Bullying became a conduct rule breach on 1 September, and the FCA's week ended with a £742,700 fine (5 September 2026)
Two things happened at the FCA this week that look unrelated and are not. A rule change made how people treat colleagues a regulatory matter at tens of thousands of firms, and an enforcement decision showed what the regulator does when it concludes someone is not fit to hold the job.
The non-financial misconduct rules took effect on 1 September
From 1 September, serious bullying, harassment and violence towards colleagues is a conduct rule breach at firms that were previously outside the scope of that part of the regime. The mechanism is a new rule, COCON 1.1.7FR, which extends the Code of Conduct at non-bank firms under the Senior Managers and Certification Regime to work-related conduct that is not of a clearly financial nature, provided there is a sufficient work-related link. It is not retrospective.
Alongside it, the Fit and Proper guidance now allows a broader range of misconduct to be weighed when a firm assesses whether someone is fit and proper, including conduct that falls outside the narrower work-related test in the conduct rule itself. The FCA published the package as PS25/23, with the final guidance issued in December 2025, covering where work ends and private life begins, what reasonable managerial steps look like, and how to handle unproven allegations.
Two limits are worth stating clearly because they are widely misread. Firms are not expected to monitor employees' private lives, and they are not required to go back and re-open past determinations. What they are expected to do is act when credible information reaches them that calls someone's fitness into question, and to disclose serious, substantiated personal misconduct in regulatory references. Legal commentators put the number of newly in-scope firms at roughly 37,000, including asset managers and insurers. Sources: FCA and DLA Piper.
FCA decides to ban an adviser and fine him £742,700
On 4 September the FCA announced it had decided to ban Daniel Thomas from working in financial services and to fine him £742,700, after finding he recklessly gave defined benefit pension transfer advice he was neither qualified nor permitted to give.
Thomas was a director and adviser at DPT Financial Solutions. Over five years he advised 53 clients on 63 transfers out of defined benefit schemes and is believed to have earned more than £173,000 in fees. The FCA found he repeatedly misled clients and pension providers about his professional qualifications, destroyed client records and failed to co-operate with the investigation. Some of those clients were British Steel Pension Scheme members, a group the regulator has repeatedly described as being in a particularly vulnerable position.
The penalty is built in layers: the £173,000 in fees plus interest, an amount reflecting the seriousness of the conduct, and a further increase for the failure to co-operate. This is a Decision Notice rather than a final one. Thomas has referred it to the Upper Tribunal, so the findings are provisional until that process concludes, and the FCA made no findings against Quilter in connection with the matter. Source: FCA, 4 September 2026.
Why the two belong in the same week
The Thomas case turns on qualifications, records and co-operation, not on bullying. But the reasoning is the same reasoning the new rules import into a much larger set of firms: honesty and integrity are assessed as a whole person question, and the uplift for failing to co-operate shows how much weight the regulator puts on conduct during a process rather than only on the original act.
For a compliance team the practical read is short. Fitness and propriety is no longer a box confirmed at hiring and revisited at renewal. From this month it is a live assessment fed by grievance outcomes, disciplinary findings and regulatory references, and the first firms to discover the gap will be the ones whose HR and compliance functions have never had to share a file.