When HR becomes a compliance risk: FCA’s non-financial misconduct rules

By Alon Kohalny, 22 September 2026

On 1 September 2026, new Financial Conduct Authority (FCA) rules brought serious non-financial misconduct more explicitly within the scope of the regulatory framework applying to financial services firms.[1]

The changes concern conduct such as bullying, harassment and violence. At first sight, these may appear primarily to be matters for Human Resources (HR), employment law and workplace culture. For compliance officers, however, the significance is considerably broader.

Where conduct traditionally managed through HR processes can constitute a breach of regulatory conduct rules, affect an individual’s fitness and propriety, or have consequences for regulatory references, HR-related processes become relevant to the organisation’s compliance risk framework.

This does not mean that compliance should assume responsibility for HR. Rather, it means that an area traditionally regarded as a partner to compliance increasingly also contains risks that compliance programmes may need to identify, assess and monitor.

From workplace conduct to regulatory conduct

Non-financial misconduct has attracted increasing regulatory attention in the UK financial services sector.

The FCA’s approach in extending the scope of its Conduct Rules reflects the proposition that serious misconduct towards colleagues cannot necessarily be separated from questions of regulatory conduct and individual fitness.

Furthermore, the implications extend beyond the Conduct Rules.

The FCA has also clarified how non-financial misconduct may be relevant to assessments of fitness and propriety. Conduct outside work may, in appropriate circumstances, be relevant where it raises concerns about characteristics relevant to a regulated role – for example, a willingness to disregard legal or ethical obligations, abuse positions of trust, or exploit the vulnerabilities of others.

There are important limits. Firms are not expected to monitor employees’ private lives or social media accounts. Nevertheless, where relevant information becomes known to the firm, it may need to consider its regulatory significance.

The distinction between an ‘HR matter’ and a ‘compliance matter’ consequently becomes less straightforward.

HR has traditionally been a compliance partner

HR has long been one of the compliance function’s most important internal partners.

The two functions frequently interact in relation to codes of conduct, employee screening, training, whistleblowing, disciplinary procedures, and the investigation of employee misconduct. HR may also possess information that is essential to identifying compliance breaches or assessing individual conduct risk.

The FCA’s new framework does not change that relationship. It does, however, add another dimension to it.

Where conduct managed through HR processes can also constitute regulatory misconduct, and where the handling of that conduct can affect Conduct Rules reporting, fitness and propriety assessments or regulatory references, those processes are no longer relevant solely to HR.
They become part of the organisation’s compliance risk environment.

HR therefore remains a partner to compliance, but some of the activities for which it is responsible may simultaneously become areas that need to be reflected in the compliance framework.

What does this mean for compliance officers?

The answer is not that compliance officers should become HR professionals.

Compliance should not ordinarily investigate every workplace grievance, determine whether an employee has bullied a colleague, or assume responsibility for employment decisions. Operational and professional responsibility for HR processes should remain with the appropriate function.

The compliance question is different: does the organisation have effective arrangements for managing the regulatory risk arising from those processes?

For example, firms may need to consider:

• Are there appropriate mechanisms for identifying when an HR matter also raises a regulatory issue?
• Does relevant information reach Compliance?
• Have they made escalation criteria clear?
• Are potential implications for fitness and propriety considered?
• Are applicable reporting and record-keeping requirements met?

The FCA itself has identified a number of matters firms should consider ahead of implementation, including staff policies, Conduct Rules breach reporting, fit and proper assessments, and regulatory references.

These requirements do not turn Compliance into the internal auditor of HR. They do, however, make relevant HR processes part of the compliance risk landscape.

Extending the compliance risk assessment

For compliance officers, the first practical consequence is therefore the compliance risk assessment.

Firms should consider whether risks arising from HR-related activities are adequately captured within their existing compliance risk universe. This could involve mapping regulatory obligations across the employee lifecycle, from recruitment and screening through training and workplace conduct, to disciplinary proceedings, fitness and propriety assessments and termination.

The exercise should distinguish clearly between regulatory responsibility and operational ownership.

A control may be owned and operated by HR, while nevertheless mitigating a compliance risk. That is neither unusual nor problematic. Compliance controls throughout an organisation are frequently operated outside the compliance function.

The relevant question for compliance is whether the regulatory risk has been identified and whether appropriate controls exist to manage it.

This distinction is important. An effective compliance framework should not be designed around organisational boundaries. It should be designed around regulatory risks.

Compliance monitoring

Identification of the risk is only the first step. Where the risk is material, it may also need to be reflected in the compliance monitoring programme.

Depending upon the firm and its risk profile, monitoring could consider:

• Whether relevant cases are appropriately identified and escalated.
• If information flows between HR and compliance operate as intended.
• Whether decisions concerning fitness and propriety are properly documented.
• If Conduct Rules reporting and regulatory reference requirements are being applied consistently.

This is not an internal audit of HR.

Compliance monitoring should provide assurance that processes relevant to regulatory compliance are operating as intended, and that controls designed to manage compliance risks are effective, even where those controls are operated by HR or another business function.

That distinction preserves the respective responsibilities of HR, Compliance and Internal Audit, while still recognising that regulatory risk does not respect organisational charts.

Broader lesson for compliance programmes

The significance of the FCA’s changes extends beyond non-financial misconduct.

Modern regulation increasingly cuts across traditional organisational boundaries. Data protection requirements reach deeply into technology and information security. Sanctions controls extend into procurement and supply chains. Regulatory reporting depends upon processes within finance. Third-party risks may sit within procurement or operational functions.

Compliance officers do not need to take operational ownership of each of these areas. Indeed, doing so could undermine the allocation of responsibility that an effective compliance framework requires.

But compliance programmes cannot define their scope simply by reference to the activities performed by the compliance department.

If a regulatory risk arises within HR, Finance, Procurement, Technology or another function, its organisational location does not remove it from the compliance risk universe.

The FCA’s approach to non-financial misconduct provides a particularly useful illustration of this principle.

From compliance partner to compliance risk area

HR will remain an essential partner to Compliance. The new rules do not alter that.

What they do is make clearer that certain processes managed by HR may also constitute areas of regulatory risk. Those risks may therefore need to be captured in the compliance risk assessment, addressed through appropriate controls and, where proportionate, incorporated into compliance monitoring.

For compliance officers, the lesson is not to expand their operational empire. It is to ensure that the compliance programme follows the risk.

As the regulatory perimeter expands, the compliance programme must be capable of expanding with it.