Third-party harassment: what changes on 30 October
From 30 October 2026, your firm can be liable when a client, investor, supplier or anyone else outside the firm harasses one of your staff. The Employment Rights Act 2025 brings this in, and the commencement regulations confirming the date have now been made (HR Connect).
Most commentary has been written for retail, hospitality and schools. It matters just as much to a small fund manager or advisory firm. Your people spend their working lives with clients, investors, placement agents and service providers, often at dinners, conferences and roadshows where the usual office controls don't reach.
It also lands eight weeks after the FCA's non-financial misconduct rule reached firms outside banking. Taken together, the two regimes now cover how your staff treat each other and how outsiders treat your staff.
What the new duty says
An employer will be liable if a third party harasses an employee in the course of their employment and the employer did not take all reasonable steps to prevent it. A third party is anyone who is not the employer or one of its employees. Acas lists customers, clients, contractors, people at conferences and events, and members of the public, and confirms harassment can happen online as well as in person (Acas).
Three features make this harder than it sounds:
- Any protected characteristic. It is not limited to sexual harassment. Harassment related to race, religion, disability, age, sexual orientation or any other relevant characteristic is covered.
- One incident is enough. There is no need for repeated conduct, and no need for the firm to have known about earlier incidents (CMS).
- "All" reasonable steps. The same date raises the existing duty to prevent sexual harassment from "reasonable steps" to "all reasonable steps". A firm has to be able to show there was nothing further it could reasonably have done.
The employee's remedy is a claim in the employment tribunal. What counts as reasonable depends on the firm's size, sector and the work its people do, so a ten-person firm is not expected to act like a bank. It is expected to have thought about the risk and acted on it.
How it fits with the FCA's non-financial misconduct rule
Since 1 September 2026, serious bullying, harassment and violence towards colleagues has been a Conduct Rules matter for SM&CR firms outside banking. That is a regulatory obligation on your own people, and it feeds into fitness and propriety assessments and regulatory references.
The new duty runs the other way. It is an employment law obligation on the firm, owed to its staff, about the people they deal with from outside. A firm can have a clean record under the FCA rule and still be exposed in the tribunal because a client harassed an analyst at an investor dinner and nobody had thought about it.
It also works in reverse. When your people visit a client or a service provider, they are the third party. Conduct that puts another firm in breach is exactly what ends commercial relationships, and it is likely to be weighed in any assessment of that individual's fitness and propriety.
The practical answer is to treat the two together: one policy, one reporting route, one training programme and one record, rather than an FCA document and a separate HR document that contradict each other.
What a small regulated firm should do before 30 October
None of this needs a project team. For most firms it is a few days' work, and the record of having done it is what matters if a claim arrives.
- 1.Map who your people deal with. Clients, investors, placement agents, brokers, administrators, IT contractors, landlords' staff. Note the settings where things go wrong: after-hours events, travel, alcohol, lone meetings, chat and video channels.
- 2.Add third-party harassment to your risk assessment. Record each risk, what you are doing about it, and who owns it. Where you decide a step is not reasonable for a firm of your size, write down why. Acas specifically suggests this (Acas).
- 3.Update the bullying and harassment policy. Name third parties expressly, cover all protected characteristics, and say what the firm will do if a client or supplier is the problem, up to ending the relationship.
- 4.Tell staff how to report it, and mean it. A named person, a route that does not run through the line manager if the manager is part of the problem, and a clear statement that nobody will be penalised for raising a concern about an important client.
- 5.Look at your terms. Client and supplier terms can require counterparties to respect your harassment policy and let you exclude individuals who do not.
- 6.Train people, and keep the evidence. Training is one of the steps every published guide expects. Make it specific to client-facing work, refresh it, and keep a record of who completed it and when.
- 7.Put it in front of the board. Note the change, the actions taken and who is responsible in the next board minutes.
Training that already covers it
Our Non-Financial Misconduct Awareness course was written for the FCA rule in force since 1 September and covers the third-party harassment duty from 30 October. It deals with the seriousness threshold, where work ends and private life begins, and what to do when someone confides in you or complains about you. Like every course in our catalogue, it is CPD assessed, takes about 45 minutes, and issues a named certificate.
It sits in the Fundsure Portal alongside the other 19 courses, scheduled and chased for you, with a record you can show a tribunal, an auditor or the FCA. Every course is included at £120 per person per year plus VAT.
To see it before you buy, ask us for a demo link. You can work through the full course and see a sample certificate before deciding.