Whistleblowing
Also called speaking up, protected disclosure
Whistleblowing is the reporting of suspected wrongdoing, such as fraud, misconduct or regulatory breaches, by someone who sees it at work. Laws protect whistleblowers from dismissal or other retaliation. UK and EU rules require many regulated firms to offer confidential internal channels, and staff can also report directly to regulators such as the FCA or the SEC.
How it works
A bank runs internal reporting channels that allow confidential or anonymous reports, often through a hotline or online platform. A designated team assesses each report, investigates, protects the reporter's identity and records outcomes. In the UK, larger banks and insurers must appoint a whistleblowers' champion at board level. Staff can bypass internal routes and report directly to the regulator.
Whistleblowers often surface problems that controls miss, including mis-selling, market abuse and financial crime. Regulators treat a weak speak-up culture as a governance failing. Retaliation exposes firms to employment claims and supervisory action. In the US, the SEC pays awards of 10% to 30% of sanctions over $1 million where original information leads to a successful enforcement action.
The rules
Requires internal whistleblowing arrangements, a whistleblowers' champion and staff to be told they may report directly to the FCA or PRA.
UK banks, building societies and PRA-designated investment firms other than small deposit takers, and Solvency II insurersProtects workers who make qualifying disclosures in the public interest from dismissal and detriment.
Workers in the UKRequires internal reporting channels, feedback within three months and protection for reporters against retaliation.
Public and private entities in the EU with 50 or more workers, and all financial services firms in scope of EU lawCreated the SEC whistleblower programme, paying 10% to 30% of sanctions over $1 million and barring retaliation.
Individuals reporting securities law violations to the SECCommon questions
Can employees report directly to the FCA?
Yes. Workers do not have to use internal channels first. Firms covered by SYSC 18 must tell staff they can report to the FCA or PRA, and settlement agreements cannot stop a worker from making a protected disclosure.
What does a whistleblowers' champion do?
The champion is a senior manager responsible for overseeing the integrity, independence and effectiveness of the firm's whistleblowing policies. In the UK the role sits with a non-executive director at firms in scope of SYSC 18, and the champion reports to the board.
Are anonymous reports allowed?
Many firms accept anonymous reports and UK rules require firms to be able to handle them. The EU directive leaves it to member states whether organisations must accept anonymous reports, but anonymous reporters who are later identified still receive protection.
Are whistleblowers paid for reporting?
In the UK and EU, there are no general reward schemes for whistleblowers. In the US, the SEC and CFTC pay awards when original information leads to sanctions above $1 million, set at 10% to 30% of the amount collected.
