The regulatory landscape for whistleblowing has changed dramatically in the lead-up to and during the pandemic. How does this affect the way you should conduct whistleblower investigations – and handle their findings?
With the regulators’ interest in non-financial misconduct alongside the fitness and propriety of senior managers continuing to grow during the current pandemic, and amidst the strains that many of us feel in having to adapt to new ways of living and working, we expect firms will continue to see difficult issues raised by whistleblowers during the year ahead. Investigating sensitive allegations and managing the output from these investigations requires a different approach and mindset from more traditional corporate internal investigations.
What has the Covid-19 pandemic meant for whistleblowing?
With many of us working remotely some or all of the time, the pandemic has inevitably meant a change in the way colleagues relate to each other.
The FCA received 1,153 whistleblower reports in 2019 and seems particularly keen to ensure that its pipeline of information does not dry up as a result of people being away from the office. The FCA may also be looking to capitalise on the low-level information leakage that can happen when people work from home: it has recently taken the unprecedented step of suggesting to people that they may wish to consider blowing the whistle to the FCA on members of their own families or neighbours. On its new whistleblowing website pages, published in October 2020, it suggests that people:
“report wrongdoing that they are aware of because of a personal relationship with someone – for example your partner may be an employee in a financial services firm witnessing wrongdoing. It could also be that you wish to report a family member or neighbour and, in these cases, you may want to speak to us confidentially.”
On the same series of webpages, the FCA also encourages prospective whistleblowers to come forward with their concerns by explaining that the FCA will “take the time to listen and understand your concerns. We can arrange to speak with you or meet you in person, and we will protect your identity throughout.” The FCA goes on to say that it “greatly values the information that whistleblowers share with us in confidence”. Anyone for whom this feels uncomfortably Orwellian will be pleased to know that the FCA also encourages prospective whistleblowers to consider raising their issues with the firm first, before speaking to the FCA. Our experience from recent months suggests that whistleblower reports do continue to be received regularly by financial institutions, despite the geographical dislocation of their workforces or the concerns that individuals may have about their job security. Consistent with the trend that had already started before the pandemic, a growing number of the issues raised relate to what the FCA categorises as “non-financial misconduct” – namely bad behaviour not directly related to work tasks, including for example bullying and harassment, rather than to financial or business misconduct. In June 2020, Protect (the UK’s whistleblowing charity) published its second report on “Silence in the City”. The report states that the most notable change relates to discrimination and harassment cases, which now feature in the top six concerns raised and equate to 5% of the concerns raised. Such issues are often by nature more sensitive to investigate than, say, allegations of business misconduct.
Managing sensitive internal investigations to minimise regulatory risk
Selecting the appropriate investigation route
Where sensitive allegations of misconduct have been raised, whether to HR, Compliance, or via an internal whistleblower process, it can be helpful to have a “triage” process to establish whether the issues raised are in the nature of grievances (typically involving behaviour specific to the complainant alone and dealt with by HR) or whether they qualify as whistleblows (typically involving behaviour non-specific to the complainant alone or at all and dealt with under the firm’s whistleblower policy). The regulatory definition of a whistleblow (known as a “reportable concern”) is somewhat broader than the employment law definition, including not only “protected disclosures” as defined under employment law, but also breaches of the firm’s internal policies and procedures, and behaviour that harms, or is likely to harm, the reputation or financial well-being of the firm.
"In today’s world, many matters that would previously have been considered grievances should now be categorised as whistleblows."
Given that firms’ policies and procedures are likely to include a requirement to comply with the FCA‘s Conduct Rules, and given that the FCA has made clear its own view that non-financial misconduct such as bullying and harassment is capable of constituting a breach of Conduct Rule 1 (acting with integrity), it is clear that, in today’s world, many matters that would previously have been considered grievances should now be categorised as whistleblows, regardless of the internal process followed to address the concerns, and the complainant afforded appropriate protection. One important protection for whistleblowers required by the FCA’s rules at SYSC 18 is that, where a whistleblower wishes to remain anonymous, the firm must enable that. In practice, where allegations of personal misconduct are being made, it can be extremely difficult to investigate the allegation effectively without disclosing the identity of the person who made a complaint. Anonymity of the complainant and any specifics that may identify them may mean that the investigation proceeds no further or that disciplinary action is not taken. At the other extreme, it may mean that an individual faced with the allegations is dismissed in circumstances which are highly likely to be unfair given the weaknesses inherent in a process where an individual claims that they cannot defend themselves if they do not know who has raised the allegations. However, to comply with the FCA’s rules, it is critically important that a whistleblower’s confidentiality is maintained where it has been requested. It often makes sense for investigations into very serious allegations to be conducted by legal professionals under legal professional privilege. While many firms choose to provide copies of privileged investigation reports to their regulators on a limited waiver basis, the privileged nature of such reports ought to put them out of reach of potential third-party litigants who may take an interest in the subject matter in the future.
Considering early notifications to regulators
"Where issues have been raised internally that are relevant to an individual’s fitness and propriety, early consideration must be given to notifications to the relevant regulators."
Where issues have been raised internally that are relevant to an individual’s fitness and propriety, particularly if the individual is senior, early consideration must be given to notifications to the relevant regulators, even where the individual is not to be suspended (suspension of itself necessitates its own regulatory notification on Form C). Principle 11 of the FCA’s Principles for Businesses and the equivalent PRA Fundamental Rule 7 (together with the detailed notification rules that sit beneath them) require prompt disclosure by firms to the regulators of information of which regulators would reasonably expect notice. Where a firm has information that would reasonably suggest that a significant breach of a Conduct Rule has been committed by a senior staff member, this is likely to be a matter of which regulators would expect early notice. Failing to notify early enough can cause difficulties with the regulatory relationship later down the line, so notification should be considered at an early stage.
Meeting the whistleblower
In our experience, conducting an initial meeting with the whistleblower (assuming that they have not chosen to remain anonymous) is usually a fruitful first step. Such a meeting should be kept as informal as possible, ideally using videoconferencing technology where an in-person meeting is not possible, with the focus being on putting the whistleblower at their ease. We have seen an increase recently in the number of whistleblowers who, in addition to their work-related concerns, are dealing with mental health issues. Investigators must be sensitive to such matters in order to help the firm to look after the whistleblower, and also to assist in evaluating the evidence being offered. Attention to body language is important while ensuring that the whistleblower feels that they are being listened to with full attention but without judgement. Appropriate reassurances should be offered about the firm’s systems and controls to ensure that there will be no retaliation against whistleblowers. The investigation team should be working closely with HR at this stage to make sure steps are in fact being taken to monitor any potential retaliation (telephone or email monitoring may be conducted in relation to the relevant individuals, for example). Any evidence that a whistleblower has suffered detriment as a result of issues they have raised may have extremely serious regulatory, as well as employment law, consequences for the firm and any individual who the whistleblower alleges has victimised them. In our experience, it often takes two or three meetings/interviews for a whistleblower to build up sufficient trust with the investigators to set out their concerns in full.
A typical pattern that we see when conducting whistleblower investigations is for the whistleblower to offer “clues” that point to, but fall short of, the full picture, hoping that the investigators will piece the clues together without the whistleblower having explicitly described the extent of the problem. This is an understandable strategy for whistleblowers to adopt, given that many are concerned about their own position, but we cannot stress enough that spending time at the front-end encouraging the whistleblower to open up can save a great deal of time and cost later in the investigation process.
Interviewing witnesses
Where the subject matter is sufficiently serious that there is a reasonable prospect of criminal misconduct being uncovered, consideration should also be given to whether any of the individuals to be interviewed should have separate, independent legal representation. As well as fairness to the individual being interviewed, which is important from an employment law perspective, it is often in the firm’s interest for the individuals whose conduct is the subject of serious allegations to be legally represented and helped to put forward their positions in as cogent a way as possible.
"Where the subject matter is sufficiently serious that there is a reasonable prospect of criminal misconduct being uncovered, consideration should also be given to whether any of the individuals to be interviewed should have separate, independent legal representation."
The FCA’s rules require that the whistleblower should be kept updated, where practicable, on the progress of the investigation. Practically speaking, updating the whistleblower helps to convey that their allegations are being taken seriously and, importantly, are being addressed. Silence may drive the whistleblower to look to blow the whistle outside of their employer. The need to comply with this rule must always be balanced carefully against the need to protect the confidentiality of other employees – the firm’s HR team should be involved in the decision around when and what information can be provided to the whistleblower.
Regulatory liaison
Once a conclusion has been reached from the investigation, it is important to keep regulators updated on a timely basis and to notify them promptly if any changes in the firm’s view of a senior individual’s fitness and propriety result from the findings of the investigation. If disciplinary action (defined under financial services law as a formal written warning, suspension imposed as a disciplinary sanction, dismissal, or a reduction in remuneration) is taken against an individual for conduct that would amount to breach of a Conduct Rule, also bear in mind that this is separately notifiable to the regulator under the SMCR Conduct Breach reporting rules.
Remedial follow-up work
With whistleblower complaints, while this is not specifically prescribed by any regulatory rule, firms should consider conducting an analysis of possible root causes of any failings identified, so that remedial actions can be agreed upon. This will be particularly important for those members of senior management who have specific responsibility for the firm's whistleblower framework, to demonstrate that they are discharging their responsibilities effectively.
CONCLUSION
“…teams that get the balance right contribute enormously to the resilience and culture of their organisations”
Whistleblower reports are a fact of life within the financial services industry, especially in troubled times, and can lead to important discoveries for firms. The strong regulatory focus in this area means that how you deal with allegations raised by whistleblowers can have a significant impact on your regulatory risk profile – both at the corporate level and at an individual level, if you are a senior manager. Effective handling of whistleblowers requires thoughtful collaboration between HR, legal and compliance professionals. This is a process that feels like an art rather than a science, demanding emotional intelligence and pragmatism as well as traditional investigation skills. However, teams that get the balance right contribute enormously to the resilience and culture of their organisations.
