Conduct Risk

The FCA focuses on good customer outcomes and how a firm achieves this through staff conduct at all levels of the business. Conduct Risk is a keystone of regulation.

Conduct Risk refers to the risk of an individual or financial firm behaving in a way that negatively impacts market competition, causes detriment to a customer or reputational damage to the business.

Our Conduct Risk Course explains the FCA's approach to Conduct Risk as well as how to recognise and manage conduct risks in daily operations.

Start your trial Course details

50 Minutes
For all staff
Based on UK legislation, but suitable for global audiences upon the removal of UK-specific references and translation as necessary.

Learning objectives

Recognise what Conduct Risk is and the complexity of managing it
Recognise the Firm's commitment to properly conduct all aspects of our relationship with our customers
Understand how we manage Conduct Risk in our business
Understand your responsibility to ensure proper conduct

Welcome

What is Conduct Risk?

The Financial Conduct Authority (FCA)

The FCA's approach
The FCA's objectives
Exercise: What do you think?
What is Conduct Risk?
Conduct Risk issues
Principle versus risk-based regulation
The FCA's 11 Principles for Business

How is Conduct Risk defined?

How we manage 'Conduct Risk'
Exercise: Risk effects

Conduct Risk's 9 Key Drivers

Group 1 - Inherent Risks
How do we deal with Inherent Risks?
Group 2 - Structure & Behaviours
How do we deal with Structural & Behavioural Risks?
Group 3 - Environmental
How do we deal with Environmental Risks?
Exercise: Categorise the risks

Conduct Risk - the FCA's expectations

What does this mean in practice?
The focus of Conduct Risk
What does this mean for us in practice?
You make the call: Is it expected of us by the FCA?

Conduct Risk and our business

Mitigating risks
Exercise: Mitigating risks

Corporate culture

Measures against Conduct Risk
The top-down approach
Senior team responsibilities
How do we achieve this?
Scenario: Is this a good Conduct Risk culture?

Good business practice

The cornerstones of good business practice

Corporate Governance

Executive & non-executive involvement
Conduct Risk implications
How do we demonstrate effective Corporate Governance?
Systems & Controls
Examples of Systems & Controls
Demonstrating effective Systems & Controls
Scenario: Conduct Risk mitigation
Our own Systems & Controls
Effective risk management
Benefits of good business practice

Conduct Risk & the 'Customer Journey'

Conduct Risk versus TCF
Exercise: Conduct Risk or TCF?

Product Design & Governance

Product approval - new firm responsibilities
Questions at the Product Design stage
Product Design evaluation
Our Product Design & Governance
Scenario: Product design

Disclosures, Terms & Conditions

Actions to mitigate Conduct Risk
Our Disclosures, Terms & Conditions
Exercise: Disclosures, Terms & Conditions

Sales

We are all responsible
Avoiding mis-selling
How we sell
Scenario: Effective Conduct Risk mitigation

'It does what it says on the tin' - After-sales service & transaction handling

Dealing with mistakes
After-sales service & transaction handling
Scenario: After-sales Conduct Risk mitigation
Conduct Risk - Example 1
Conduct Risk - Example 2
Conduct Risk - Example 3
Conduct Risk - Example 4

Summary

Affirmation

Assessment

Your questions, answered

Risk Management

FCA Handbook

How does conduct risk differ from compliance risk?

Conduct risk focuses on behaviour and outcomes, how actions affect customers and markets - while compliance risk relates to failing to meet legal or regulatory requirements. Conduct risk is broader and more subjective, often tied to culture and ethics.

Who is responsible for managing conduct risk within a firm?

While senior leadership sets the tone, managing conduct risk is a shared responsibility across all levels, from front-line staff to compliance teams. Everyone plays a role in identifying and mitigating risky behaviour.

Can conduct risk exist in non-financial sectors?

Yes. Although the FCA regulates financial services, conduct risk principles apply across industries. Any business that interacts with customers or influences markets can face conduct-related challenges.

How can technology help reduce conduct risk?

Tools like automated monitoring systems, AI-driven analytics, and e-learning platforms can help detect risky patterns, reinforce ethical behaviour, and ensure consistent training across teams.

How often should proliferation financing risk assessments be updated?

Best practice suggests reviewing risk assessments annually or whenever there are significant changes in business operations, customer profiles, or geopolitical developments.

Why is risk scoring important for my business?

Identifying potential risks around your business is not enough. Tracking how your company manages them helps you implement policies to prevent them. The best way to get started is with a risk scoring matrix.

What is a risk scoring matrix?

A risk scoring matrix helps identify the level of risk for specific activities, such as personal data. By measuring the likelihood of something happening against how serious the consequences would be, it helps you see which areas to focus on. And what policies or procedures to put in place.

Which principle is most important in an insurance contract?

Utmost good faith is the most critical, requiring both parties to disclose all material facts. Without it, contracts risk being invalidated under UK insurance law.

What is proximate cause in insurance?

It is the dominant, effective cause of loss, not merely the last or nearest event. Courts use proximate cause to determine whether a peril covered by the policy actually triggered the claim.

How does the principle of indemnity work in real-life claims?

The principle of indemnity ensures you’re restored to your pre-loss financial state, not profiting from claims. For example, if your insured car repair costs £9,000, the insurer pays that amount, not the full policy limit.

What types of firms are regulated under CONC?

Under the Consumer Credit sourcebook (CONC), firms engaged in consumer credit activities, including lenders, credit brokers, debt management firms, and credit information services, are regulated by the Financial Conduct Authority (FCA). This encompasses a broad spectrum of consumer finance services, such as personal loans, hire purchase agreements, and credit broking.

How often should firms review their CONC compliance policies?

Firms are required to review their CONC compliance policies regularly to ensure they remain effective and up to date. While the FCA does not prescribe a specific review frequency, it is generally expected that firms assess their compliance arrangements periodically, taking into account changes in business operations, regulatory updates, and market conditions.

What triggers an FCA investigation into CONC breaches?

The FCA may initiate an investigation into potential breaches of CONC if there is evidence of widespread or repeated failures that could harm consumers. Triggers include patterns of non-compliance, consumer complaints, or findings from supervisory activities that suggest systemic issues.

What kind of staff training is required to meet CONC standards?

To meet CONC standards, firms must ensure that their staff receive appropriate training and supervision. This includes providing relevant training before employees work with reduced supervision and ensuring supervisors have the necessary technical knowledge and coaching skills.

How does insider trading affect businesses and investors?

Insider trading damages market fairness, giving some investors an unfair advantage and undermining trust. For businesses, it risks reputational harm and FCA penalties, even without personal gain. Investors face distorted prices and reduced confidence, with the FCA finding signs of insider dealing in nearly a third of UK takeovers.

What tools are used to detect insider trading?

The FCA relies on surveillance systems, transaction data, and Suspicious Transaction and Order Reports (STORs). Firms must keep insider lists and use internal trade monitoring, pre-clearance systems, and staff training.

How does the FCA regulate insider trading?

The FCA regulates insider trading under the Financial Services and Markets Act 2000, the Criminal Justice Act 1993, and UK MAR, reinforced by the Financial Services Act 2021. Sanctions include unlimited fines, injunctions, public censures, and up to 10 years’ imprisonment.

What is a Recognised Investment Exchange (RIE) and how is it regulated?

A Recognised Investment Exchange (RIE) is a UK exchange authorised by the FCA to trade securities or derivatives. RIEs must maintain orderly markets, monitor for abuse, and ensure member compliance, with the FCA supervising their operations and enforcing rules as needed.

What steps can firms take to avoid FCA penalties?

Firms can mitigate the risk of FCA penalties by establishing comprehensive compliance frameworks. This includes implementing clear policies on market abuse, conducting regular staff training, maintaining accurate insider lists, and ensuring timely submission of Suspicious Transaction and Order Reports (STORs). Additionally, firms should regularly audit their surveillance systems to detect and address any potential issues promptly.

How does the FCA monitor and detect market abuse?

The FCA employs advanced surveillance tools to monitor trading activities, including the analysis of transaction reports and order books. Firms are required to submit STORs when they suspect market abuse, and issuers must maintain insider lists. The FCA also collaborates with other regulators and uses data analytics to identify and investigate potential instances of market abuse, ensuring the integrity of UK financial markets.

What does FCA COBS stand for?

FCA COBS stands for the Financial Conduct Authority’s Conduct of Business Sourcebook, which sets out rules and guidance for how regulated firms must interact with clients, market products, and provide advice.

What is the main purpose of COBS?

Its goal is to ensure firms act honestly, fairly, and professionally in the best interests of clients, with clear, fair, and not misleading communications.

Where can I find the full COBS rules?

The complete COBS section is available in the FCA Handbook, which is updated frequently.

Who needs to comply with COBS rules?

Any FCA‑regulated firm carrying out designated investment business, ancillary services, or insurance‑related activities in the UK, including advisers, brokers, wealth managers, and investment platforms must comply.

Who do the FCA Principles apply to?

They apply to all FCA‑regulated firms and individuals performing controlled functions, regardless of size or sector.

How are the FCA Principles enforced?

The FCA enforces the Principles through regulatory, civil, and criminal powers, including fines, public censures, and prohibitions. Their approach is detailed in the FCA Enforcement Guide.

What happens if a firm fails to notify the FCA of an issue?

Firms are required to notify the FCA promptly of any matters that could have a significant adverse impact on their ability to meet regulatory requirements. Failure to do so can result in enforcement action, including fines or other sanctions.

How can firms ensure compliance with the FCA Principles?

Firms can ensure compliance with the FCA Principles by implementing robust governance frameworks, conducting regular risk assessments, and maintaining effective internal controls. This includes establishing clear policies and procedures, providing ongoing staff training, and fostering a culture of compliance throughout the organisation.

How often should FCA Code of Conduct training be refreshed to remain effective?

Firms should refresh Code of Conduct training at least annually, or more frequently if there are significant regulatory updates, changes in business processes, or lessons learned from compliance breaches. Regular refreshers help maintain awareness and reinforce the expected behaviours across the organisation.

How can firms tailor Code of Conduct training for high‑risk business areas?

Training should be customised to reflect the specific risks and responsibilities of high-risk areas, such as trading desks or advisory teams. This can include scenario-based exercises, role-specific guidance, and practical examples relevant to the department’s day-to-day activities, ensuring staff understand the real-world implications of the Conduct Rules.

What tools or technology can support ongoing compliance monitoring?

Firms can leverage compliance monitoring software to track employee behaviour, trade activity, and adherence to policies. This includes workflow tracking, automated alerts, data analytics, and communication surveillance systems to identify potential breaches quickly and efficiently.

What steps can be taken to rebuild trust after a breach of the Conduct Rules?

Rebuilding trust requires transparency, accountability, and proactive remediation. Firms should promptly investigate the breach, implement corrective measures, communicate clearly with stakeholders, and enhance training and oversight to prevent recurrence. Demonstrating a strong culture of compliance and ethical behaviour is key to restoring confidence among clients, staff, and regulators.

Who needs to comply with CASS rules?

Any firm regulated by the FCA that holds or controls client money or assets must comply with CASS rules. This includes investment firms, asset managers, and certain insurance intermediaries.

How often should firms review their CASS compliance procedures?

Firms should review their procedures at least annually, or whenever there are changes in regulation, business structure, or risk exposure. Regular internal audits and gap analyses are recommended.

What role does staff training play in CASS compliance?

Training is critical. Staff must understand their responsibilities under CASS, know how to handle client money and assets correctly, and be able to identify and escalate potential breaches.

Which FCA compliance topics are covered?

Skillcast supports financial-services learning in areas including Consumer Duty, SM&CR, Conduct Rules, financial crime, fraud, financial promotions, vulnerable customers, complaints, CASS, COBS, CONC, MCOB, operational resilience, data protection and information security.