FCA Compliance Training: Requirements Every Regulated Firm Should Know in 2026

The FCA issued over £176 million in fines in 2024 alone - a 230% jump on the year before. Most of the firms penalized had training programmes on paper. The FCA's concern wasn't the absence of training. It was the absence of effective training, and the absence of any evidence that staff actually understood their obligations.

That's the distinction that matters in 2026. Regulatory expectations around FCA compliance training have expanded across SMCR, Consumer Duty, and Conduct Rules - and a fourth requirement, covering non-financial misconduct, takes effect in September. This guide covers what each framework requires, where firms are falling short, and how to build a programme that actually satisfies the regulator.

1. What Is FCA Compliance Training?

FCA compliance training covers everything a regulated firm's staff must learn to meet the Financial Conduct Authority's expectations - conduct standards, individual accountability, customer outcome obligations, and financial crime prevention. It isn't a single course or annual exercise. It's an ongoing programme spanning multiple regulatory frameworks.

The FCA doesn't prescribe a format. What it does require is that firms ensure staff are competent to perform their roles - the 'competent employees rule' in SYSC 5.1 of the FCA Handbook. For regulated activities involving retail clients, more detailed requirements apply under the Training and Competence Sourcebook (TC).

In practice, the programme covers four main pillars in 2026: SMCR obligations (Senior Managers, Certified Persons, and Conduct Rules staff), Consumer Duty (staff understanding of customer outcome obligations), Conduct Rules (the five Individual and four Senior Manager rules), and from September 2026, non-financial misconduct under the extended COCON. Financial crime training - AML, sanctions, fraud, and market abuse - sits alongside these as a separate obligation of equal weight.

FCA Handbook Reference

SYSC 5.1.1R - Competent Employees Rule

"A firm must employ personnel with the skills, knowledge and expertise necessary for the discharge of the responsibilities allocated to them."

Source: FCA Handbook, SYSC 5.1 - applies to all UK-authorised firms, including wholesale firms.

2. Which Firms Need FCA Compliance Training?

All FCA-authorised and registered firms have training obligations. The scope and depth vary by firm type, size, and the activities it carries out - but no regulated firm is exempt.

Under SMCR, firms fall into three categories: Limited Scope, Core, or Enhanced. Enhanced firms - larger, more complex organisations - carry the most detailed requirements. Core firms cover most FCA-regulated businesses: banks, insurers, investment firms, payment services providers, and financial advisers. Limited Scope firms face lighter requirements but remain subject to Conduct Rules training.

Consumer Duty training requirements apply to all firms distributing products or services to retail customers. Financial crime training applies to any firm within the regulated sector under the Money Laundering Regulations 2017 - and non-compliance is a criminal offence, not a regulatory breach.

3. SMCR Training Requirements in 2026

The Senior Managers and Certification Regime is the FCA's framework for individual accountability in financial services. Every person performing a regulated function - from the CEO to a junior certified staff member - sits somewhere in the SMCR structure, and each category carries distinct training obligations.

Senior Managers (SMF holders)

Senior Managers hold one or more Senior Management Functions approved by the FCA. Training for this group must cover their Statements of Responsibilities, the four Senior Manager Conduct Rules (SM1-SM4), and what 'reasonable steps' actually looks like when something goes wrong. Personal liability follows Senior Managers - a point reinforced by multiple FCA enforcement actions in 2024 and 2025. They need to understand this clearly, not in abstract terms.

Certified Persons

Certified staff perform functions listed as FCA Certification Functions under SYSC 27. Firms must assess their fitness and propriety and issue certificates annually. Training must support that ongoing competence assessment throughout the year - not just at onboarding and forgotten. The FCA expects evidence that certified staff stay competent and current. A one-off module checked off twelve months ago doesn't demonstrate that.

Conduct Rules Staff

All other staff subject to the Conduct Rules - which covers the majority of most firms' workforces - must receive training on how the five Individual Conduct Rules apply specifically to their role. Generic training isn't acceptable here. The FCA has been explicit: rules must be mapped to individual job functions, and training must be proportionate and role-relevant.

Regulatory Reference

Section 64B FSMA 2000 - Conduct Rules Training

"Authorised persons must ensure that persons who are subject to the conduct rules are provided with training about how those rules apply to the persons concerned in the performance of their functions."

Source: Financial Conduct Authority - SM&CR

What PS26/6 Means for Training in 2026

The FCA's Phase 1 SMCR reforms (PS26/6, live from 24 April 2026) introduced several procedural changes - extending criminal record check validity, adjusting SMF application timelines, simplifying some certification overlap. The reforms also removed the prescriptive requirement for firms to conduct mandatory training on Conduct Rules.

That's where firms need to be careful. Removing the prescriptive requirement doesn't reduce the underlying expectation. The FCA has been clear: firms remain responsible for ensuring staff understand and apply the rules. PS26/6 gives flexibility in how that training is delivered. It's not a green light to cut it.

Don't misread PS26/6

PS26/6 removes some administrative requirements but does not reduce core accountability standards. The FCA has been explicit: 'accountability remains unchanged.' Firms that treat these reforms as permission to reduce training programmes are misreading the regulation.

4. Consumer Duty Training Obligations

Consumer Duty came into force in July 2023. In 2026, the FCA has moved from implementation to scrutiny. It now expects firms to demonstrate that staff aren't just trained on Consumer Duty - they genuinely understand it and apply it in their daily work.

The FCA's 2025-2026 priority areas explicitly include 'embedding the Duty and sharing good practice,' with multi-firm reviews assessing implementation across product design, customer journeys, communications, and outcomes monitoring. Supervisory visits now include questions about how staff training supports the Duty. This is not a compliance checkbox anymore.

What Consumer Duty Training Must Cover

The Duty is built around four outcomes: products and services, price and value, consumer understanding, and consumer support. Training for staff in customer-facing, advisory, and product roles must address each of these and make clear what a 'good outcome' looks like in practice for that specific role.

The numbers here are worth sitting with. The FCA's 2024 Financial Lives Survey found that 12% of UK adults - approximately 6.3 million people - had limited understanding of the products they held. That's the problem Consumer Duty training is designed to address. And it's why the FCA is scrutinizing embedding so closely in 2026.

The FCA's March 2026 review into consumer understanding found that firms doing this well were using call listening, complaints data, and chat transcripts to identify where customers struggle - and updating training accordingly. Training can't be static. Consumer Duty requires a feedback loop between customer outcomes data and training content. Build it in from the start or you'll be retrofitting it later under pressure from a supervisory visit.

2026 Consumer Duty priority

The FCA expects firms to have moved beyond 'we have implemented the Duty' to actively demonstrating they are 'living and breathing it.' Board-level oversight of Consumer Duty training outcomes is now a supervisory expectation, not a nice-to-have.

5. Conduct Rules Training: Timelines, Scope, and Evidence

The five Individual Conduct Rules and four Senior Manager Conduct Rules form the behavioural backbone of the SMCR. Training on these rules isn't optional - it's a statutory requirement under Section 64B FSMA 2000. There's no carve-out and no ambiguity.

Training must enable staff to recognize when the rules apply to their specific role, identify what a breach looks like in practice, and understand their obligations to report concerns. If a Senior Manager breaches the Conduct Rules, the FCA expects firms to report within seven working days. Other staff breaches go through the annual reporting process unless severity demands earlier notification.

The FCA's evidence expectations have tightened. Firms should maintain records showing not just that training was completed, but that it was role-specific, assessed for understanding, and refreshed regularly. A screenshot of 100% completion for an annual module no longer satisfies this standard. The regulator has seen that approach fail too many times.

6. Non-Financial Misconduct: The September 2026 Requirement

From 1 September 2026, the FCA's Code of Conduct (COCON) will explicitly capture serious non-financial misconduct - including bullying, harassment, sexual misconduct, and violence - at all FCA-authorised firms, not just banks. This is one of the most significant expansions of the Conduct Rules in years.

The new rule (COCON 1.1.7FR, published in PS25/23) makes clear that unwanted conduct which violates dignity or creates an intimidating, hostile, or offensive working environment may constitute a regulatory breach when sufficiently serious. It doesn't create a new standalone conduct rule. Instead, it extends the application of Individual Conduct Rules 1 (integrity) and 2 (due skill, care, and diligence) to cover this category of behaviour.

Regulatory Reference - effective 1 September 2026

COCON 1.1.7FR - Non-Financial Misconduct

"Serious non-financial misconduct - including work-related bullying, harassment, and violence - will fall within the scope of COCON for non-bank firms, such that it may constitute a regulatory breach."

Source: FCA PS25/23 - Non-Financial Misconduct

For training, this is concrete. Firms must update staff training to cover the expanded COCON scope. Managers in particular need bespoke training - they're held to a 'reasonable steps' standard for preventing and addressing non-financial misconduct in their teams. Failing to take reasonable steps after becoming aware of misconduct can itself constitute a breach of Conduct Rule 2. That's personal liability territory for managers, not just a policy issue.

Action needed before 1 September 2026

Update anti-bullying and harassment policies to align with the new COCON scope. Notify all Conduct Rules staff of the changes. Deliver updated training - with bespoke modules for managers - before the implementation date. This runs alongside the Worker Protection Act 2023 duty (requiring 'all reasonable steps' to prevent sexual harassment, effective October 2026).

7. Common FCA Training Failures - and the Enforcement Cost

The FCA's enforcement record is the clearest signal of where training programmes are falling short. In 2024/25, total financial penalties hit £186 million - a 337% increase on the prior year. Of 130 open FCA enforcement cases as of July 2025, 75 related to financial crime. These aren't outlier firms. They're regulated businesses that thought their training was adequate.

Two recent cases show the pattern clearly.

Starling Bank was fined £29 million in October 2024 for financial crime control failures the FCA described as 'shockingly lax' - including a misconfigured sanctions screening system that had been running for years. Staff training and awareness had drifted while the business scaled. Monzo was fined £21 million in July 2025 for AML control failures during rapid growth, including opening over 34,000 high-risk accounts in direct breach of FCA orders. The FCA specifically noted that Monzo's compliance infrastructure failed to keep pace with its business growth. Every scaling firm should absorb that warning.

Financial crime training isn't a tick-box exercise completed at onboarding. It requires continuous reinforcement as products evolve, customer volumes increase, and typologies change. The firms being fined aren't the ones that never trained their staff. They're the ones that stopped keeping up.

What the FCA found in AML enforcement

The FCA's 2024 Financial Crime Guide update emphasised that senior management must be 'sufficiently aware of sanctions obligations to discharge their functions effectively.' Training runs all the way to the board.

8. How to Build an FCA-Compliant Training Programme in 2026

An FCA-compliant training programme isn't a single annual course. It's a structured, role-mapped, evidence-generating system that runs continuously. Here's what the FCA expects firms to have in place.

• Map your population against the regulatory frameworks. Identify which staff fall into each SMCR category - Senior Managers, Certified Persons, Conduct Rules staff - and which are subject to Consumer Duty and MLR 2017 obligations. Document this mapping; the FCA may request it during supervisory visits.
• Conduct a training needs assessment by role. Generic training isn't sufficient. Each job function requires a distinct view of which rules apply, what those rules mean in daily practice, and what a breach looks like in context.
• Cover all four compliance pillars. Your programme must address SMCR obligations, Consumer Duty, Conduct Rules (including NFM from September 2026), and financial crime. Gaps in any pillar are gaps in your regulatory defence.
• Deliver training continuously, not annually. Annual refreshers don't reflect how regulations evolve - or how quickly staff forget. Short, frequent sessions maintain knowledge retention and allow rapid deployment when new guidance drops.
• Build an audit-ready evidence trail. Completion records must be accessible, role-specific, and timestamped. Go further: record assessment results, track who received refresher training when regulations changed, maintain records of how training was updated following new FCA guidance.
• Build in a process for regulatory updates. In 2026 alone, firms face PS26/6 SMCR changes in April, non-financial misconduct COCON expansion in September, and the Worker Protection Act duty in October. Aim to update content within four to six weeks of new guidance being published.

9. Why Microlearning Outperforms Annual E-Learning for FCA Compliance

The standard annual compliance module has a fundamental problem: it asks staff to absorb a year's worth of regulatory obligations in one sitting, then ignores knowledge decay for the next 364 days. The FCA doesn't assess firms on whether they ran an annual course. It assesses whether staff demonstrate ongoing competence and whether controls are working.

Platforms like 5Mins take a different approach - delivering bite-sized, TikTok-style lessons that staff complete in five minutes or less, every day. The outcome is continuous reinforcement rather than periodic tick-boxing. Firms across financial services using 5Mins report 95%+ completion rates, compared to under 5% for traditional LMS annual modules. More importantly, the knowledge sticks - because the content is role-specific and delivered in the flow of work.

For firms managing SMCR, Consumer Duty, and AML obligations simultaneously, the ability to auto-enrol staff on updated content the week new FCA guidance drops - and generate a real-time compliance dashboard for the next supervisory visit - isn't just operationally convenient. It's the difference between being prepared and being penalised.