Why the FCA is Targeting Non-Financial Misconduct in 2026 Regulatory Audits

FCA enforcement actions increased by 24% in recent reporting periods, but the regulator is no longer just looking at spreadsheets and financial returns. In 2026, the supervisory lens has shifted aggressively toward auditing internal culture, SM&CR adherence, and non-financial misconduct. For a Head of Compliance & Risk at a mid-sized firm, the challenge is no longer just proving that the books balance, but proving that the human elements of the business are not creating systemic risks that lead to consumer harm.

The Shift from Financial Metrics to Cultural Health

The Financial Conduct Authority (FCA) has made its position clear: non-financial misconduct is a leading indicator of broader regulatory failure. Behaviour such as bullying, harassment, and violence is no longer treated as a peripheral HR issue. Under the new COCON 1.1.7FR rule, the scope of conduct rules for non-bank firms has been extended to cover these behaviours whenever there is a sufficient work-related link. This change, taking full effect on 1 September 2026, means that toxic workplace environments are now viewed as high-risk environments for regulatory breaches.

Firms that tolerate objectionable staff behaviour are more likely to mistreat customers or mismanage risk. The regulator views workplace culture not as a nebulous concept, but as the engine room of decision-making. If the engine is corroded by unchecked internal resistance to compliance or a culture of silence, the output will inevitably be a failure to deliver good outcomes for consumers. The FCA now requires firms to treat non-financial misconduct with the same gravity as fraud or market abuse. This is because a firm that fails to protect its own staff from harassment is unlikely to possess the governance necessary to protect its clients from financial harm.

The Senior Managers and Certification Regime (SM&CR) acts as the primary tool for this enforcement. Senior managers are increasingly being held accountable for the "psychological safety" and cultural integrity of their departments. A compliance blind spot regarding staff behaviour is no longer an excuse; it is a failure of oversight. The FCA has explicitly stated that misconduct inside or outside of work can imply an individual is no longer "fit and proper" to hold a certified role, especially where that conduct shows a disregard for ethical obligations.

Where Mid-Sized Firms Fail the Culture Test

Mid-sized firms frequently fall into the trap of "tick-box" compliance. In a recent FCA review of 270 principal firms, the results were sobering. Only 52% of self-assessments were deemed to be of good quality. The majority of firms relied on superficial, high-level statements about their culture without providing the granular data needed to back up those claims. This gap between what a firm says about its culture and what is actually happening on the ground is where regulatory intervention begins.

The same review found that just 43% of annual reviews met the regulator's quality expectations. Many firms lacked a clear audit trail and could not evidence how they were assessing the fitness and propriety of their staff on an ongoing basis. This has led to the FCA ordering the termination of over 1,300 relationships where oversight was found to be inadequate. For a Head of Compliance, this demonstrates that the regulator is looking for evidence of active, intrusive supervision, not just a signed policy document stored in a digital folder.

Internal resistance remains one of the most significant hurdles for mid-sized firms. When the compliance team is viewed as a "blocker" rather than a partner, staff often find workarounds to maintain speed at the expense of safety. This friction is a cultural red flag for the FCA. If employees are bypassing controls to meet commercial targets, it signals that the firm’s governance has been overridden by its sales culture. Without documented evidence of how these conflicts are managed, firms remain highly vulnerable during a supervisory visit.

The Hidden and Hard Costs of Weak Governance

The financial impact of poor culture is often underestimated until an enforcement action occurs. Beyond the immediate threat of FCA fines, which can be catastrophic for a mid-sized firm, there are the operational costs of a broken governance framework. High staff turnover is a direct byproduct of toxic cultures, and in the specialized world of financial services, replacing a certified individual can cost tens of thousands of pounds in recruitment and lost productivity.

There is also a severe cost associated with maintaining an overwhelmed in-house compliance function. Many firms believe that hiring a single compliance manager is the most cost-effective solution, but the math often proves otherwise. In the UK, a competent compliance manager commands a base salary of roughly £60,000. However, the true annual cost is far higher when you account for the following:

• Employer’s National Insurance (13.8%): £7,200
• Pension contributions (5%): £3,000
• Recruitment costs (amortised over 3 years): £4,000
• Training, CPD, and regulatory subscriptions: £8,000
• Office space, software, and overheads: £8,500
• Paid absence (holiday and sickness): £8,000

The total true annual cost frequently exceeds £100,200. This figure does not include the single-point-of-failure risk. If that one individual leaves, the firm is left without regulatory coverage, often forced to pay day rates of £500–£1,000 for temporary cover. In contrast, leveraging a retained partner like Compliance Consultant provides senior-level expertise and a panel of topic experts at a fraction of the cost—for example, the Silver Professional tier offers comprehensive support for less than 11% of that annual in-house total.

Evidencing a Compliant Culture Before the Next Audit

Preparation for a 2026 audit requires a shift from manual, retrospective checks to continuous, data-driven monitoring. The FCA no longer accepts the annual review as sufficient evidence of compliance. Instead, firms must move toward Evidencing Consumer Duty Outcomes in Fintech: Moving Beyond Manual Spreadsheets to ensure that cultural health is being tracked in real-time. This involves creating a feedback loop where non-financial misconduct is identified, investigated, and documented immediately.

A concrete roadmap for Heads of Compliance should include the implementation of structured tools that remove the subjectivity from cultural assessments. The use of a dedicated Conduct Rules Breach Investigation Toolkit and an SMCR Responsibilities Mapping Playbook ensures that every incident is handled according to a repeatable, defensible process. This documentation is what the FCA will ask for during a supervisory visit. They want to see the minutes of meetings where cultural risks were discussed and the specific actions taken to mitigate them.

Training is the final pillar. It is not enough to simply distribute the Handbook. Staff must understand how non-financial misconduct relates to their specific roles and the boundary between private life and professional conduct rules. The FCA’s guidance in PS25/23 provides a framework for these assessments, but it is the firm's responsibility to embed these standards into their daily operations. By shifting from a reactive posture to a proactive, evidence-based culture, firms can protect themselves from both internal friction and external regulatory intervention.