Every HR leader in financial services knows the choreography, even if nobody writes it down.
A complaint is made about a high performer. An investigation opens. Before it concludes, the employee resigns. A settlement is signed, with confidentiality on both sides. The reference confirms dates of employment and job title.
Six months later, the same person is doing the same job at a competitor, and the new employer has no idea there was ever a question.
The industry had a name for the result: rolling bad apples. People whose conduct problems moved with them from firm to firm, because each exit was quiet enough that the next employer never heard.
On 1 September 2026, the UK’s Financial Conduct Authority closed a large part of that route. For HR and screening professionals, inside financial services and well beyond it, the change deserves close attention, because it answers a question most hiring processes have never managed to ask.
What Changed on 1 September
The FCA extended its Code of Conduct to capture serious non-financial misconduct at non-bank firms. Around 37,000 non-bank regulated firms are now subject to clearer Conduct Rules covering serious bullying, harassment and violence, alongside new guidance on fitness and propriety.
Banks already worked under comparable standards. The change brings investment firms, asset and fund managers and insurers into much closer alignment with them.
Three features matter most for hiring.
First, the scope is wide. The misconduct does not need to relate to a protected characteristic, so the rule reaches further than discrimination law.
Second, it applies where there is a sufficient connection to work, and only to conduct on or after 1 September 2026, even if that conduct comes to light later. The rule is not retrospective.
Third, and most important for anyone who hires, NFM-related findings must now be included in regulatory references when an individual moves to another SMCR firm. Managers face their own exposure too: failing to intervene where they knew, or should reasonably have known, about misconduct may itself breach the Conduct Rules.
Why the Reference Is the Real Story
The quiet exit only ever worked because the reference stayed quiet. The regulatory reference regime is designed to stop exactly that.
Under the FCA’s SYSC 22 rules, firms exchange standardised references when senior managers and certified staff move between firms, covering at least the previous six years, with mandatory disclosure of conduct breaches, fitness concerns and disciplinary action well beyond a normal employment reference.
Firms must also revise a reference they have already given if they later learn something that would have changed it. That duty runs until six years after the person left.
The detail that ends the old choreography sits in the FCA Handbook: the obligation to supply information in a regulatory reference applies notwithstanding any agreement the rules prohibit. A settlement can no longer buy silence in the reference.
Since April 2026, the process is also faster. The first phase of SM&CR reforms cut the expected time to provide a reference from six weeks to four, and added guidance for the hardest case of all: an employee who leaves before an investigation finishes. Firms must now weigh the seriousness of the suspected misconduct, the grounds for their belief, their duty to act fairly and wider legal considerations such as privacy and employment law.
Put those pieces together, and non-financial misconduct at a regulated firm now has a forwarding address.
The Data Behind the Rule
The FCA did not act on anecdote. In February 2024 it surveyed 1,028 wholesale firms about incidents recorded across 2021, 2022 and 2023. Reported incidents rose over the period, with bullying and harassment (26%) and discrimination (23%) the most common named types.
Two further findings shape how the new rule should be read.
Discrimination cases had the highest share of incidents ending with the complainant signing a settlement or confidentiality agreement. That is the quiet exit, measured.
But substantiation is genuinely hard. 62% of reported discrimination incidents and 47% of bullying and harassment incidents were not upheld.
The regime’s focus on findings rather than accusations is not a loophole. It is the difference between a reference system and a rumour mill.
The industry signalled it was ready for the change: the overwhelming majority of firms surveyed said they would include non-financial misconduct in a regulatory reference.
The Odey Judgment
On 14 September 2026, two weeks after the rules took effect, the Upper Tribunal upheld the FCA’s ban on Crispin Odey, founder of Odey Asset Management.
The facts go to the heart of this subject. Odey faced an internal disciplinary process for breaching a final written warning about repeated and persistent inappropriate behaviour towards female employees. In response, he bullied and threatened his executive directors, then twice dismissed the executive committee, bringing the process to a halt.
The Tribunal upheld all five of the FCA’s allegations. It reduced the proposed fine from £1.83 million to £1.53 million, but left the ban intact.
What makes the case instructive for hiring is where the integrity failure landed. The finding centred on stopping anyone from reaching a conclusion about his behaviour.
That is the weak point in any reference-based system: a reference can only carry a finding that exists. The FCA’s own guidance recognises this, telling firms that wherever feasible they should conclude investigations before an employee departs, while noting that the rules themselves create no duty to investigate.
A process that never finishes produces nothing to disclose. The most effective quiet exit was never the gagging clause. It was the investigation that simply stopped.
The UK Is Tightening Around It
The FCA’s change sits inside a wider shift in UK employment law, one that reaches every UK employer, regulated or not.
Since 6 April 2026, disclosures about sexual harassment count as qualifying disclosures for whistleblowing protection, which overrides confidentiality clauses that might otherwise restrict them.
From October 2026, the Employment Rights Act 2025 raises the duty to prevent sexual harassment from “reasonable steps” to “all reasonable steps”, and makes employers liable for harassment by third parties such as customers or clients unless they took all reasonable steps to prevent it.
A further provision stopping employers enforcing NDAs that prevent workers disclosing harassment and discrimination is also in the Act, though it has no scheduled commencement date yet.
The direction is unmistakable. Silence about workplace misconduct is becoming legally expensive, and prevention is becoming a positive duty. A duty to prevent harassment sits awkwardly beside a hiring process that never asks whether a candidate has been found to have harassed anyone.
It Was Never Really About Bad Apples
“Rolling bad apples” makes the problem sound like a few rotten individuals. It is more accurately a coordination failure.
Look at the choreography again from each employer’s side. The departing firm wants a clean, fast exit and no litigation, so it settles and writes a neutral reference. The hiring firm asks for a reference, receives dates and a title, and has no basis to ask for more.
Each decision is rational. Together they guarantee the problem moves, and that the next people harmed are colleagues who had no say in any of those decisions.
No single employer can fix that by behaving better, because the incentive to stay quiet sits with the firm holding the information, while the cost lands on a firm that doesn’t have it.
What the FCA has done is change that incentive for tens of thousands of firms at once. Disclosure is now an obligation. Silence is now a breach.
That is why the change matters beyond compliance. It shows the problem was structural, and structural problems need structural answers.
Outside the Regulated Perimeter
For most employers in the world, nothing has changed. The quiet exit still works.
In the United States, many employers limit references to dates and titles out of fear of defamation claims, even though many states protect references given in good faith. The information exists. The incentive to share it doesn’t.
In India, the POSH Act created Internal Committees to investigate sexual harassment complaints, and its confidentiality provision prohibits making known the contents of complaints, the identities of the parties, the inquiry proceedings or the recommendations. Those protections exist for good reasons, above all to protect complainants. They also mean a substantiated finding at one company very rarely reaches the next.
Across the Gulf, employment references are typically brief and factual, and conduct history seldom travels at all.
Global employers face a subtler version. A manager who leaves a UK SMCR firm under a cloud and joins the same group’s office in Dubai, or a capability centre in Bengaluru, has stepped outside the regime that would have forwarded the finding.
So the gap the FCA closed for its firms remains open almost everywhere else. For those employers, conduct history only enters a hiring decision if their own screening goes looking for it, lawfully and fairly.
Silence Was a Policy Choice
The quiet exit was never an accident. It was the sum of thousands of reasonable-looking choices: settle fast, say little, ask less.
The FCA has now made a different choice for UK financial services, and the Odey judgment shows the regulator is prepared to treat obstruction of accountability as a question of integrity in its own right.
Employers outside that perimeter don’t need a regulator to make the same choice. They need a hiring process that asks the conduct question as seriously as it asks about degrees and dates, and an exit process that answers it honestly when someone else asks.
The companion playbook covers both.
