Understanding the Challenge
On 1 September 2026, the Financial Conduct Authority (FCA) expanded its Standards of Business Conduct to include serious bullying, harassment, and violence as regulatory issues if there's a sufficient connection to work. This shift meant that decisions HR teams had been making for years, whether to investigate an allegation, how to weigh evidence, what counts as "serious", now carried regulatory consequences.
The challenge wasn't just understanding these new rules. It was applying them without turning every workplace conflict into a compliance investigation or dismissing genuine concerns because they happened outside the office. Your team needs a framework to distinguish serious regulatory risk from ordinary workplace friction before the first difficult allegation arrives.
Navigating the Environment
Two key factors shaped how your team must respond. First, the FCA clarified it doesn't expect companies to monitor employees' private lives or police every bad-tempered exchange. The threshold is "serious" behavior, and context matters. A single rude comment won't trigger a regulatory breach, but repeated harassment or conduct involving violence could.
Second, the connection to work isn't just about location or time. Behavior at the office, while working remotely, or at a company event is clearly within scope. But what about a party that started as an official event and continued elsewhere? Or social media posts that catch the firm's attention? The test is whether a sufficient connection with work remains, meaning you can't rely on simple rules.
At the same time, overlapping obligations exist. From 30 October 2026, employers have a duty to take all reasonable steps to prevent sexual harassment under the Employment Rights Act. The Crime and Policing Act 2026 expanded Section 7 Corporate Liability for senior managers whose conduct affects the business. A single allegation could have employment-law implications, regulatory implications, or both. HR and compliance teams that operated separately now need a joint protocol.
Crafting an Effective Approach
Start with a triage framework to apply consistently before an allegation escalates. Ask three questions upfront: Is there credible evidence? Is it connected to the person's role? Could it affect customers, colleagues, the firm's reputation, or the individual's fitness and propriety?
If the answer to all three is no, there might be nothing further to do. If yes, investigate the relevant facts without turning it into a broader inquiry into someone's private life. The threshold for "let's look into this" is lower than for "we've established misconduct." Managers should escalate a concern, not diagnose it themselves.
Documentation is critical, even when deciding not to investigate. The FCA's guidance states that deciding not to investigate is itself a decision. You need to show you've weighed an allegation against a consistent framework, considered the evidence, and reached a reasoned conclusion. This protects your firm if the decision is later questioned and avoids over-reporting as a substitute for proper judgment.
Redefine how HR and compliance work together. Create a joint protocol before an allegation arrives. HR typically leads the employment process, while compliance needs visibility of any regulatory implications. The protocol should specify who investigates, who makes the employment decision, and who assesses regulatory risk.
Measuring Success
The government's broader SMCR Phase 2 reforms aim to cut the regime's administrative burden by around 50%. This reflects a recognition that firms were spending significant resources on compliance processes that didn't always improve outcomes.
For non-financial misconduct rules, the FCA emphasized that reporting more complaints doesn't necessarily mean a firm has a worse culture. Very low numbers could mean people don't feel safe raising concerns. If you're treating a falling complaint count as a target, you're missing the point. The real measure is whether patterns across whistleblowing reports, complaints, disciplinary cases, exit interviews, and surveys show that people feel safe speaking up and that concerns are handled consistently.
Learning from Experience
Firms that struggled made one of two mistakes. Some treated every workplace conflict as a potential regulatory breach, launching unwarranted investigations. Others dismissed concerns too quickly because they happened outside traditional work hours or locations.
The firms that adapted effectively realized early that the "sufficient connection" test required judgment, not a checklist. If a later event was a continuation of an official work event, or if problematic behavior began at the original event and continued, the connection with work could still apply. Relevant factors include who organized the second venue, how many of the same people attended, whether senior staff and their direct reports were present, and how much time passed. Calling something "private" doesn't automatically make it so, especially if junior staff felt they were expected to attend.
Several firms wished they'd built their change registers earlier. SMCR Phase 2, introduced through the Financial Services and Markets Bill on 19 May 2026, contained broader reforms to certification, fitness and propriety assessments, and Senior Management Function approvals. Firms that mapped current processes before the final rules arrived were better positioned to act quickly once formal consultations began.
Key Takeaways for Your Team
Start with a triage framework you can apply before an allegation escalates. The three-question test, credible evidence, connection to role, potential impact, gives you a consistent starting point without requiring a full investigation every time.
Document your decisions, including decisions not to investigate. You're not trying to build a legal defense; you're showing you applied a reasoned process. If you can't explain why you dismissed an allegation or why you escalated it, your framework isn't working.
Create a joint HR-compliance protocol now, before the next difficult allegation arrives. Specify who investigates, who decides, and who assesses regulatory risk. The worst time to figure out who owns what is halfway through a harassment investigation.
Don't treat a falling complaint count as a success metric. Look for patterns across multiple data sources. If you're seeing very few reports, ask whether people feel safe speaking up, not whether your culture has improved.
Finally, remember that senior management needs to demonstrate the system works in practice, not just on paper. A policy alone isn't a control. Training shows people understood and used it. If your managers can't explain how to apply the framework, you don't have a framework, you have a document.
