The PRA and FCA have published a joint consultation paper (CP) on a series of measures to formalise whistleblowing procedures in firms. The aim is to encourage employees to raise concerns and protect whistleblowers from victimisation. This initiative responds to the Parliamentary Commission on Banking Standards' recommendation to put in place effective mechanisms to allow employees to raise concerns internally.
Requirements
Firms are required to develop internal procedures including measures to:
- inform employees that they can blow the whistle to the FCA/PRA
- act on anonymous complaints
- provide different communication channels (email, phone etc)
- assess and escalate concerns
- track the outcome of the concern
- track what happens to whistleblowers (to ensure they are not subsequently disadvantaged)
- provide feedback to the whistleblower
- train employees and identify a whilstleblowing champion
- ensure that no person within the firm's control engages in victimisation
- include a passage in new employment contracts and settlement agreements clarifying that employees are not prevented from making protected disclosures
- prepare an annual report on the operation and effectiveness (with statistical data) of the whilstleblowing function to the Board and share it with regulators on request.
Some of these measures are already in place in larger firms. However, this CP proposes that firms must look beyond their permanent employees to include volunteers, agency workers, contractors and employees of subsidiaries, competitors and suppliers and offer them the ability to use the firm's whistleblowing arrangements. They should be offered the same level of confidentiality and the same protections against being mistreated. It is unclear how such protections can be practically provided to third party or non-permanent employees.
There is also some consideration of proportionality – the CP recognises that the whistleblowing function may be not be a formal unit and could sit within an existing function such as Internal Audit or Compliance (but preferably outside HR to alleviate concerns that any disclosures may be treated as a grievance claim).
Third parties can also be used to provide whistleblowing services, and this arrangement is viewed favourably in the CP. However controls need to be in place to monitor the quality of the service and the respective roles of the firm and the third party in ensuring an effective whistleblowing function. Internal Audit or Compliance is expected to provide oversight.
Timelines
The framework will apply to UK banks, building societies and credit unions (greater than £25m in assets), PRA designated investment firms and insurers. The consultation closes on 22 May 2015. No date has been provided for final rules or their implementation.
In conclusion
The requirement to provide independent controls assurance and track what happens to the whistleblower puts the responsibility for protecting the whistleblower squarely on the firm. The annual report to the Board will also ensure senior management oversight. These proposals reflect another step in strengthening the culture of firms by ensuring avenues for reporting issues are open, well understood and protected.
Firms now have to consider the challenges of implementation and beyond. Firms will have to determine the extent and scale of any investigation in relation to a concern that a whistleblower has raised. Whilst this has to be judged on a case-by-case basis, every concern will potentially need to be investigated to ensure that it is not indicative of a pervasive problem. This could require significant coordination and investment in time and resources across the firm.
As always, the challenge of implementing discrete pieces of new regulation will be in integrating them into existing reform programmes and embedding them in such a way to deliver the spirit of the regulation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
