Full Breakdown
Regulators Tighten Conduct Rules and AI Oversight in Financial Services
4/28/2026, 9:27:49 PM
New Conduct Rules and AI Guidance Take Effect
From 1 September 2026 the UK FCA will treat serious bullying, harassment or violence as breaches of the Code of Conduct Rules (COCON) even when unrelated to regulated activities. The South African FSCA and SARB have signalled upcoming AI-specific guidance that will require transparency, explainability and governance for autonomous systems.
Expanded Scope of Non-Financial Misconduct and Agentic AI
The FCA now classifies non-financial misconduct (NFM) – bullying, harassment and violence – as conduct matters linked to the Senior Managers and Certification Regime (SMCR). Firms must treat NFM as a regulatory issue, not merely an HR matter, and document escalations promptly. At the same time, financial institutions are deploying agentic AI that can initiate transactions, assess credit and manage customer interactions, shifting AI from a productivity tool to a profit-and-loss driver. Regulators warn that opaque models may trigger conduct breaches if decisions cannot be explained.
Data and Statistics
- FCA imposed a £1.8 million fine and an industry ban on a senior individual for obstructing internal disciplinary processes.
- Stanford’s 2026 AI Index recorded 362 AI incidents in 2025, a 55 % increase over the prior year.
Official Statements & Responses
The FCA and PRA issued joint guidance requiring firms to embed NFM considerations into risk frameworks, set clear escalation routes and retain robust documentation. In South Africa, the FSCA and SARB indicated that future AI regulations will focus on explainable algorithms and customer-trust safeguards, though formal rules are pending.
Criticism & Opposition
Industry observers note a “speed versus fairness” tension: regulators push rapid escalation of misconduct, while employment law mandates reasonable investigation periods. Some critics argue that the broadened COCON scope could lead to “over-correction” where firms act on incomplete evidence.
Conflicting Reports & Gaps
The FCA’s NFM definition is deliberately broad, creating potential mismatches with existing employment-law standards. AI governance guidance remains fragmented globally, and South Africa lacks formal AI legislation, leaving firms uncertain about future compliance requirements.
Verbatim Quotes
- “From 1 September 2026, serious bullying, harassment or violence will breach the FCA Code of Conduct Rules (COCON) regardless of whether the conduct relates to regulated activities.” — FCA, Regulatory Notice
- “The challenge has shifted. It is no longer about whether the model is good enough.” — Zilvinas Girenas, Head of Product, nexos.ai
- “Clear and explicit accountability must run across technology, data and teams.” — AI Journ, Expert Commentary
- “COCON remains focused on conduct with a sufficient work-related link and generally excludes private life.” — FCA, Conduct Rules Guidance
What’s Next
Firms must revise SMCR fitness-and-propriety assessments by Q4 2026 to embed NFM risk. Simultaneously, banks and insurers are expected to pilot AI audit frameworks before the anticipated FSCA-SARB AI guidelines are formalised, likely in 2027. Early adoption of integrated governance—combining HR, compliance, legal and model-risk functions—will be decisive in meeting both conduct and AI regulatory expectations.
