"Keep It Between Us": The Two Decisions That Could Put You in Breach

I need to tell you something, but I need you to promise me first that it stays with you. Just you. If it goes anywhere it'll follow me, so if you can't promise that, I'm not going to say it."

It is 4:38 on a Thursday afternoon when one of your analysts closes your door and sits down. She is calm, and she means it. You have about five seconds to decide.

Refuse, and she may walk out and tell nobody. Whatever is happening carries on happening. A principled refusal that leaves a problem undisturbed protects your paperwork and nothing else, and you will have taught the most frightened person on your desk that coming to you achieved nothing. That is a real cost. Backing out of the conversation entirely so your hands stay clean isn't neutrality. It's wilful blindness.

If you say yes, there are only two roads. Either you break the promise, and she - along with everyone she tells about it afterwards - learns exactly what your word is worth at the worst possible moment. Or you keep it, and you own whatever you've just heard, alone, with a duty you can't discharge and a problem she's no closer to escaping.

Take a moment before you read on. Would you promise? Should you?

For the sake of this scenario, let's assume you say yes, so we can go deeper.

She says that the man who runs the desk - a desk head who holds a senior management function - has spent three months making her working life unbearable. Comments. Messages. The kind of thing that has a name, and the name is sexual harassment. She is specific, and she is credible. What she doesn't know is that this morning you received a regulatory reference request for that same desk head, who resigned three weeks ago, is working his notice and is off to a bigger job. His new employer wants to know, in the ordinary box-ticking way, whether there's anything they should know. You planned to sign it on Friday and think no more about it.

This is where the trap seems to close, because now your own conduct rules sit behind both doors.

Your first option is to go quiet: sign the reference the easy way, and in doing so breach your transparency duties. If you're a senior manager yourself, Senior Manager Conduct Rule 4 requires you to disclose appropriately any information the regulator would reasonably expect notice of, and serious misconduct bearing on another senior manager's fitness is exactly that. Individual Conduct Rule 3 - to be open and cooperative with your regulators - points the same way. Silence isn't neutral. It's a breach.

So you resolve to be transparent, and then Individual Conduct Rule 1, integrity, sits up. It feels as though transparency means breaking your word to someone who trusted you, and pulling a frightened junior into the process she begged to avoid; subjecting someone to detriment for speaking up can itself breach that rule.

Three conduct rules, and they seem to be pulling in opposite directions.

Take another moment - what would you actually do now?

_____________

So firstly, don't say no. Change what's on offer, immediately, before she commits:

"I want to hear this, and I won't promise you something I'd have to break; you deserve better than that. Here's what I can promise. I'll take it seriously. I'll keep it as tight as I possibly can and share it only with people who genuinely need to know. You will not be punished, sidelined or moved for telling me; I'll put my name to that. And I won't do anything without telling you first. No surprises, ever."

Most people, given honest terms, still talk. What frightens them is usually not that a process might follow - it's losing control of it and being blindsided. Confidential and secret are not the same thing, and saying so out loud is often the sentence that unlocks the conversation.

If she still declines, that isn't a failed conversation. Point her to the routes that don't depend on you - the whistleblowing line, compliance, the anonymous channel - and leave the door open. Write down that day what you were told and what you offered. You may already hold enough, on your own, to owe someone a phone call.

And if you already promised, because most of us would have? You go back to her, today, and you tell her you got it wrong. That you shouldn't have promised something that wasn't yours to give, that you're sorry, and that here is what has to happen now and what you will do to protect her while it does. That conversation is horrible. It is still far better than the alternative, which is her finding out from somebody else that your word was worth nothing.

Once she tells you, do you keep it in the room, or take it to the regulator?

The trap works by letting you believe integrity means keeping your word whatever it costs. Individual Conduct Rule 1 isn't a rule about being a good friend; it's about honesty and propriety in a regulated role, measured against your regulatory duties, not against a promise you had no authority to give. This is where stage one pays for itself: handled honestly, there is no promise of silence to agonise over, because you never made one.

And the second half of the trap misreads one word: detriment. She is protected from detriment for having spoken up - being sidelined, punished, quietly managed out. Escalating what she's told you, while shielding her identity and guarding her role as far as you can, isn't detriment if it's managed properly.

Materiality to fitness and propriety is the hinge. Serious harassment by an approved senior manager about to step into a bigger role is about as material as it gets, and it engages a hard deadline: the firm must inform the FCA as soon as practicable and in any event within seven business days. Note whose duty that is. The seven days belong to the firm, not to you personally, and the way you discharge your part is by escalating so the firm can meet it. What you cannot do is sit on it so that the firm never starts the clock. A genuinely trivial, one-off, resolved misunderstanding is a different question. Seriousness drives the size of the duty.

An approved senior manager triggers a notification duty on the firm, and that duty doesn't wait for proof: material information can include an untested allegation, treated with appropriate caution and revisited when the outcome is known. The reference is different. What goes into a regulatory reference is what the firm has concluded, and disciplinary action it has taken, not what it currently suspects. So the answer on Friday isn't to sign it clean, and it isn't to sign it damning. It's not to sign it on Friday. What you can't do is leave it unanswered, because you have a limited window to respond and it is shorter than most people assume. Use that window: investigate, and disclose what the firm has actually concluded by the time the reference has to go. If the investigation concludes something disclosable after that, you update the reference. That duty runs for years after someone leaves, which is exactly why you are not forced to choose between a false reference and a premature one.

One other thing worth knowing. SYSC 22 doesn't itself oblige firms to investigate a former employee, but the guidance sets out why a firm often should, and one reason is to satisfy itself that the senior manager responsible for the area where the misconduct happened took reasonable steps to prevent it or stop it. Read that again, because it points somewhere uncomfortable. If this ran for three months on one desk, the investigation isn't only about him. It is also about whoever was managing that desk while it happened. The same guidance says a firm should, wherever feasible, finish its investigations before the employee leaves. This one didn't.

One more rule is in play, and from 1 September 2026 the FCA spells out for the first time what it means for managers. Individual Conduct Rule 2 requires due skill, care and diligence, and the new guidance sets out what that looks like when a complaint reaches you: take it seriously, operate the firm's policies, and provide an environment where people can raise concerns. You don't have to get the outcome right. You do have to act reasonably, and "she asked me not to" has never been a reasonable step. That guidance isn't in force yet. It comes into force on 1 September, and the conversation it describes could happen on any Thursday between now and then.

What you promised in stage one and what you owe her now line up. Identity protected as far as humanly possible. No change to her role that she hasn't agreed to. And no surprises: she hears from you, before it moves, what is going where and why. Don't make her worse off for speaking. Cutting her out, moving her off the desk, letting her review slip can amount to detriment for raising a concern and can breach the integrity rule. Making the problem disappear by making the person disappear is a second breach on top of the first.

Most of what protects everyone was decided long before this afternoon: a culture where she felt able to walk in, a speak-up route that doesn't punish its users, managers who know disclosure duties can't be signed away, a reference process that survives a settlement negotiation.

In the moment:

• Talk to compliance, HR and legal before you do anything else. This is the first move, not the last.

• Escalate what's material so the firm can meet its notification duty inside its window. That duty was never yours to waive with a promise of silence.

• Don't sign the reference on Friday, but don’t leave it unanswered either. Check your deadline, investigate inside it, disclose what the firm has concluded by then, and update it afterwards if the investigation finds more.

• Don’t shelve this until September. Only the manager guidance waits. The notification duty, the reference and the integrity rule all apply today.

• Scope the investigation properly. It covers his conduct, and it covers whether the managers above him took reasonable steps.

• Protect her identity as far as possible, and make no change to her role she hasn't agreed to.

• Record what you were told, what you did and why - a "why" that stands up without the flattering light of hindsight.

• Keep your stage-one word: she hears it from you first.

The honest bottom line is that there were two decisions, and only the first one was ever genuinely difficult. After that there is no real choice left. No private plea, however sympathetic, and no confidentiality clause, however well drafted, entitles you to withhold material information about a senior manager's fitness from the regulator. The conduct rules aren't a trap that forces you to breach one to satisfy another; they're built to point the same way. The only thing that manufactures a dilemma is treating what you owe a person and what you owe the regulator as if they sat on the same scales.

Which is why the whole thing turns on whether you were honest about what you could carry. The manager who gets that right never has to choose between their people and their approval. The manager who buys the information with a promise will end up breaking one or the other.

If you enjoyed thinking through the dilemmas in this scenario, you'll love the over 1,000 scenarios - that, just like this one, you need to be ready for - to be found in our MAR360 Academy "Certification in Market Abuse" training course here, which includes a specific module built for the FCA's changes coming into force on 1 September 2026.

_____________

This article is for general information and training purposes and does not constitute legal advice. Specific situations should always be referred to your compliance, HR and legal teams.