FCA Handbook - COCON 1.3 Scope of COCON

You are viewing COCON 1.3 Scope of COCON as it appeared on 01/09/2026. The current version of COCON 1.3 Scope of COCON was last updated on 01/09/2026 .

Guidance

Related resources

COCON 1.3 Scope of COCON

Introduction

This section deals with the restrictions on the scope of COCON based on:

(1) the activities of the firm in COCON 1.1.6R to COCON 1.1.7R (To what conduct does it apply? (Limitations in the Act)) (COCON 1.3.2G to COCON 1.3.9G deal with this);
(2) the SMCR financial activities of a firm in COCON 1.1.7AR (To what conduct does it apply? (Other limitations: Non-banks)) (COCON 1.3.10G to COCON 1.3.16G deal with this); and
(3) COCON 1.1.7BR (To what conduct does it apply? (Other limitations: Benchmark firms)) (COCON 1.3.17G deals with this).

COCON does not cover private or personal life

COCON 1.1.6R to COCON 1.1.7R limit the application of COCON to conduct that relates to a function carried out by a member of the conduct rules staff where in turn that function relates to the carrying on of an activity by the firm. The firm's activity may be a regulated activity or an unregulated activity. This limitation on the scope of COCON applies in relation to all firms.

(1) The effect of COCON 1.1.6R to COCON 1.1.7R is that conduct relating to the conduct rules staff member’s private or personal life is outside the scope of COCON.
(2) However, this does not mean that a senior conduct rules staff member is not required to disclose information about their private or personal life under COCON 2.2.4R (SC4). A senior conduct rules staff member should disclose such matters if they are material to an assessment of fitness and propriety under FIT. COCON 4.2.33G (SC4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice) gives examples of matters that should be disclosed.

Factors that point towards conduct being within the scope of COCON 1.1.6R to COCON 1.1.7R include:

(1) the conduct occurred when the conduct rules staff member was present on the firm's premises;
(2) the conduct occurred when the conduct rules staff member was working on the firm's business;
(3) the conduct involved a client, a professional acquaintance, another member of the firm's staff or someone the conduct rules staff member had dealt with on behalf of their firm;
(4) the conduct was carried out using equipment supplied by or made available by the firm or by involving the firm's staff;
(5) the conduct arose in a business context, including an official or an informal event organised or supported by the firm or in which the firm participates, whether it is held at the firm's premises or at another location;
(6) the position of the conduct rules staff member as a conduct rules staff member of the firm helped them to carry out the conduct; or
(7) the purpose (misguided or not) of the conduct was to benefit the firm.

(1) Whether conduct is within the scope of COCON depends on the specific facts of each case. It is therefore not possible to set out scenarios in the Handbook and say whether in all cases the conduct in question will be within the scope of COCON.
(2) Paragraph (1) means that:
1. (a) the list of factors in COCON 1.3.4G is not exhaustive; and
2. (b) the presence or absence of one of the factors in COCON 1.3.4G is not by itself conclusive.
(3) Another result of (1) is that:
1. (a) when the table in COCON 1.3.7G says that conduct is generally within the scope of COCON, that means that the facts of the scenario are ones that point towards the conduct coming within the scope of COCON; and
2. (b) when the table in COCON 1.3.7G says that conduct is generally outside the scope of COCON, that means that the facts of the scenario are ones that point against the conduct coming within the scope of COCON,
3. but that in an individual case all the other features of the case are also relevant.

(1) The table in COCON 1.3.7G sets out examples of when a person's conduct is outside the scope of COCON because it is part of their private or personal life and when it is not excluded for that reason (subject to COCON 1.3.5G).
(2) As explained in Note (2) to the table, conduct to which ‘Yes’ applies is not necessarily within the scope of COCON as it may be excluded by one of the other scope rules in COCON 1.1 (Application). For example, it may be excluded by the exclusion in COCON 1.1.7AR (To what conduct does it apply? (Other limitations: Non-banks)).
(3) Another example of the point in (2) is that if M (as referred to in the notes to the table) is based in an overseas office of the firm and carries out the conduct from there (or from their home in the country where the overseas office is located), the conduct will be outside the scope of COCON under COCON 1.1.10R (Where does it apply?) unless M comes within COCON 1.1.9R (which deals with senior conduct rules staff members and material risk takers) or within COCON 1.1.10R(2)(b) (which deals with clients in the United Kingdom).

Table: Private or personal life and COCON

Description of conduct	Whether generally within the scope of COCON 1.1.6R to COCON 1.1.7R
Misconduct by M in relation to a fellow member of the workforce while both are on their firm's premises.	Yes
Misconduct by M in relation to a fellow member of the workforce while M is working remotely for their firm.	Yes
Misconduct by M in relation to a family member while M is working remotely for their firm.	No
Misconduct by M in relation to a member of the public while M is commuting to or from their firm's place of business for work.	No
Misconduct by M in relation to a fellow member of the workforce when both are travelling to a meeting in which they will represent their firm.	Yes
Misconduct by M in relation to a client at a business meeting in which M is representing their firm.	Yes
Misconduct by M in relation to a fellow member of the workforce at a social occasion organised by their firm.	Yes
Misconduct by M in relation to a fellow member of the workforce at a social occasion organised by M or another member of the workforce in their personal capacity.	No However: (1) An occasion organised by a manager may be within the scope of COCON, taking into account that the manager’s direct reports may feel obliged to attend. (2) If the event takes place after a firm event but at a separate location or venue, it may be within the scope of COCON if it is a continuation of the first event or if the conduct started at the first event and continued in the new venue. Otherwise, COCON is likely to cease to apply because the connection between the event and the activities of the firm has been lost.
Misconduct by M at a social occasion, a meeting, a round table, an awards ceremony, a training course or a workshop, in each case organised by a client of their firm, another firm, an industry body, a training organisation or a regulator, in which they will represent their firm or where the main reason for the invitation is their working for their firm.	Yes
M is a member of a profession (such as an accountant, actuary or lawyer) and practises that profession in their job with their firm. M carries out misconduct at an event organised by a third party to meet the professional requirements of that profession or by the regulator of that profession.	Yes
M publishes material on a personal social media account (including sending it on a messaging app) held by M. As this table only covers whether conduct takes place in M’s private life (and hence is outside the scope of COCON under COCON 1.1.6R to COCON 1.1.7R), this example assumes that the publication would otherwise breach COCON.	This is an example of how it is not possible to give a definitive answer to a scenario based on a single element. Factors to take into account include: • whether the material is directed at a fellow member of the workforce (if it is, that points towards the conduct being within scope); • whether there is another connection between M and the subject of the misconduct that is not based on M’s work with their firm (if there is such a connection, that may point away from the application of COCON); • whether it is part of a course of conduct that includes other incidents that are more closely connected with M’s work at the firm; • whether the content of the social media posts is related to work at the firm; • whether M uses a work-issued device. The fact that M uploads the posts during working hours or while on the firm's premises is not a strong factor pointing towards the application of COCON. If the conduct takes place over the firm's systems (for instance through the firm's e-mail system) it is likely to be within the scope of COCON.
Notes
(1) ‘M’ refers to the member of a firm's conduct rules staff carrying out the conduct in question.
(2) ‘Yes’ means that, in accordance with COCON 1.3.5G(3)(a), the scenario is based on a factor that points towards the conduct being within COCON 1.1.6R to COCON 1.1.7R and thus within the scope of COCON unless excluded by COCON 1.1.1AR to COCON 1.1.5AR (To whom does it apply?), COCON 1.1.7AR to COCON 1.1.7FR or by COCON 1.1.8BR to COCON 1.1.11CR (Where does it apply?).
(3) ‘No’ means that, in accordance with COCON 1.3.5G(3)(b), the scenario is based on a factor that points towards the conduct being outside COCON 1.1.6R to COCON 1.1.7R and thus outside the scope of COCON.

However, conduct excluded from COCON as described in the table in COCON 1.3.7G can still be relevant to fitness and propriety, as described in FIT 1.3 (Assessing fitness and propriety).

The scope of COCON is not limited to conduct that is authorised by the firm or carried out with a view (misguided or not) that it is for the firm's benefit. Conduct is not excluded from the scope of COCON just because the firm forbids it (for instance, in a staff handbook) or it is calculated to harm the firm. Thus, for example, the following conduct is within the scope of COCON 1.1.6R to COCON 1.1.7R:

(1) misappropriating a client’s or the firm's assets;
(2) providing false or inaccurate details about the member of the conduct rules staff's training, qualifications, past employment record or experience;
(3) misusing the assets or confidential information of a client or the firm to make a personal profit;
(4) misconduct against a client;
(5) harassment of a fellow member of the workforce; and
(6) maliciously sabotaging a firm's information technology systems or altering or erasing its data.

SMCR financial activities

COCON 1.3.11G to COCON 1.3.16G deal with a conduct rules staff member for whom the scope of COCON is limited to conduct in relation to their firm's SMCR financial activities by COCON 1.1.7AR.

When COCON is restricted to SMCR financial activities, it covers more than conduct involving direct dealings with counterparties and customers (and potential ones) or their assets at the point of sale or at the time of the transaction or service. It can also cover matters such as the following:

(1) conduct arising out of such direct dealings, such as record-keeping, valuations and reporting;
(2) after-sale or post-transaction activities such as settlement, queries, dealing with the exercise of rights by the firm or the customer, complaints, cancellations, renewals and generally dealing with the customer or counterparty through the lifecycle of the product or relationship;
(3) designing and operating policies and procedures relating to the conduct of the firm's relationship with counterparties and customers, such as:
1. (a) product or services design;
2. (b) policies and procedures about what services and products to sell or buy;
3. (c) policies and procedures about product distribution;
4. (d) policies and procedures for the conduct of the relationship between the firm and a customer in relation to products and services already sold or delivered; and
5. (e) policies and procedures for the monitoring of customer outcomes for products and services already sold or delivered; and
(4) management and monitoring of these activities.

COCON is not restricted to the activities in COCON 1.3.11G. For example, it covers:

(1) participation in meetings of the firm's governing body and its committees and other management forums;
(2) conduct in relation to internal systems, controls and operations supporting the activities in COCON 1.3.11G;
(3) conduct in relation to acquisition and management of resources used to support the activities in COCON 1.3.11G; and
(4) conduct in relation to systems and controls to monitor and control risks such as liquidity, operational, solvency, market and trading risks.

(1) Conduct of an individual is not within the scope of COCON just because it is carried on in relation to an activity of their firm that is connected to an SMCR financial activity that is carried on by the firm but that is not itself an SMCR financial activity.
(2) For example, the misconduct of the employee in the following examples is not within the scope of COCON:
1. (a) A firm's main business is to sell physical goods. It sells some of them on credit and so has permission for consumer credit. An employee steals some of the firm's stock.
2. (b) A firm's main business is to sell cars. It also sells connected insurance and so has permission for insurance distribution activities. An employee commits a serious driving offence while moving one of the cars the firm sells.
(3) However, conduct in (2) is relevant to the fitness and propriety under FIT of the employee, if the employee is subject to FIT.

(1) COCON 1.1.7FR says that the restriction of the scope of COCON to conduct in relation to a firm's SMCR financial activities under COCON 1.1.7AR does not apply to harassment or similar conduct in relation to a fellow member of the workforce. Instead, COCON 1.1.7FR(5) excludes such conduct if it clearly only relates to a part of the firm's business that does not carry on regulated activities or other SMCR financial activities, as illustrated further in the table in COCON 1.3.15G.
(2) COCON 1.3.15G gives examples of how the exclusion in COCON 1.1.7FR(5) applies to conduct of a conduct rules staff member in relation to a fellow member of the workforce when a firm has both a financial services business and a non-financial services business.
(3) The example relates to internal audit. The example corresponds to the example in SYSC 25.3.4G (Management responsibilities maps: Exclusion of non-financial services activities for some firms).

Table: Application of COCON to a firm with mixed businesses

Description of business	Whether generally within the scope of COCON
(1) F’s internal audit function covers its entire business without separating the parts that deal with its financial services business and its other business. The conduct rules staff member carrying out the misconduct and the subject of the misconduct work in the internal audit function.	The conduct is within scope.
(2) Same as (1) except that the subject of the misconduct works outside the internal audit function.	The conduct is within scope even if the subject of the misconduct works for the non-financial services part of the business.
(3) F separates the part of its internal audit function that deals with its financial services business from the part that deals with the other part of its business. Both the conduct rules staff member carrying out the misconduct and the subject of the misconduct work in the part of the internal audit function that does not deal with the financial services business.	The conduct is outside scope. It would be within scope if either the conduct rules staff member carrying out the conduct or the subject of the conduct work in the part of the internal audit function that deals with the financial services business.
(4) F’s internal audit function covers its entire business as described in (1). Within the function, certain individuals deal with the financial services business, and other individuals deal with the non-financial services business. The conduct rules staff member carrying out the misconduct deals with the financial services part of F’s business and the subject of the misconduct deals with the non-financial services business or vice versa.	The conduct is within scope.
(5) F’s internal audit function covers F’s and the rest of its group's entire business without separating the parts that deal with the group's financial services business and the group's other business. The conduct rules staff member carrying out the misconduct works in the internal audit function and the subject of the misconduct works in another company in F’s group.	The conduct is within scope.
(6) F’s internal audit function covers the whole of its group's activities. F separates the part of the internal audit function that deals with the group's financial services business from the part that deals with the other part of the group's business. The conduct rules staff member carrying out the misconduct works in the part of the internal audit function that does not deal with the financial services business. The subject of the misconduct works in another company in the firm's group.	The conduct is outside scope. It is outside scope even if the subject of the misconduct’s job involves SMCR financial activities carried out by another company in F’s group. This is because, even if the conduct relates to SMCR financial activities, it does not relate to SMCR financial activities carried on by F.
Notes
(1) When the table says that conduct is outside scope, that means that COCON 1.1.7FR does not apply and instead COCON 1.1.7AR or COCON 1.1.7BR applies.
(2) When the table says that conduct is within scope, that means that COCON 1.1.7FR applies and the conduct is within the scope of COCON unless excluded by COCON 1.1.1AR to COCON 1.1.5AR (To whom does it apply?) COCON 1.1.6R to COCON 1.1.7R (To what conduct does it apply? (Limitations in the Act)) or by COCON 1.1.8BR to COCON 1.1.11CR (Where does it apply?).
(3) See COCON 4.3.16G (Subject of the misconduct) for the meaning of the phrase ‘subject of the conduct’.
(4) ‘F’ refers to the firm for which the member of the conduct rules staff carrying out the conduct in question works.

The flow diagram in COCON 4 Annex 1 3.7G gives further guidance on how COCON 1.1.7FR works.

Benchmark firms

COCON 1.1.7FR also applies to a pure benchmark SMCR firm to which the restrictions in COCON 1.1.7BR apply. The flow diagram in COCON 4 Annex 1 3.7G gives further guidance on how COCON 1.1.7FR works for such a firm.

Point In Time

01/09/2026