The Quiet Revolution in “People Risk”
Why the FCA’s non-financial misconduct changes will reshape ongoing screening and Enhanced Due Diligence
An interest piece for compliance, HR, and risk leaders
For years, many firms treated bullying, harassment, and other workplace Non-Financial Misconduct (NFM) as serious yet fundamentally HR-owned. The FCA’s Policy Statement PS25/23 signals that era is ending: serious workplace NFM is being anchored more explicitly into the Conduct Rules (COCON) and the fit and proper framework (FIT).
The practical impact is immediate for “people risk” controls: firms will need stronger, more defensible approaches to ongoing assurance, trigger-based re-screening, and Enhanced Due Diligence (EDD) especially for managers, SMFs and certification populations.
What’s changing (and what isn’t)
1) Scope expands for non-banks: work-related NFM toward colleagues will be within COCON scope if either the person responsible or the subject of the misconduct works in the financial services part of the business.
2) The implementation date is fixed: the new rule and associated COCON and FIT guidance come into force on 1 September 2026
3) Private life remains outside COCON’s statutory scope, so the FCA is not turning conduct rules into a “life-policing” regime. But private life conduct can still be relevant to FIT where it indicates a material risk (not remote or speculative) of future regulatory breaches, or where conduct is sufficiently serious that it could undermine public confidence.
The big operational shift: from periodic checks to event-driven assurance
A common (and costly) mistake is to hear “new conduct focus” and respond by simply adding more screening. PS25/23 points to something more precise: avoid indiscriminate monitoring; instead, build an allegation-led triage capability that triggers proportionate investigation and EDD when risk crystallises.
In practice, that means designing your control environment around three questions:
- Do we have clear triggers that initiate ‘out-of-cycle’ re-screening or EDD escalation?
- Do we assess seriousness and materiality consistently (and record why we decided what we decided)?
- Do HR outcomes, conduct rule outcomes, certification decisions, and references reconcile cleanly?
What “good” looks like under PS25/23
A seriousness decision checklist (because “NFM” is broad)
The FCA is candid that NFM covers a wide range of behaviour and guidance can’t be exhaustive; firms must apply judgement case by case. But the new rule is framed around serious misconduct (broadly bullying, harassment and violence) and uses a purpose-or-effect concept aligned to workplace harassment framing (violating dignity; intimidating, hostile, degrading, humiliating or offensive environments).
Managers as control owners (not just individuals)
One of the most operationally significant aspects is the FCA’s focus on managers’ “reasonable steps”. The guidance highlights the role managers play in fostering healthy cultures and gives examples of actions managers might take while also setting boundaries (no expectation to prevent misconduct they could not reasonably have known about, and limits where they lacked authority to act).
Social media: no duty to monitor, but triage matters
The FCA’s position on social media is clearer than many expect. Firms generally need not monitor staff private lives to identify FIT issues, and they are not required to investigate private-life social media allegations that are trivial, implausible, non-material or irrelevant to fitness. However, private-life social media activity can be relevant to fitness if it indicates a material risk of regulatory breaches, for example, threats of violence, clear criminal involvement, or conduct that shows a material risk of bullying or harassment at work.
Mobility and references: what follows the person
The FCA explicitly links this work to improving standards of behaviour through regulatory references, so serious NFM is appropriately disclosed when individuals move firms. If your processes still create a gap between HR outcomes and what flows into certification decisions and references, that gap will become harder to justify.
A pragmatic blueprint for 2026 readiness
If you want a programme you can defend in front of regulators (and in front of staff), build four capabilities:
- A trigger framework for re-screening/EDD escalation (grievances upheld, disciplinary findings, whistleblowing, credible adverse media, tribunal/court proceedings, etc.).
- A seriousness and materiality model (workplace NFM plus a clear gateway for private-life matters under FIT).
- Role-based depth (SMFs, Certification Functions, and people managers receive deeper governance and scrutiny).
- Documentation discipline (evidence relied on; fairness steps; proportionality rationale; and an audit trail linking HR outcomes to COCON/FIT outcomes and references).
How Garancie can support firms
Garancie helps regulated firms operationalise PS25/23 without turning compliance into surveillance. We focus on proportionate, allegation-led assurance that stands up to scrutiny. For example, offering targeted OSINT and adverse media support: focused, evidential research in support of internal investigations and certification decisions, not always-on monitoring.
If you’re planning a 2026 uplift, the fastest way to start is a short gap assessment: what you do today, what PS25/23 expects, and what a proportionate implementation looks like for your size and risk profile.
About Garancie
Garancie Limited specialises in online due diligence and investigative research, supporting property owners, legal firms, and financial institutions to verify the integrity and legitimacy of individuals and businesses. Our analysts combine open-source intelligence, public-record research, and structured risk assessment to identify red flags before they become liabilities.
Contact us to learn how Garancie can help you implement robust tenant-screening and property-risk monitoring across your portfolio.
🌐 https://garancie.com
#DueDiligence #AML #PropertyRisk #EnhancedDueDiligence #Garancie #OSINT #Compliance #ReputationManagement
