The Legal and Regulatory Framework

Legal Protection for Whistleblowers

Workers in the UK who make protected disclosures are protected from detriment and unfair dismissal under the Public Interest Disclosure Act 1998, which amended employment law to give that protection. Disclosures can be made internally to the employer, or externally to prescribed bodies, which include the FCA and the PRA.

The Regulators’ Whistleblowing Rules

On top of the legal protection, the FCA and PRA have their own whistleblowing rules, set out for FCA purposes in SYSC 18. These require relevant firms, including banks, building societies with significant assets and larger insurers, to:

• have internal arrangements that allow any person to raise concerns, including anonymously
• handle concerns effectively and protect people who raise them from victimisation
• tell staff that they can report concerns directly to the FCA or PRA, and that they don’t need to use internal channels first
• make sure settlement agreements and employment contracts don’t prevent people from making protected disclosures
• appoint a whistleblowers’ champion.

Other regulated firms aren’t required to follow all of these rules, but the FCA encourages them to treat the rules as good practice. In practice, many firms of every size now adopt them, because supervisors look at whistleblowing arrangements when they assess culture.

The Whistleblowers’ Champion

Where the rules require one, the whistleblowers’ champion is typically an independent non-executive director. Their role is to oversee the integrity, independence and effectiveness of the firm’s whistleblowing policies and procedures, including how the firm protects people who raise concerns. It’s an oversight role: the champion doesn’t usually investigate concerns personally, but makes sure the arrangements work and reports on them to the board.

The champion also has a role under the Senior Managers regime. Where the firm has a whistleblowers’ champion, they are allocated the associated responsibility, which becomes part of their accountability to the regulator. For firms where the champion is also a Senior Manager, such as a committee chair, the responsibility sits in their Statement of Responsibilities.

A good whistleblowers’ champion is independent of the executive, trusted by staff, willing to challenge management and familiar enough with the business to recognise when a concern points to a wider problem.

What Good Arrangements Look Like

Several Routes to Raise a Concern

People should be able to raise concerns with their line manager, a designated internal contact, the whistleblowers’ champion or an external hotline, and directly with the regulators. Anonymous reporting should be available, because some people won’t speak up otherwise.

Proper Handling

Concerns should be logged, assessed promptly, investigated by someone independent of the area concerned and closed with a clear outcome. Where possible, the person who raised the concern should be told what happened, even if detail has to be limited.

Protection From Detriment

Firms should watch for signs that someone who raised a concern is being treated unfairly, whether through their performance ratings, their pay, their prospects or their relationships with colleagues. Victimisation is one of the fastest ways to destroy trust in the process.

Board Oversight

The board, usually through the whistleblowers’ champion or the audit or risk committee, should receive regular reports on the number and nature of concerns, how they were handled, outcomes and any themes. A sudden fall to zero reports is as much a warning sign as a sharp rise.

Learning From Themes

Individual concerns often point to wider problems: a weak control, a difficult manager, a sales practice that’s drifting. The most valuable whistleblowing arrangements feed those themes into the firm’s risk management and culture work.

The Role of Senior Managers

Whistleblowing isn’t only the champion’s concern. Every Senior Manager is subject to the Conduct Rules, including requirements to act with integrity, to be open with the regulators and to take reasonable steps to make sure the business they’re responsible for is controlled effectively. A Senior Manager who discourages concerns, fails to act on them or tolerates victimisation in their area is exposed.

Senior Managers should make sure their own teams know how to raise concerns, respond constructively when they do, and escalate serious matters promptly. Control function holders, such as compliance oversight and MLROs, often receive concerns first and need clear routes to the board.

Common Failings

• Policies without practice. Well-written policies that staff don’t know about or don’t trust.
• Handling by the wrong people. Concerns investigated by the manager whose area they concern.
• No feedback. People who raise concerns never hear what happened, and conclude nothing did.
• Restrictive agreements. Settlement agreements or contracts drafted in a way that appears to discourage protected disclosures.
• A passive champion. A whistleblowers’ champion who receives reports but doesn’t test whether the arrangements actually work.
• Ignoring themes. Treating each concern as isolated rather than looking for patterns.

Whistleblowing and Culture

Regulators treat speaking up as a barometer of culture. A firm where people feel safe raising concerns is more likely to catch problems early, and more likely to be trusted by its supervisors. Boards that want to understand their culture should look at whistleblowing data alongside staff surveys, exit interviews, complaints and conduct breaches, and ask what the combined picture tells them.

This links closely to the Consumer Duty. Many concerns raised by staff relate to how customers are treated, and a firm that listens to its people is better placed to spot poor customer outcomes before they become systemic.

Choosing a Whistleblowers’ Champion

Because the champion is normally an independent non-executive, choosing the right person is a board appointment question. The strongest candidates combine independence, credibility with staff, experience of investigations or risk oversight, and the confidence to challenge the executive. Where the board lacks someone suitable, recruiting an additional independent non-executive may be the right answer. NED Capital, a sister practice of SMF Capital, specialises in non-executive and board appointments, and SMF Capital recruits where the role carries a Senior Manager Function, such as the Chair or a committee chair.

A Checklist for Boards

• Does the firm need a whistleblowers’ champion under the rules, and if not, would appointing one be good practice?
• Do staff know how to raise concerns internally and with the regulators?
• Are concerns investigated independently and closed with a clear outcome?
• Is there any evidence of detriment to people who have raised concerns?
• Does the board receive regular, meaningful reports, including themes?
• Are settlement agreements and contracts consistent with protected disclosures?

The Bottom Line

Effective whistleblowing arrangements protect customers, markets and firms. They depend less on policy documents than on how the board, the whistleblowers’ champion and every Senior Manager respond when someone speaks up. Firms that get this right usually hear about problems early, when they’re easiest to fix. For more on the accountability that comes with senior roles, see the Senior Manager Functions guide from SMF Capital.