‍Lessons from the Crispin Odey case part 2: is your misconduct process set up for the right risks?

The FCA’s new rules make serious workplace behaviour a clearer regulatory concern for financial services firms. For Risk and Compliance leaders, that raises a practical question: can your reporting and misconduct process identify a serious concern, get it to the right people and keep working when the person involved has significant authority?

The Odey case gives you a useful way to test that.

What did the FCA change in September 2026?

From 1 September 2026, a new FCA rule extended the Conduct Rules in non-bank firms to bullying, harassment and violence against colleagues where there is a sufficient connection to an individual’s role. The FCA estimates that the extension brings around 37,000 additional regulated firms into line with the approach already applied to banks. FCA

The FCA has also clarified how relevant non-financial misconduct can feed into fitness and propriety assessments. It expects affected firms to have considered changes to staff policies, Conduct Rule breach reporting, fitness and propriety assessments and regulatory references. FCA

For us, the implication is clear. Your non-financial misconduct rules cannot sit solely within a HR policy. Compliance needs visibility of serious concerns where they could affect individual accountability or regulatory obligations.

The Odey case shows where the process can fail

On 14 September 2026, the Upper Tribunal upheld the FCA’s decision to ban Crispin Odey from financial services after finding that he lacked integrity. It upheld all five of the FCA’s allegations against him and imposed a £1.53 million fine, reduced from the £1.83 million proposed by the FCA. Not familiar with this case? You can read all about it here. 

The Upper Tribunal decision was made under the rules applying to Odey’s conduct at the time. The September 2026 rule was not applied retrospectively. The tribunal said the case primarily concerned Odey’s lack of integrity in corporate governance. GOV.UK

That distinction makes the case more useful rather than less relevant.

Odey Asset Management had already investigated allegations concerning inappropriate behaviour towards female employees. Its lawyers produced a 68-page investigation report after 23 people had been interviewed, covering evidence relating to 46 allegations or alleged incidents. Odey received a final written warning in February 2021. GOV.UK

Further concerns followed. The tribunal eventually found that Odey twice removed executive committees that were due to consider whether he had breached that warning. It concluded that his actions were intended to frustrate the disciplinary process and avoid accountability. GOV.UK

That is the risk Compliance teams should test for.

Your process may work perfectly when the person involved is a middle manager. What happens when they are a founder, majority owner or senior executive?

Reporting is part of your control environment

The FCA’s own data shows how dependent firms are on employees raising concerns.

In its survey of 1,028 wholesale financial services firms, grievances and similar formal processes were involved in identifying 50% of recorded non-financial misconduct incidents. Whistleblowing was also an important detection route. Bullying and harassment accounted for 26% of recorded concerns and discrimination for 23%. FCA

Those figures matter because an incident you cannot see is difficult to manage. 

We recommend treating your whistleblowing channel as part of your conduct control framework. Employees need a route that can bypass the ordinary management chain when the allegation itself creates a conflict.

The FCA has also warned against assuming that fewer complaints automatically mean a healthier firm. Higher reporting volumes can reflect a culture where people believe concerns will be heard. FCA

Test your process against seniority

We would ask Risk and Compliance teams to run a simple scenario.

A credible harassment concern is raised about your chief executive.

Can the employee report anonymously? Who receives the report? Can it be routed away from people who report to the CEO? Who decides whether Compliance needs to become involved? Who controls access to the case? Can the person named in the report influence the investigation or remove the people responsible for it?

These are questions of process design.

A useful starting point is our guidance on building a misconduct reporting process and our examination of whether a whistleblowing policy can withstand a serious harassment complaint.

Make the new rules operational

The non-financial misconduct rules give Compliance teams a reason to examine the whole route from disclosure to regulatory decision.

This means that you need case records that show what was reported and what happened next. For higher-risk cases, you also need escalation routes that remain independent of the individual concerned.

The FCA has said that the primary responsibility for preventing and dealing with non-financial misconduct lies with firms. FCA

The Odey case shows why that responsibility needs working controls behind it.

The strongest test of your non-financial misconduct rules is whether the process still functions when the allegation concerns somebody with the power to interfere.

If you want to test that part of your control framework, see how Veremark’s whistleblowing software works. It gives employees a system with safe anonymous (if they wish) reporting, and it provides your team with a policy of defined roles, strong independence, and triage steps. Our community investigator model also brings real deep domain expertise through a global community - when you need it. route and gives your authorised teams a structured way to receive, manage and follow up concerns.