We’re just days away from the FCA’s non-financial misconduct rules being extended to 37,000+ regulated firms on 1st September, meaning that serious workplace behaviours such as bullying, harassment and sexual harassment will now be classed as regulatory breaches, not just something to be ‘passed to HR’.
Set out under the Code of Conduct (COCON) and the Fit and Proper test (FIT), the changes broaden the scope of conduct rules in non-banking firms, bringing them closer to the position that has applied to banks for some time. More broadly, on 30th October the Employment Rights Act will strengthen UK employers’ duty to take ‘all reasonable steps’ to prevent sexual harassment, placing greater emphasis on proactive prevention rather than reactive response.
Together, these changes raise the bar on what ‘compliant’ actually looks like. There’s work that needs doing to help meet that bar in the short term –including reviewing and updating policies, undertaking thorough risk assessments, providing targeted training where needed, and ensuring that clear reporting and escalation routes exist. But firms that treat these new rules as a box-ticking policy exercise are missing a bigger opportunity: to get a true read on their organisational culture and the opportunity to identify and act on issues before they escalate.
This is particularly important when you consider that the FCA has made it clear that firms will not be assessed on whether they have policies in place alone, but on whether they can demonstrate meaningful cultural change, effective oversight, and consistent enforcement in practice.
Using reporting data as culture intelligence
Many organisations have already taken positive steps to stamp out poor behaviour in the workplace, with a high number now having some form of formal reporting system in place. But the real question is what happens next? Collecting reports is one thing but using that data to identify patterns of behaviour and emerging risks is another.
In many firms, conduct reports are still treated as isolated incidents, rather than being grouped to unearth cultural intelligence and trends. A report arrives, it’s assessed, investigated, and closed. Another follows and the same process repeats. The approach limits understanding and risks missing the bigger picture. Insight only emerges when firms can analyse reports collectively, identify recurring themes over time and understand where issues may be developing. One report may appear isolated, but a series of similar concerns raised over time can reveal deeper cultural issues that would likely go unnoticed.
Viewing reports collectively allows firms to spot patterns – whether that’s repeat names or linked individuals appearing across multiple reports, hotspots in certain teams or offices, similar issues appearing consistently, or increases in reports at certain times of year such as Christmas parties or periods of increased workload and stress. If companies know when these problem periods are, they can be worked into risk assessments and preventative action can be put in place to stop issues happening in the first place, or at least mitigate the risk.
Low levels of reporting are also worth keeping an eye out for – often pointing to a lack of psychological safety and reluctance to report. EHRC’s research into workplace harassment backs this up, stating that low harassment reporting rates may indicate a workplace where employees feel unable to report due to fear of retaliation, rather than the absence of harassment. So, if reports look abnormally low, particularly in larger organisations, this should be examined.
Used in the ways described above, anonymous reporting data provides a practical way for organisations to build a clearer understanding of their organisational culture, and to address emerging issues before they escalate into more serious problems. However, many organisations are still some way from this proactive and preventative approach, often because they haven't yet built the analytical habit or the organisational appetite to look – not because they lack the data.
The case for earlier intervention
One of the most powerful benefits of collective data analysis is the ability to intervene earlier. When patterns are visible, firms can act before matters escalate into formal disputes, regulatory exposure, and possible reputational damage. Teams shouldn’t have to wait until a serious report arrives to act. This might mean coaching managers whose teams show elevated concerns, adjusting workload allocation, providing mediation support, strengthening leadership capability, or changing management structures.
These interventions are typically less costly and combative, and more effective than post-crises responses. They preserve relationships, protect reputations, and reduce attrition, but perhaps most importantly, they demonstrate that reporting leads to tangible improvement. When employees see that reporting issues prompts meaningful change, confidence in internal systems grows and the likelihood of speaking up is greater.
September is just the beginning
With just a few days until the 1st September rule changes, smart firms will have already taken various steps to prepare, and be documenting their efforts to evidence compliance. However, compliance should be just the beginning, not the end goal.
The smartest firms will use these regulatory changes to sharpen how they listen, learn and respond to what’s going on culturally within their organisation, not simply to box-tick. They won’t necessarily be the ones with the longest policies, but instead those that can show they understand what is happening in their business and are prepared to act before a cultural concern becomes a conduct, regulatory or reputational crisis.
