Can misconduct outside work affect whether someone is fit and proper under FCA rules?
Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.
Wider than the conduct rules
The Code of Conduct (COCON) only covers conduct connected with a firm's activities. The fit and proper test (FIT) is not limited in that way, so behaviour outside work can still matter when a firm assesses certified staff or senior managers.
FIT 1.3.16G says dishonesty or a lack of integrity outside the regulatory system is always relevant. Violence or sexual misconduct in private life may show a risk of similar behaviour towards customers or colleagues.
When there is little risk of repetition
Private-life misconduct can be relevant even where it is unlikely to be repeated at work, if it shows a willingness to disregard ethical or legal obligations, abuse a position of trust or exploit the vulnerabilities of others, or is serious enough to undermine public confidence. FIT 1.3.17G says a custodial sentence, even if suspended, is likely to be serious enough, subject to factors such as how old the offence is and rehabilitation since.
Allegations and social media
Firms need only look into an employee's private life if there is a good reason, such as an allegation that would call their fitness into question if true. The FCA does not expect firms to investigate allegations that are trivial, that would not show a material risk, or that the firm reasonably considers implausible. Firms will often rely on criminal convictions or the findings of a court, tribunal or regulator, but should consider what reasonable steps they can take, such as asking the person for an explanation.
Social media is treated in the same way. Threats of violence or clear involvement in crime are relevant. FIT 1.3.21G says a person can lawfully express controversial views without calling their fitness into question, even if colleagues disagree or are upset.
Sources
- FIT 1.3 Assessing fitness and propriety · FCA Handbook
- Non-financial misconduct in financial services · FCA
- PS25/23: Tackling non-financial misconduct in financial services · FCA
General information for employers in Great Britain, not legal advice. Check the official sources for your situation.
- FCA guidance on non-financial misconduct and fitness and propriety came into force
Future dates are expected dates and depend on Parliament.
What employers can do
- Set out in policy when the firm will look into conduct outside work
- Triage allegations: trivial, implausible or irrelevant matters need not be investigated
- Ask the person for their explanation before reaching a view
- Record the reasons for each fitness and propriety decision
- Keep any investigation fair and within employment and privacy law
- Check whether the matter needs to be notified to the FCA or reflected in a regulatory reference
Pre-employment checks by sector: Financial services.
Related answers
- What are the FCA's rules on non-financial misconduct? Since 1 September 2026, the FCA's Code of Conduct (COCON) has applied to serious bullying, harassment and violence by conduct rules staff towards colleagues in firms other than banks, as it already did in banks. New FCA guidance explains when such behaviour breaches the conduct rules and how it bears on fitness and propriety.
- What is a fair disciplinary procedure? In Great Britain, a fair disciplinary procedure follows the Acas Code of Practice: investigate to establish the facts, tell the employee about the problem in writing, hold a meeting where they can respond, allow them to be accompanied, decide and confirm the outcome in writing, and offer an appeal.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.