The FCA and PRA have published new rules on how certain financial institutions must manage internal whistleblowing disclosures. The rules require affected firm's to institute rigorous internal whistleblowing arrangements, offer protection to all whistleblowers, including those who fall outside the scope of the UK legislation, and appoint a "whistleblowers' champion" to oversee the operation of the internal arrangements. The new rules come into force on 7 September 2016 and the appointed whistleblowers' champion will have responsibility for overseeing the firm's preparatory steps from 7 March 2016.
In June 2013 the Parliamentary Commission on Banking Standards (PCBS) published its report, Changing Banking for Good, setting out proposals for reform of the banking sector. This included a number of recommendations aimed at ensuring that banks have effective whistleblowing arrangements in place and whistleblowers are protected from victimisation.
Following a consultation exercise carried out earlier this year, the FCA and the PRA have now published new rules aimed at formalising the whistleblowing procedures within certain financial institutions. You can read our detailed report on the consultation process here.
Who is covered by the new rules?
The new rules will apply to:
- UK deposit takers with assets of £250 million or greater (including banks, building societies and credit unions);
- PRA-designated investment firms; and
- insurance and reinsurance firms within the scope of Solvency II and to the Society of Lloyd's and managing agents.
(together Relevant Firms).
Whilst the new rules will only apply to Relevant Firms, the rules will also serve as non-binding guidance for other FCA-regulated financial institutions falling outside the definition of Relevant Firms. Relevant Firms are able to operate the new arrangements internally, within its group or through a third party. However, where a Relevant Firm uses another member of its group or a third party to operate the arrangements it will continue to be responsible for compliance.
Looking ahead, the FCA intends to launch a consultation on whether the same or similar rules should be extended to UK branches of overseas banks. In due course, they will also consider whether similar requirements should be imposed on a wider range of firms regulated by the FCA, such as stockbrokers, mortgage brokers, insurance brokers, investment firms and consumer credit firms. In the meantime, the new rules will act as non-binding guidance for FCA-regulated firms which are not Relevant Firms.
Where can I find the rules?
The rules are set out in the:
- FCA's SYSC Senior Management Arrangements, Systems and Controls sourcebook; and
- PRA's Supervisory Statement SS39/15
In this briefing, references to rule numbers refer to the numbers used in the FCA's sourcebook.
When do the rules come into force?
The requirement to assign responsibilities to a whistleblowers' champion takes effect on 7 March 2016. From this date, the whistleblowers' champion will be responsible for overseeing the preparatory steps for the new regime.
Relevant firms must comply with the rules by 7 September 2016.
What do the new rules say?
Protection for all whistleblowers
The consultation proposed that a Relevant Firm's internal whistleblowing arrangements should be extended to all whistleblowers, not just employees or those who benefit from protection under the whistleblowing legislation. It was also proposed that the arrangements and protections should apply to those blowing the whistle about any type of concern, including those that do not relate to breaches of the FCA or PRA rules or which do not qualify as protected disclosures under the whistleblowing legislation.
There was broad support for both proposals. The result is that rule 18.3.1R(1) requires firms to establish, implement and maintain appropriate and effective arrangements for the "disclosure of reportable concerns by whistleblowers". The definition of "whistleblower" used in the rules covers any person that has disclosed (or intends to disclose) a "reportable concern" to the firm, the regulator or otherwise in accordance with the whistleblowing legislation. In turn, "reportable concern" is widely defined to cover any concerns held by any person in relation to the activities of the firm. This includea anything that would be the subject matter of a protected disclosure under the whistleblowing legislation and also includes (but is not limited to) a breach of the firm's own policies and any behaviour that harms or is likely to harm the reputation or financial well-being of the firm.
It is recognised that not all issues (e.g. grievances or customer complaints) need to be channeled through the whistleblowing arrangements. However, rule 18.3.2G(3)(a) provides that the whistleblowing arrangements: "…can be used to blow the whistle after alternative routes have been exhausted in relation to the effectiveness or efficiency of the routes". This is concerning for employers who may see employees who are dissatisfied with grievance appeal outcomes turning to the whistleblowing arrangements in an attempt ventilate their complaint again. It, therefore, comes as some comfort that the FCA highlights that: "…not all whistleblowing disclosures will result in investigative action", although there is an expectation that "due consideration" will be given to each case and this would be recorded.
Internal whistleblowing arrangements
The consultation recommended that Relevant Firms institute whistleblowing arrangements and inform their UK-based employees about them. The provisions on internal arrangements are included in rule 18.3.1R. Relevant Firms are required to:
- respect the confidentiality of whistleblowers and permit anonymous disclosures;
- permit disclosures to be made through a range of communication methods;
- ensure the effective assessment and escalation of concerns within the Relevant Firm and to the FCA or PRA;
- put in place reasonable measures to prevent the victimisation of whistleblowers;
- provide appropriate feedback to whistleblowers, where "feasible and appropriate";
- prepare and maintain appropriate records of concerns made by whistleblowers and the response and outcome;
- prepare and maintain written whistleblowing procedures that are readily available to staff;
- prepare an annual report to the Board on the operation and effectiveness of the whistleblowing arrangement (such report to maintain the confidentiality of the whistleblowers);
- promptly report to the FCA where the Relevant Firm loses a whistleblowing claim before an Employment Tribunal where the finding relates to a claim that the whistleblower was victimised; and
- provide appropriate training for certain staff (see below for further details).
The new rules require appropriate training is delivered to:
- all UK-based employees;
- managers of UK-based employees, wherever the manager is based; and
- all employees, wherever they are based, who are responsible for operating the Relevant Firm's internal arrangements.
Rule 18.3.4G prescribes the minimum training requirements in each case.
Further, rule 18.3.5G provides that where a Relevant Firm uses another member of its group or a third party to operate its internal arrangements it should also consider providing training to the persons operating the arrangements.
In addition, the whistleblowers' champion must be provided with training to enable him to carry out his responsibilities (see "Appointment of a whistleblowers' champion" below)
Notification about the FCA's and PRA's whistleblowing services
The consultation proposed that Relevant Firms should inform all of their UK-based employees about the dedicated whistleblowing services provided by the FCA and the PRA. This proposal received broad support from respondents to the consultation.
Rule 18.3.6R confirms that the notification to staff must be included in the Relevant Firm's employee handbook (or equivalent document) and must make it clear that:
- reporting to the FCA or PRA is not conditional on an internal report having been made under the firm's own arrangements;
- it is possible to make a report under the firm's arrangements and also to the FCA or PRA and that these routes can be used simultaneously or consecutively; and
- it is not necessary for the disclosure to be made to the firm in the first instance.
In addition, rule 18.3.7R requires Relevant Firms to ensure that their appointed representatives and tied agents notify their own UK-based employees about the FCA's whistleblowing services. Rule 18.3.8Galso encourages Relevant Firms to "invite" their appointed representatives and tied agents to consider adopting appropriate internal whistleblowing procedures.
Settlement agreements and employment contracts
The consultation proposed that Relevant Firms include express clauses in settlement agreements and employments contracts to clarify that nothing in the agreement prevented the employee from making a whistleblowing disclosure, including to the FCA or PRA. The consultation set out a suggested form of wording to include in such agreements.
Respondents to the consultation agreed that new settlement agreements should make it clear that the agreements do not prevent protected disclosures from being made. Rule 18.5.1R sets out the requirement for settlement agreements to include text explaining workers' legal rights in this respect. The FCA has provided sample text (at rule 18.5.2E) which may be used for this purpose, although alternative wording with the same meaning may be used instead.
In addition, rule 18.5.3R prohibits Relevant Firms from asking signatories to settlement agreements to state:
- whether they have made a protected disclosure; or
- that they know of no information that could form the basis of a protected disclosure.
The FCA imposes no such requirement in respect of employment contracts, leaving this to the discretion of the Relevant Firm. However, the PRA states that nothing in settlement agreements or employment contracts should prevent or discourage a worker from making a protected disclosure to the PRA.
Appointment of a "whistleblowers' champion"
The consultation recommended that Relevant Firms allocate responsibility for whistleblowing under the Senior Managers Regime (SMR) and the Senior Insurance Managers Regime (SIMR) to an individual, dubbed the "whistleblowers' champion". The majority of respondents favoured this proposal and the result is that Relevant Firms must appoint a whistleblowers' champion, although they are not obliged to use that specific title within their organisation. The whistleblowers' champion must be a non-executive director who is subject to the SMR or the SIMR and must be appointed by 7 March 2016. From this date the whistleblowers' champion must oversee the Relevant Firm's transition to arrangements complying with the new rules which come into force on 7 September 2016 (rule 18.4.6G).
Rule 18.4.4R provides that the role of the whistleblowers' champion is to oversee the integrity, independence and effectiveness of internal whistleblowing arrangements (under rule 18.3), including those intended to protect whistleblowers from victimisation. The whistleblowers' champion must have a level of authority and independence and access to resources (including independent legal advice and training) to enable him to carry out that role, although he is not expected to have a day-to-day operational role handling disclosures.
Financial groups will have flexibility about how to allocate the responsibilities of the whistleblowers' champion. There is no objection to the champion being based overseas, although the Relevant Firm will need to be satisfied that they can perform the role effectively.
No regulatory requirement to blow the whistle
The PCBS report had proposed that employment contracts, codes of conduct and staff handbooks include clear references to the "duty" on staff to blow the whistle internally. However, the FCA and PRA have declined to introduce such a duty on the basis that it could place individuals in a position where they feel they face being penalised whatever course of action they take. It could also lead to defensive reports being made which could overwhelm the firm. Instead, the decision to blow the whistle should remain a matter for individual. This approach echoes that taken in the independent Whistleblowing Commission report published by the whistleblowing charity, Public Concern at Work in November 2013.
What steps should Relevant Firms be taking now?
In order to be fully compliant by September 2016 Relevant Firms will need to take action now. As a starting point, Relevant Firms should:
- appoint a whistleblowers' champion by no later than 7 March 2016;
- ensure that the whistleblowers' champion receives appropriate training and advice on the scope of his responsibilities;
- ensure that the whistleblowers' champion has oversight of the preparatory steps towards compliant internal arrangements.
- audit current whistleblowing arrangements to identify where they already comply and where they fall short;
- consider what resources are available from whistleblowing charities (e.g. PCAW) and other recognised standard setting organisations and how they can inform the development of the internal arrangements;
- consider consulting with employees or representatives about the development of the internal arrangements;
- amend employee handbooks to include the notification of the FCA's and PRA's whistleblowing services;
- ensure appointed representatives and tied agents notify their own UK-based employees about the FCA's whistleblowing services;
- consider asking appointed representatives and tied agents to adopt appropriate internal whistleblowing procedures; and
- ensure a procedure is in place for determining and recording whether a whistleblowing disclosure warrants further investigation.
PS15/24: Whistleblowing in deposit-takers, PRA-designated investment firms and insurers (FCA Policy Statement and Rules)
PS24/15: Whistleblowing in deposit-takers, PRA-designated investment firms and insurers (PRA Policy Statement)
SS39/15: Whistleblowing in deposit-takers, PRA-designated investment firms and insurers (PRA Supervisory Statement)