There is no topic quite as contentious as whistleblowing, particularly in the financial sector where the boundary between “right” and “wrong” is so often tested. A number of global regulators are overhauling their approach to whistleblowing in an attempt to change perceptions of this controversial area of risk management. In our latest free report, we take a look at attitudes and approaches to whistleblowing in financial services and provide an overview of recent developments in whistleblowing guidelines and regulation.
What qualifies as whistleblowing?
Whistleblowing refers to raising the alarm – i.e. contacting the relevant authorities or going public – about wrongdoing within an organisation. A complaint is usually considered to qualify as ‘whistleblowing’ when it concerns something that is in the interest of the wider public, meaning it will impact others outside of the organisation.
Broadly speaking, the following factors are usually what qualifies a complaint as a whistleblowing complaint, rather than raising a grievance, which instead usually refers to an individual being treated poorly within an organisation:
- Public interest concern: The concern raised must be in the public interest, such as fraud, corruption, safety violations, environmental hazards, or other forms of misconduct that could harm the general public, or the organisation’s stakeholders.
- Intent: Whistleblowers typically act with the intent to bring attention to the wrongdoing and seek corrective action, rather than for personal gain or vendetta.
- Disclosure of information: The individual raising the alarm is disclosing information that they reasonably believe to be true and accurate regarding the alleged wrongdoing.
Why is whistleblowing so contentious?
Whistleblowing is a complicated process which is often drawn out over a long period of time and can be stressful for all parties. Whistleblowers must face the internal struggle of balancing loyalty to their employer or organisation with their responsibility to expose matters crucial to the broader public interest.
If someone is lodging a complaint with an outside authority such as a financial regulator, they have most likely already tried to voice their concerns internally and been met with resistance – and perhaps even retaliation – from their superiors. Whistleblowing also raises complex legal and ethical questions, because despite acting in the public interest, a whistleblower’s actions may have legal repercussions, due to exposure of sensitive information or leaking of classified documents.
Risking the repercussions
One of the biggest deterrents for individuals calling out unethical or illegal practices within a firm is the potential impact it may have on their career and future employability. There are countless examples of whistleblowers who say they did not speak up sooner about misconduct due to fear of retaliation from their employer or colleagues. Research by UK whistleblowing charity, Protect, shows 70% of whistleblowers working in finance were either victimised, dismissed or felt resignation was the only option open to them after raising an issue at work. A recent high-profile example of this is the case of Desiree Fixler, former head of sustainability at German asset manager, DWS. When Fixler raised concerns internally about inaccuracies in the firm’s ESG reporting, she was promptly fired from her position. She later chose to go public with her story after false accusations were leaked to the press about her competency in her role at DWS, impacting her ability to find employment in the industry. The firm was later investigated by the US Securities and Exchange Commission (SEC) for greenwashing and settled the case for US$19m in September 2023.
The manufacturing safety scandal currently unfolding at Boeing and Spirit Aerosystems (Spirit) similarly demonstrates the pressures faced by whistleblowers when trying to get employers to listen to their concerns. Santiago Paredes, a former worker at Spirit, which is the sole supplier of fuselages to Boeing, recently went public with his experience of trying to raise safety concerns internally while he was working at the firm. He alleges he was nicknamed “showstopper” for slowing production by highlighting defects on parts that were being prepared for shipping to Boeing.
“I felt I was being threatened, and I felt I was being retaliated against for raising concerns,” he told the BBC. Paredes claims he was then ordered by management to change the way in which defects were reported, in order to reduce the number on record. “They just wanted the product shipped out,” said Paredes. “They weren’t focused on the consequences of shipping bad fuselages. They were just focused on meeting the quotas, meeting the schedule, meeting the budget… If the numbers looked good, the state of the fuselages didn’t really matter.”
After he protested, Paredes claims he was demoted from his role and moved to another part of the factory. He then filed an ethics complaint with the firm’s HR department, and emailed the CEO at the time, Tom Gentile. In the email, he said “I have lost faith on the quality organisation here at Spirit and this is my last cry for help.” Paredes was later reinstated in his previous role and received back-pay, but left Spirit soon after.
The US Federal Aviation Administration (FAA) is currently investigating if Boeing and Spirit completed the necessary safety inspections and whether documents were falsified by staff to cover up defects. Boeing voluntarily informed the regulator in April that it may not have completed “required inspections to confirm adequate bonding and grounding where the wings join the fuselage on certain 787 Dreamliner airplanes.” The case is still ongoing.
Preventing catastrophe
UK whistleblowing charity Protect says that more than 90% of whistleblowers who contact the charity for advice have already raised concerns internally, meaning the majority of public scandals could potentially have been avoided if issues were addressed when they were first raised. In the UK, the Post Office Horizon scandal, in which hundreds of postmasters were accused and wrongly convicted of fraud due to a defective IT system (Horizon) between 1999 and 2015, highlights this fact. “As much as it’s been called an IT scandal, it was human beings who made the decisions: people who must have sensed something was wrong and either never asked questions, or were too afraid to say something,” says Protect. “A scandal like this can only occur when people who notice something isn’t right don’t speak up. Organisations must recognise the value of listening to their workers and create an environment that encourages and protects those who speak up. This scandal shows, more than anything else, that we need better governance and accountability…Mistakes are bound to happen but when there is no system to ensure that they are discovered and investigated, and instead are covered up, that turns them into catastrophes.”
How is whistleblowing regulated?
There has been whistleblowing legislation in place in many jurisdictions for several decades. In the UK, whistleblowing protection is primarily governed by the Public Interest Disclosure Act 1998 (PIDA). This law provides legal protections for employees who report certain types of wrongdoing, such as criminal activities, breaches of legal obligations, health and safety violations, or environmental damage. Under PIDA, employees who make protected disclosures are supposed to be shielded from unfair treatment or dismissal as a result of whistleblowing.
In March 2021, the UK’s Financial Conduct Authority (FCA) launched a publicity campaign to increase awareness and improve messaging around whistleblowing in the financial services industry. The campaign, entitled In Confidence, With Confidence, included a digital toolkit of posters and information leaflets designed to educate individuals about the regulator’s whistleblowing procedures and to reassure those who wish to report an issue through the FCA that they will be protected.
In the US, whistleblowing protections are mainly governed by laws such as the Whistleblower Protection Act of 1989 (WPA), which protects federal employees who disclose government misconduct, and the Sarbanes-Oxley Act of 2002 (SOX), which provides protections for employees of publicly traded companies who report financial fraud.
The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 includes provisions for whistleblowers who report violations of securities laws. The SEC oversees the implementation of these provisions, including the whistleblower reward programme, which offers financial incentives to individuals who provide original information leading to successful enforcement actions.
Incentivisation
Some jurisdictions incentivise whistleblowers to come forward about wrongdoing by providing a financial reward if a case is successful. Some argue this system is vulnerable to abuse and raises ethical concerns. Others argue that it helps provide security for people who are afraid of being financially ruined by speaking up.
Examples of countries that currently provide rewards for whistleblowing include:
United States: As mentioned above, the SEC offers financial rewards to whistleblowers who report violations of securities laws. Under the Dodd-Frank Act, whistleblowers can receive between 10% and 30% of the monetary sanctions collected by the SEC. Additionally, the False Claims Act allows whistleblowers to receive a portion of the funds recovered by the government in cases involving fraud against the government.
European Union: The EU has adopted directives aimed at protecting whistleblowers across its member states. These directives require member states to establish channels for reporting wrongdoing and provide protection against retaliation. While financial incentives are not as common in the EU as they are in the US, some countries may offer rewards or compensation to whistleblowers in certain cases. EU countries that currently offer financial rewards include Hungary, Slovakia and Poland.
Australia: In Australia, the Corporations Act 2001 provides protections for whistleblowers in the corporate sector. Whistleblowers who report misconduct related to corporations can receive protection from retaliation and may be eligible for compensation if they suffer harm as a result of their disclosure.
Canada: Canadian securities regulators offer whistleblower programmes similar to those in the US, providing financial incentives to individuals who report violations of securities laws.
United Kingdom: While financial incentives are not as prevalent as in some other jurisdictions, whistleblowers in the UK are protected against retaliation and may receive compensation for any harm suffered as a result of their disclosure. The Competition and Markets Authority (CMA) offers a reward scheme for whistleblowers who report illegal cartel activity and the UK’s tax authority HMRC (His Majesty’s Revenue & Customs) offers discretionary incentives for whistleblowers who report tax fraud.
The UK’s Serious Fraud Office (SFO) has also recently said it is looking into incentivising whistleblowers in order to shorten the average time it takes for the SFO to close a case. SFO Director Nick Ephgrave recently discussed how incentives might be used to encourage people to bring forward essential information to help guarantee prosecution. In his first public speech in his role as director in February 2024, he said: “If we’re serious about SFO cases being quicker, then we need to focus on the intelligence and evidence. Our cases, which maybe take five to six years; how much quicker would they be if we could access what we might call ‘smoking gun’ evidence from an insider who was actually there when it happened, saw what happened…has the documents that prove the case?”
Ephgrave points to the example of the US, where rewards have so far proven to be effective. “If you look at the example in America…the American system allows [whistleblowing incentives], and I think something like 86% of the US$2.2bn of…prosecutions have come from whistleblowing information reports at that first stage.” He added that since 2012, 700 UK nationals chose to report their concerns to US regulators, rather than UK regulators, due to the lack of financial incentives in the UK.
Law firm A&O Shearman agrees that providing a financial reward might encourage individuals who are on the fence about coming forward to take the plunge. “Put yourself in the whistleblower’s shoes: there are significant financial and reputational risks for whistleblowers who report wrongdoing,” says the firm in a blog authored by two of its financial law experts, Grace Miller and Kendall Pauley. “Whistleblowers often lose their jobs, suffer ramifications throughout their careers and, in the most serious cases, reporting wrongdoing can be career-ending…They will likely want costly legal advice before they make a disclosure, and throughout what can be a lengthy process…Financially rewarding whistleblowers provides a strong incentive, and effectively an insurance policy for some.”
Developments in whistleblowing regulation, guidance and regulatory action
US voluntary self-disclosures pilot
The US Department of Justice (DoJ) has launched a new pilot programme designed to encourage voluntary self-disclosure by corporate executives who are involved in financial misconduct. Under the new programme, culpable individuals will receive a non-prosecution agreement (NPA) if they (1) voluntarily, (2) truthfully, and (3) completely self-disclose original information regarding misconduct that was unknown to the department in certain high-priority enforcement areas, (4) fully cooperate and are able to provide substantial assistance against those equally or more culpable, and (5) forfeit any ill-gotten gains and compensate victims.
“We understand that when companies are deciding whether to make a voluntary self-disclosure, they assess not only the benefits of self-reporting laid out in our Corporate Enforcement Policy, but also the risk that the department will learn about the misconduct from other sources,” says the DoJ. “The department is upping the ante in that calculus by increasing the incentives for individuals to come forward.”
EU Whistleblowing Directive: slow progress?
The EU’s Whistleblowing Directive was launched in 2019 to address fragmentation in approaches to whistleblowing across its member states, which many felt had been negatively impacting people’s willingness to come forward with information. “The consequences of breaches of Union law with a cross-border dimension reported by whistleblowers illustrate how insufficient protection in one member state negatively impacts the functioning of Union policies not only in that member state, but also in other member states and in the Union as a whole,” said the directive.
An important feature of the EU Directive is that all firms are required to establish secure internal reporting channels for whistleblowers. These must be designed to maintain confidentiality and anonymity for the reporting person and any third party mentioned. It should also prevent any access to this information by non-authorised staff members. Whistleblowers should be able to make a report in writing and have the ability to submit reports by post, by a physical complaint box, or via an online platform, whether it be on an intranet or internet platform. They should also have the option to make their complaint orally, via a telephone hotline or voice messaging system, or both.
Each member state was instructed to transpose the EU directive into law by December 2021. In a January 2024 update on how member states were progressing, the commission issued the following statement: “The directive requires member states to ensure that all legal entities in the private sector, with 50 or more workers, establish internal reporting channels. This obligation needed to be transposed by 17 December 2021. However, for medium-sized companies (legal entities in the private sector with 50 to 249 workers), member states had an additional two years to transpose EU rules. To date, Estonia and Poland have not notified any measures transposing this Directive and on 15 February 2023, the Commission had decided to refer Estonia and Poland to the Court of Justice. In addition, both member states have also not communicated national measures regarding medium-sized companies.”
In December 2023, anti-corruption movement Transparency International also assessed how countries were progressing with their interpretation of the directive into local law and found mixed results. “When scrutinising the new whistleblower protection laws of 20 EU member states, we found that 19 fell short of crucial EU requirements…Encouragingly, many countries, in some instances, exceeded EU standards for protection. However, none meet best practices in all critical areas. Despite the strides taken, there’s a pressing need for further improvements in whistleblower protection laws across the EU.”
Banks being investigated over non-disclosure agreements (NDAs)
The US Commodity Futures Trading Commission (CFTC) has reportedly contacted several major banks to see if they have been using NDAs to prevent potential whistleblowers from raising concerns. According to Bloomberg; Bank of America, JPMorgan Chase and Citigroup have all been contacted by the US regulator about their use of questionable NDAs in their swaps and clearing businesses. Reports suggest the regulator is concerned about banks preventing clients from blowing the whistle by writing clauses into contracts that prevent them from speaking up.
In January, JPMorgan agreed to pay the SEC a US$18m settlement to draw a line under allegations that it had violated whistleblower protection laws. The bank allegedly “impeded hundreds of advisory clients and brokerage customers from reporting potential securities law violations” according to the SEC’s order. From March 2020 through July 2023, JPMorgan Securities regularly asked retail clients to sign confidential release agreements if they had been issued a credit or settlement from the firm of more than US$1,000.
“Whether it’s in your employment contracts, settlement agreements or elsewhere, you simply cannot include provisions that prevent individuals from contacting the SEC with evidence of wrongdoing,” said Gurbir S. Grewal, Director of the SEC’s Division of Enforcement. “But that’s exactly what we allege JPMorgan did here. For several years, it forced certain clients into the untenable position of choosing between receiving settlements or credits from the firm and reporting potential securities law violations to the SEC. This either-or proposition not only undermined critical investor protections and placed investors at risk, but was also illegal.”
Being prepared for a whistleblowing complaint
What do people whistleblow about?
It’s important to remember that misconduct can take many forms and can involve highly sensitive issues. The FCA says it receives reports about mis-selling, money laundering, fitness and propriety, unauthorised business, pension liberation activity, as well as complaints about non-financial misconduct. Non-financial misconduct includes (but is not limited to) bullying, sexual harassment and discrimination, whether inside or outside the workplace. This demonstrates the wide range of issues firms need to be prepared to deal with effectively in order to ensure a complaint is dealt with sensitively and appropriately. It is essential to ensure the welfare of the individual is not overlooked when trying to manage the potential fallout from an issue becoming public.
The psychology of whistleblowing
Managing the whistleblowing process is fraught with complexity because it involves human behaviour and relationships. Preventing misconduct in the first place is of course the most effective way of reducing your risk of an employee whistleblowing publicly. But understanding what makes people choose to blow the whistle can also help firms to better manage issues internally and create a whistleblowing policy fit for purpose.
A study published by the journal Current Opinion in Psychology in 2015 determined that higher rates of whistleblowing were found amongst well-paid, well-educated male employees who had been at the company for a long time. “These correlational patterns suggest that people with greater occupational power are more likely to dissent, perhaps because they face reduced threat of punishment for violating group cohesion,” said the study. This is interesting because many might have the preconception that it is disgruntled junior members of staff who are more likely to feel compelled to blow the whistle, not people who hold well-paid, senior roles – i.e. a lot to risk by speaking up.
Attitudes towards whistleblowing are also often extreme and opposing. “From one perspective, whistleblowing is the ultimate act of justice, serving to right a wrong. From another perspective, whistleblowing is the ultimate breach, a grave betrayal,” says the study. So, how can firms cultivate a harmonious environment that leverages the potential benefits of whistleblowing, rather than perpetually guarding against its negative impacts?
The authors of the journal study suggest encouraging a more open culture based on constructive dissent. “By encouraging individuals to engage in open and, if necessary, critical discussion about the group’s collective interests, those who observe organisational wrongdoing may no longer feel they are sacrificing group loyalty for justice in reporting wrongdoing,” it says. “Instead, in a culture of constructive dissent, people might come to view whistleblowing as an essential part of what it means to be a loyal and productive group member with an eye toward advancing collective goals to act appropriately and ethically.”
How to handle a whistleblowing complaint internally
Handling a whistleblowing complaint internally may help to avert a PR disaster and could even enable the firm to avoid regulatory action if the issue is addressed quickly and effectively. The process requires a delicate balance between addressing the concerns raised by the individual and protecting the interests of the organisation and its employees. Here are some tips to effectively manage whistleblowing internally:
Establish clear policies: Have well-defined policies and procedures in place for reporting and handling whistleblowing cases. Make sure all employees are aware of these policies and know how to report concerns. These should be regularly assessed and updated where necessary to ensure they continue to comply with relevant regulation.
Create a safe environment: Foster a culture where employees feel safe and encouraged to speak up about any wrongdoing or ethical concerns without fear of retaliation. Assure anonymity and confidentiality for whistleblowers whenever possible.
Listen actively: When a whistleblower comes forward, listen to their concerns attentively and take them seriously. Provide them with a safe space to express their grievances and ensure they feel heard and understood.
Investigate thoroughly: Conduct a prompt and thorough investigation into the allegations raised by the whistleblower. Maintain objectivity and ensure that the investigation is fair and impartial. Whistleblowers often choose to go public if they feel their employer is not taking their concerns seriously, so demonstrating that the issues they have raised are being dealt with appropriately is essential.
Protect whistleblowers: Take steps to protect the whistleblower from retaliation or harassment. Make it clear that any form of retaliation against whistleblowers will not be tolerated and may result in disciplinary action.
Maintain confidentiality: Respect the confidentiality of the whistleblower and the information they provide. Avoid disclosing their identity or the details of the investigation unless absolutely necessary.
Provide support: Offer support and assistance to the whistleblower throughout the process. This could include counselling, legal advice, or protection measures if they feel threatened or vulnerable.
Take corrective action: If the investigation substantiates the allegations, take appropriate corrective action to address the wrongdoing and prevent it from recurring in the future. Self-report the issue to regulators and keep a record of measures taken to actively address the issue.
Set realistic expectations: Dealing with complaints takes time. Keep employees informed about the progress of the investigation and any likely actions that may be taken as a result – but be transparent and realistic. Transparency helps build trust and demonstrates the organisation’s commitment to ethical conduct.
Learn and improve: Use whistleblowing cases as an opportunity to learn and improve internal processes and controls. Identify any systemic issues that may have contributed to the wrongdoing and implement measures to address them.
