We have reviewed how firms have implemented our whistleblowing rules. We have published the findings, including the areas of good practice we observed and areas for improvement, together with our expectations on firms’ whistleblowing arrangements. We encourage you to review our findings and consider the steps needed to improve your whistleblowing arrangements.
August 2025 update: This review is historical. See our what we publish[1] page for more information and current views.
In June 2013, the Parliamentary Commission on Banking Standards report[2] (Changing Banking for Good) stated that the financial services sector must undergo a significant shift in cultural attitudes towards whistleblowing. In response, the FCA and PRA published new rules which became effective from September 2016.
Our whistleblowing rules[3] were designed to build on examples of good practice already found in parts of the financial services sector, and to encourage a culture where individuals felt comfortable raising concerns and challenging poor behaviour without fear of retaliation.
As reflected in our Business Plan[4], firms’ culture and governance remains a key priority for the FCA. Recent regulatory actions[5] show the seriousness with which we and the PRA consider whistleblowing failings.
Our whistleblowing rules require firms to have effective arrangements in place for employees to raise concerns, and to ensure these concerns are handled appropriately and confidentially. The requirement to appoint a whistleblowers’ champion is to ensure there is senior management oversight over the integrity, independence and effectiveness of the firm’s arrangements. These include those arrangements designed to protect whistleblowers from victimisation, and overseeing the preparation of an annual report to the firm’s governing body.
The latest stage of our supervision work reviewed firms’ approach to implementing the new rules. We included a range of retail and some wholesale banks in our work and found common themes across them.
Our expectations
The senior management and Board of firms are responsible for clearly communicating and fostering a culture that welcomes discussion and challenge, so that wrongdoing is identified early and addressed promptly to stop actual or potential harm developing.
We expect the senior management of firms to:
- oversee and ensure that their firm has fully considered and implemented effective whistleblowing arrangements
- continuously assess how the arrangements are working in practice
Firms should:
- Have up-to-date written procedures, which are readily available to employees, outlining the firm’s approach whistleblowing.
- Clearly explain that raising a whistleblowing concern to the FCA or PRA is not conditional on a report first being made using the firm’s internal arrangements and that concerns can be raised internally and to the PRA or FCA simultaneously or consecutively.
- Have a documented investigation process that explains how they progress whistleblowing cases and provide a clear and consistent approach for those responsible for operating the firm’s arrangements to follow. This should include information on how to protect a whistleblower’s confidentiality, assess and grade the significance of information provided by whistleblowers and help the whistleblowers’ champion when asked to do so.
- Document and embed their approach to preventing victimisation across their whistleblowing arrangements. This should ensure that the necessary measures and safeguards are in place to protect whistleblowers from retaliation or being otherwise disadvantaged.
- Ensure a whistleblowing report is made annually to its governing body. This report is required to ensure the firm’s governing body has ongoing oversight of the operation and effectiveness of its whistleblowing systems and controls. The annual report is required regardless of the number of whistleblowing cases reported and must maintain the confidentiality of individual whistleblowers.
- Ensure the whistleblowers’ champion has the responsibility for overseeing the production of the annual whistleblowing report and overseeing the integrity, independence and effectiveness of the firm’s whistleblowing arrangements. This includes policies and procedures on protecting against victimisation.
- Provide appropriate training for UK-based employees, managers of UK-based employees wherever the manager is based, and employees responsible for operating the firms’ internal whistleblowing arrangements. This should include the information outlined in our Handbook (SYSC18.3.4G[3]).
- Tell us promptly about contested but lost employment tribunal cases, where the claimant successfully based all or part of their claim on either detriment suffered as a result of making a protected disclosure in breach of section 47B of the Employment Rights Act 1996 or being unfairly dismissed under section 103A of the Employment Rights Act 1996.
What we looked at
Our review looked at how firms had developed and implemented their whistleblowing arrangements. This also gave us an insight into their culture. We looked at:
- policies and procedures, including the approach to protecting confidentiality and preventing victimisation
- the role of the whistleblowers’ champion
- firms’ whistleblowing annual reports
- the training arrangements for employees, managers of employees and those responsible for operating the firms’ internal arrangements
Our findings: good practice observed and areas for improvement
- The new rules are helping to ensure that firms have implemented whistleblowing arrangements and manage whistleblowing cases and concerns raised by their employees fairly, consistently and in a way which protects the individual whistleblower.
- Non-executive directors appointed as whistleblowers’ champions are providing independent oversight and accountability and helping to raise the profile of whistleblowing.
- There are examples of good practice outlined below. However, there are some key areas for improvement, most notably in the provision of whistleblowing training and the requirement to produce an annual report to the firm’s governing body.
- We also found that firms needed to better document their whistleblowing investigation process and the practical arrangements and processes for protecting whistleblowers against victimisation.
Policies and procedures
| Good practice observed | Areas for improvement |
|---|---|
| All firms had either implemented or updated existing policies and procedures following the introduction of the new rules. | Many firms had not fully implemented or sufficiently considered the SYSC18 requirements (as set out below). |
| Some firms had a detailed and step-by-step investigation process in place to help those responsible for operating the firm’s arrangements. This included a clear process on how to assess and grade information. | Most firms needed to document and enhance their investigation processes to ensure there was a consistent approach to assessing and escalating concerns. |
Some firms had a clear policy and other arrangements for ensuring whistleblowers were protected against victimisation, both during and following an investigation. For example, one firm monitored employment records for 12 to 18 months after a reportable concern had been investigated, to identify if the whistleblower had been subject to victimisation. | A number of firms needed to develop or enhance their arrangements to demonstrate how whistleblowers would be protected against victimisation. For example, some firms had not clearly documented their approach in their whistleblowing arrangements, or how this would work in practice as part of the investigation process. |
| Most firms had a clear policy and procedures in place to securely store whistleblowing information and protect the whistleblower’s confidentiality. | |
Most firms had a variety of reporting channels for employees to raise concerns. In one instance, whistleblowers had the option of giving their contact details to a third-party hotline provider, without personal details being given to the firm. This allowed a two-way dialogue and still protected the whistleblower’s identity. | Some firms had incorrectly stated that employees must first raise whistleblowing concerns internally before contacting the FCA. |
| All firms told us they would provide feedback to a whistleblower, wherever possible. The level of detail in policies and procedures varied, some covered when feedback would be provided and how much information would be given. |
Whistleblowers’ champion and the annual whistleblowing report
| Good practice observed | Areas for improvement |
|---|---|
| All firms had appointed an appropriately senior and independent whistleblowers’ champion. | Some firms were developing reports to be provided to their governing body for the first time since the whistleblowing rules became effective. |
| Most firms had met the requirement to produce an annual report for the firm’s governing body on their whistleblowing arrangements. | Some annual reports did not contain a sufficient level of information and analysis, particularly where firms had a lower volume of whistleblowing cases. |
| The whistleblowers’ champion and other senior individuals involved in the whistleblowing process were able to articulate the importance having a culture where employees felt able to speak up. | |
| Most whistleblowers’ champions had a good understanding of their role and responsibilities, including providing independent oversight of the integrity of the whistleblowing arrangements. | |
| In one firm, the whistleblowers’ champion had, in certain cases, contacted whistleblowers to determine whether they had suffered any adverse consequences or victimisation since raising the concern. | |
| Most firms had reviewed the effectiveness of their whistleblowing arrangements through second and third-line reviews. Some had commissioned third-party reviews through whistleblowing charities. A number of these reviews had been initiated by the whistleblowers’ champion. | |
| A number of firms had undertaken staff surveys to assess whether their employees understood the whistleblowing arrangements and how to raise concerns. |
Training
| Good practice observed | Areas for improvement |
|---|---|
| All the firms provided whistleblowing training to their employees. Some firms also provided annual refresher training. | Most firms needed to improve the detail provided in their training. This is needed to ensure that employees understand how to raise concerns and the firm’s approach to maintaining confidentiality and preventing victimisation. |
Some firms provided separate training for managers, and to their investigation teams. This approach helped to ensure that managers were equipped to provide the necessary management and support to those raising concerns, and that those responsible for operating the firm’s internal arrangements were undertaking investigations consistently and effectively. | Most firms did not distinguish between the training provided to all employees and the training given to managers and those operating the firms’ internal arrangements, which includes investigation teams. |
| Some firms provided training to their senior leadership teams particularly where they were involved in the assessment of cases. |