Two years ago the FCA and PRA introduced stringent whistleblowing rules for financial institutions.  The FCA has recently conducted a review into how a range of retail and wholesale banks have grappled with these rules.  On 14 November 2018 the FCA published a summary of its findings, highlighting areas of good practice and areas for improvement.

What's the background?

In June 2013 the Parliamentary Commission on Banking Standards published its report, Changing Banking for Good, setting out proposals for reform of the banking sector. This included a number of recommendations aimed at ensuring that banks have effective whistleblowing arrangements in place and whistleblowers are protected from victimisation.  In response, the FCA and PRA introduced rules on how certain financial institutions should manage internal whistleblowing disclosures.  These rules came into force on 7 September 2016 and were extended to UK branches of overseas banks a year later.

Amongst other things, the rules require firms to:

• Institute rigorous internal whistleblowing arrangements which allow employees to raise concerns and to have them dealt with appropriately and confidentially.
• Appoint a "whistleblowers' champion" to oversee the integrity, independence and effectiveness of the internal arrangements and the production of an annual report to the Board.
• Provide tailored training to employees, managers and the whistleblowers' champion.

You can read our detailed report on the rules here.

Two years after implementation, the FCA has conducted a review of how affected firms have implemented the rules.  A range of retail and wholesale banks were included in the review.

What can firms do better?

In general, the review found that the rules have helped firms to implement effective whistleblowing arrangements and manage disclosures fairly and consistently, whilst protecting the whistleblower from reprisals.  The review also found that non-executive directors appointed as whistleblowers' champions were providing independent oversight and accountability.  However, a number of improvements were needed across the following areas: 

(i) Policies and procedures:

Procedures: although all firms had implemented or updated existing procedures, it was the case that many firms had not fully implemented, or sufficiently considered, all of the whistleblowing rules set out in SYSC18.

Investigation process: most firms still needed to document and enhance their investigation processes to ensure there was a consistent approach to assessing and escalating concerns.  The review highlighted the good practice adopted by some firms of having a step-by-step process in place which provided guidance on how to assess and grade information.

Victimisation: a number of firms needed to develop or enhance their arrangements to demonstrate how whistleblowers would be protected against victimisation.  By contrast, some firms had adopted particularly good practices in this area, including one firm which monitored employment records for 12-18 months after a reportable concern had been investigated to check whether the whistleblower had been victimised.

Reporting: although most firms had a variety of reporting channels for employees to raise concerns, some firms had incorrectly stated that concerns must first be raised internally before contacting the FCA (contrary to rule 18.3.6R).

(ii) Annual whistleblowing report:

Providing the report: whilst most firms had met the requirement to produce an annual report to the Board on their whistleblowing arrangements, some firms had failed to do so and were still at the stage of developing their first report.

Quality of the report: some firms' annual reports did not contain a sufficient level of information or analysis and this was particularly the case where the firm had a lower number of whistleblowing cases to deal with.

(iii) Training:

Training to employees: whilst all firms had provided whistleblowing training to their employees, in most cases this had not been sufficiently detailed and needed improvement.  In particular, firms needed to equip employees with an understanding of how to raise concerns and the firm's approach to confidentiality and preventing victimisation.

Different training to different audiences: the FCA rules have stringent requirements as to the provision of training (see rules 18.3.4G, 18.3.5G and 18.4.4R).  They require that appropriate training is delivered to: (i) all UK-based employees; (ii) managers of UK-based employees, wherever the manager is based; (iii) all employees, wherever they are based, who are responsible for the firm's arrangements; (iv) the persons operating the firm's arrangements (if another member of the firm's group or a third party); and (v) the whistleblowers' champion.  The review found that some firms provided separate, tailored training to these different audiences.  However, most firms failed to distinguish between the training provided to employees, managers and those operating the firm's arrangements (including investigation teams).

What should firms do now?

The findings of the review should nudge firms into checking that their practices and procedures comply fully with SYSC18 and, where possible, the examples of good practice given by the FCA.  In particular, firms should ensure that they rectify any weaknesses linked to the areas for improvement highlighted by the FCA.  Indeed, the FCA says it expects senior managers to: "oversee and ensure that their firm has fully considered and implemented effective whistleblowing arrangements" and "continuously assess how the arrangements are working in practice".  Therefore, it would be prudent for firms to:

• Regularly benchmark their practices and procedures against SYSC18.
• Ensure the annual report to the Board is sufficiently detailed. 
• Ensure that a programme of tailored whistleblowing training is rolled out to different audiences on a regular basis.

Addleshaw Goddard can help you review your internal procedures, audit how they are working in practice and deliver tailored training programmes to your staff.  Please contact Amanda Steadman or your usual AG contact if you would like further information.

Retail and wholesale banking: review of firms' whistleblowing arrangements