SM&CR Reforms: FCA CP26/37 Chapter 5 - Proposed Changes to the Conduct Rules and Breach Reporting
The Financial Conduct Authority (FCA) is proposing to keep the Conduct Rules unchanged but to simplify the processes around them. Firms would no longer have to provide Conduct Rules training, the threshold and timing for reporting breaches by most staff would change, and sole traders would be brought within the rules for the first time. These proposals form part of CP26/37, Senior Managers & Certification Regime Review: Phase 2, which the FCA published on 22 October 2026. The consultation follows the Phase 1 reforms in PS26/6 and depends on changes to the Financial Services and Markets Act 2000 (FSMA) proposed in the Financial Services and Markets (FSM) Bill 2026.
This is the final article in Compliance Angle's three-part series on CP26/37. The first article covered the proposed changes to the Senior Managers Regime in Chapter 3, and the second article looked at the proposed abolition of the Certification Regime and the Directory in Chapter 4.
This article examines Chapter 5, which covers Conduct Rules training, Conduct Rules breach reporting for each category of staff, the treatment of minor misconduct that is not reportable, consequential changes to regulatory references, and the extension of the Conduct Rules to sole traders. If the Certification Regime is removed, the Conduct Rules will become the main individual accountability standard below Senior Manager level, so these changes matter for almost every firm. As with the rest of CP26/37, they are consultation proposals, and the current training and reporting requirements continue to apply until final rules take effect.
What Does Chapter 5 of CP26/37 Propose?
The Conduct Rules, set out in the Code of Conduct sourcebook (COCON), apply to all SM&CR firms and to almost everyone working in them except ancillary staff. That is around 900,000 individuals. The FCA is clear that it is not changing the rules themselves. The proposed legislative changes would instead allow it to simplify two statutory obligations that currently sit around the rules, namely training and breach reporting, and to bring sole traders into scope.
The FCA's cost benefit analysis estimates annual savings of £56.81m from the training proposal and £34.37m from raising the breach reporting threshold (central estimates). These are the second and third largest savings in the Phase 2 package, after the removal of the Certification Regime.
The chapter's proposals fall into five areas:
Replacing the Conduct Rules training duty with a requirement to notify staff of the rules and the consequences of breaching them.
Changing breach reporting thresholds, timing and forms, with different treatment for three categories of staff.
New guidance on misconduct that will not be reported to the FCA.
Consequential changes to the regulatory reference template.
Bringing sole traders into scope of COCON.
Dual-regulated firms are subject to additional reporting requirements and should read the PRA's CP14/26 alongside Chapter 5.
The Main Proposals for the Conduct Rules
Conduct Rules Training Replaced by a Notification Requirement
Firms are currently required by legislation to take "all reasonable steps" to ensure that relevant staff understand the Conduct Rules and how they apply to their roles. In practice, many firms meet this through detailed, role-specific training programmes with significant ongoing costs. The FCA now considers this approach unnecessarily prescriptive.
The FCA does not propose to replicate the statutory training duty once it is removed from legislation. Instead, firms would need to ensure that everyone subject to the Conduct Rules is notified of two things:
the Conduct Rules that apply to them; and
the consequences of breaching those rules.
Firms would not have to provide Conduct Rules training. They could choose how to comply, for example by integrating Conduct Rules content into induction, compliance or wider conduct communications. The FCA accepts that staff may be less well informed, which could weaken the deterrent effect of the regime, but considers this risk small. Its cost estimate assumes that firms will reduce Conduct Rules-specific training costs by about 80%, while recognising that some firms will choose to keep standalone training.
Three Staff Groups for Breach Reporting
Firms must currently notify the FCA when they take disciplinary action for misconduct that amounts to a Conduct Rule breach. FSMA defines disciplinary action as a formal written warning, suspension, dismissal, or the reduction or recovery of remuneration. For most non-SMF staff, breaches are reported through the annual REP008 return.
The FCA values breach reports as a source of information on individual misconduct, firm culture and control weaknesses, and on the suitability of SMF applicants. However, firms have said that identifying and reporting breaches can be resource-intensive, often involving several teams and external advisers, even for minor incidents. The FCA's aim is to target more serious misconduct and streamline the process. Its proposals treat three groups of staff differently:
Non-SMF staff subject only to the Individual Conduct Rules.
Non-SMF staff who are also subject to the Senior Manager Conduct Rules.
SMFs, who are subject to all the Conduct Rules.
Non-SMF Staff Subject Only to the Individual Conduct Rules
This group includes almost everyone working in financial services, so it is where the changes would have the widest effect. The FCA proposes three changes.
First, the reporting threshold would rise to a final written warning or dismissal. A formal (first) written warning, suspension or a reduction or recovery of remuneration would no longer trigger a breach report for this group. The FCA estimates that around 30% of currently reported breaches would no longer be reportable, reducing the burden of breach determination and reporting by around 30%. It considers the risk to supervisory oversight small and mitigated by other notification requirements.
Second, annual reporting would be replaced by a requirement to notify the FCA within 14 months of imposing disciplinary action. Firms would report only the final outcome, after any appeal. Firms could still report annually on a consolidated basis, or more often: the 14-month deadline is designed to allow a 12-month reporting cycle plus two months to resolve appeals.
Third, the breach reporting form would move out of the Handbook so that the FCA can update it more easily. The FCA is considering converting free-text fields into structured questions and adding a question on non-financial misconduct. The rarely used hard-copy option, currently available only to credit unions, would be withdrawn, with alternative formats still available for accessibility needs.
Non-SMF Staff Subject to the Senior Manager Conduct Rules
This group includes individuals providing temporary cover for SMFs, others acting as SMFs without prior approval, and non-executive directors (who are subject to Senior Manager Conduct Rule SC4). The types of reportable breach would not change, and the current FSMA definition of disciplinary action would continue to apply.
What would change is timing. At present, breaches of some rules by these individuals must be reported immediately and others annually, which can mean reporting the same breach twice. The FCA proposes that all breaches by this group be reported within seven business days, with the annual reporting requirement removed. It expects the operational impact to be minimal, given the low number of reports, and says the change would give it earlier visibility of misconduct by senior individuals. For firms that rely on the 12-week rule (which Chapter 3 proposes to extend to 18 weeks), this is a relevant point: the shorter deadline would apply to anyone providing temporary SMF cover.
SMFs
Nothing would change for SMFs. The FSMA definition of disciplinary action would continue to apply, and breaches would be reported as they are now under SUP 10C. The FCA says it is broadly aligned with the PRA, except where the PRA proposes reporting additional types of disciplinary action for staff in certain key roles.
The proposed requirements under FCA rules are summarised below:
Non-SMFs subject only to the Individual Conduct Rules: final written warning or dismissal; report the final outcome within 14 months.
Non-SMFs also subject to the Senior Manager Conduct Rules: formal written warning, suspension, dismissal, or reduction or recovery of remuneration; report the initial outcome within seven business days.
SMFs: formal written warning, suspension, dismissal, or reduction or recovery of remuneration; report the initial outcome within seven business days.
The wider notification duties are unaffected. There would be no change to Principle 11, SUP 15 or SUP 10C, and firms must still promptly notify the FCA of any matter of regulatory significance, including suspected or actual significant breaches of the Conduct Rules. A higher threshold for routine breach reports does not mean that serious misconduct below that threshold can go unreported.
Guidance on Non-Reportable Conduct Rule Breaches
Firms told the FCA that they often carry out detailed Conduct Rule assessments and keep records even for minor misconduct that will never be reported, because of concern about supervisory challenge and regulatory reference requests. The FCA proposes new guidance clarifying that firms are not expected to decide whether misconduct amounts to a breach of COCON unless it results in disciplinary action that would be reportable. The guidance would apply only to the notification requirements under SUP 15.11.
The FCA's intention is to give firms more certainty and allow lower-level conduct issues to be handled through internal processes. The scope of the guidance is narrow, however. It concerns whether a formal COCON breach determination is needed for breach notification purposes. It does not remove the need to deal with misconduct, or the separate duties under Principle 11 and the rest of SUP 15.
Changes to Regulatory References
To keep reporting, record-keeping and disclosure consistent, the FCA proposes to update the regulatory reference template to reflect both regulators' new breach reporting thresholds. Firms should disclose past breaches where the disciplinary action met the reporting threshold that would currently apply to the role. In practice, this means a first written warning would not be disclosed unless the individual was in an SMF or similar role at the time. Firms would still need to disclose any other information relevant to the hiring firm's assessment of fitness and propriety.
This should be read with Chapter 4, which proposes that firms would no longer need to obtain regulatory references for previously certified staff. Regulatory references would remain required for SMF candidates, whether approved or notified.
Sole Traders Brought into Scope of COCON
At present, employees of a sole trader may be subject to the Conduct Rules while the proprietor is not. Sole traders are instead subject to the Principles for Businesses (PRIN 2.1.1R), which set broadly similar standards. The FSM Bill would allow the FCA to bring sole traders into scope of COCON. They would then be subject to both the Senior Manager Conduct Rules and the Individual Conduct Rules, in addition to the Principles.
The FCA describes this as creating a more consistent framework rather than introducing new standards of behaviour. It estimates that around 1,000 sole traders would be affected and does not expect a significant cost impact.
Key Themes in the Conduct Rules Proposals
Three themes stand out. First, the standards are unchanged but the process is lighter. The Conduct Rules themselves stay the same, and the changes concern how firms inform staff, which misconduct is reported and when. Second, the reforms are tiered by seniority. For most staff, the threshold rises and the reporting window lengthens. For senior individuals, the reportable types of action stay the same, and the reporting window for non-SMF senior staff becomes shorter and simpler. Third, the FCA is relying more on firms' own judgement and internal processes. This is consistent with its wider decision to accept more risk in exchange for a more proportionate regime.
Read together with Chapter 4, these proposals change the position of the Conduct Rules within the SM&CR. If certification is removed, the Conduct Rules, together with firms' own competence and suitability arrangements, will be the main individual accountability mechanism for staff below Senior Manager level. The draft Handbook text reflects this, using "Senior Managers and Conduct Rules Regime" as a placeholder name for the regime.
In our view, firms should be cautious about reducing Conduct Rules communication to the bare minimum. The new requirement is to notify staff, but the FCA's analysis itself recognises the risk that staff will be less well informed. With certification also expected to go, a short, practical explanation of the rules, built into induction and periodic compliance updates, is likely to be a proportionate way to demonstrate that staff understand the standards expected of them.
What Should Firms Do Now
None of the Chapter 5 proposals is in force. Until final rules take effect, firms must continue to train staff on the Conduct Rules, report breaches on the current threshold through REP008 and SUP 10C, and use the current regulatory reference template. The steps below are about preparation and should be proportionate to the size of the firm and its staff population:
Review the firm's disciplinary policy and map its sanctions against the proposed threshold. Many policies use different labels for warnings, so firms should identify which outcomes would count as a "final written warning" for reporting purposes.
Identify which individuals fall into each of the three reporting groups, including non-executive directors and anyone who provides or may provide temporary SMF cover.
Plan how the seven business day deadline for senior non-SMF staff would be met in practice, including who decides on reporting and how HR and compliance share information.
Decide on the future reporting cycle for other staff: an annual consolidated report within the 14-month window, or reporting as cases close.
Review current Conduct Rules training and decide what form of notification, and what level of training, the firm will provide once the statutory duty is removed.
Update breach assessment and regulatory reference procedures so that they reflect the new guidance on non-reportable breaches and the revised disclosure template once confirmed.
Sole traders should prepare for the Conduct Rules to apply to them personally, including the Senior Manager Conduct Rules, and consider how this sits alongside their existing obligations under the Principles for Businesses.
Consider responding to Questions 19 to 25, particularly on the breach reporting threshold and the guidance on non-reportable breaches.
Consultation Deadline and Next Steps
The consultation closes on 22 January 2027. The FCA expects to publish final rules in a Policy Statement in the first half of 2027 and proposes to implement them about six months later, in H2 2027. The changes to training, breach reporting and sole traders all depend on amendments to FSMA, so implementation depends on the FSM Bill receiving Royal Assent. The FCA has confirmed that it will not implement any part of the package before reaching a final policy position. Firms should keep their current arrangements in place until then.
How Compliance Angle Can Help
Compliance Angle supports FCA-regulated firms and sole traders in understanding and implementing changes to the SM&CR. Our support is practical and proportionate, tailored to each firm's business model, permissions, size and staff population. Depending on the firm's needs, this can include:
SM&CR support, including a review of Conduct Rules breach assessment and reporting arrangements against the proposals;
compliance training, including proportionate Conduct Rules communications and training for staff and managers;
updating disciplinary, breach reporting and regulatory reference procedures; and
ongoing compliance support to manage the transition and monitor reporting once the new rules take effect.
If you would like to discuss how the proposed changes to Conduct Rules training and breach reporting may affect your firm, please contact us at info@complianceangle.co.uk.
Source: Financial Conduct Authority, CP26/37: Senior Managers & Certification Regime Review: Phase 2, published 22 October 2026.
