulated: in mixed businesses, firms must consider whether the conduct has a sufficient connection to the regulated activities. Misconduct in a wholly separate, non-regulated part of the business may remain outside COCON, even where it engages employment law.
Equality Act harassment – a higher bar for employers
From 30 October 2026, employers will be under a duty to take “all reasonable steps” to prevent sexual harassment.
This is a significant change from the current requirement to take “reasonable steps”. Employers will also face a new obligation regarding harassment by third parties, meaning organisations must think beyond risks from their own workforce.
The move to an “all reasonable steps” standard did not arrive without controversy. During the legislation’s passage, businesses and industry groups warned that stronger duties, particularly on third-party harassment, could place an unrealistic burden on employers and create uncertainty around workplace conversations and free expression. Earlier versions of the proposals were diluted following those concerns, so the decision to reintroduce a stronger preventative duty and third-party liability is significant.
What should employers be doing now?
Although further guidance is expected, organisations should not wait for a definitive checklist.
Practical steps are likely to include:
- reviewing anti-harassment policies;
- carrying out or refreshing workplace risk assessments;
- considering risks arising from customer and client interactions;
- delivering regular training for managers and employees;
- reviewing reporting and investigation procedures; and
- ensuring complaints are properly documented and monitored.
In practice, tribunals are likely to look closely at what employers actually did to identify and address foreseeable risks, rather than simply whether they had policies in place.
For FCA-regulated firms, there is an additional need to ensure HR, Legal and Compliance teams are aligned on when a workplace complaint may also raise regulatory issues.
The bigger picture
What links these developments is a growing expectation that organisations take responsibility for workplace culture. The focus is no longer just how employers respond after a complaint: regulators, tribunals and employees increasingly expect businesses to identify risks, intervene early, and show they have taken proactive steps to protect staff.