"Under the new regime, EU companies with more than 50 employees, and all legal entities in the public sector unless exempt under national law, must set up internal whistleblowing procedures"
In this article we examine the current state of whistleblowing regulations in financial services in the UK, as well as the new EU whistleblowing regime coming into force in December 2021.
Whistleblower regulations in UK financial sector
The UK’s financial regulators (the FCA and PRA) use the term ‘whistleblowing’ to refer to the disclosure by “any person” of “a reportable concern” to a firm or the regulator. A “reportable concern” includes a number of matters, such as:
• a breach of the firm’s policies and procedures;
• behaviour that harms the financial well-being of the firm;
• criminal offences; and
• miscarriages of justice.
The FCA rules on whistleblowing are part of the Senior Managers Regime and are contained in Chapter 18 of the Senior Management Arrangements, Systems and Controls sourcebook (SYSC 18). SYSC 18 requires large firms to have adequate systems in place for handling reportable concerns made by whistleblowers. Firms are also required to appoint a senior manager as a “whistleblowers’ champion” who is responsible for overseeing the effectiveness of the firm's policies and procedures on whistleblowing.
Key case – Barclays and Staley
The FCA's and PRA's first high-profile case involving the Senior Managers Regime regulations was the 2016 case involving Barclays Bank and its then CEO, Jes Staley, who left the bank in November 2021.
In 2016, the Barclays’ board received two letters expressing concern about the hiring of an individual, Tim Main, who was a former JP Morgan colleague of Mr Staley. Mr Staley thought the allegations were malicious, and directly involved himself in the investigation. This included attempts by Mr Staley to identify the sender of one of the letters. Following an investigation, the FCA and PRA fined Mr Staley £640,000 for his involvement in the matter. In particular, the regulators were critical of:
• Mr Staley’s general involvement in the case, his interference in the compliance team’s investigation and sharing the letter with persons outside of the Bank – given his clear conflict of interest.
• Mr Staley’s attempts to identify the first letter’s author, in circumstances where anonymity is critical to the whistleblowing regime.
The FCA’s head of enforcement, Mark Steward said: “Mr Staley breached the standard of care required and expected of a chief executive in a way that risked undermining confidence in Barclays’ whistleblowing procedures”.
The regulators’ decision to simply fine Mr Staley, without banning him from his position, was controversial – many arguing that the fine was a slap on the wrist, and the lack of action would deter whistleblowers coming forward in the future. Interestingly, My Staley was the first CEO of a major financial institution to be fined by financial regulators without being banned from his position.
In addition, the FCA imposed requirements on Barclays as to how it dealt with whistleblower reports in the future. It also required Barclays (for the three years following the investigation) to provide the FCA with a signed attestation confirming its systems complied with the requirements of SYSC 18.
There was also a separate investigation by New York’s Department of Financial Services (NYDFS). In 2019, NYDFS fined Barclays Bank PLC and its New York branch US $15 million for the incident.
The FCA’s campaign
Since the Staley case, the FCA has been investing in resources to support whistleblowers, including specialist training for its staff. And, earlier this year, the FCA launched a new campaign – 'In confidence, with confidence' – to encourage individuals to report wrongdoing by emphasising the support available to them across the FCA's departments.
Under the new campaign, whistleblowers that report to the FCA will have a dedicated case manager. They can meet with the FCA to discuss their concerns and can receive optional regular updates throughout the investigation. To support the campaign the FCA has produced:
• materials for firms to share with their employees – this includes an employee leaflet and a number of different posters; and
• a digital toolkit for industry bodies and consumer groups to encourage people to whistleblow.
Observers wait to see whether such campaign will have the intended effect and increase the volume of whistleblowing reports to the FCA. In the most recent FCA Annual Report and Accounts (for the year ended 31 March 2021) the FCA received a total 1046 whistleblower reports which contained 2,754 separate allegations of misconduct. The most frequent themes from the reports were complaints about compliance, fitness propriety, treating customers fairly and systems and controls. Interestingly, crime and anti-money laundering were the least frequently reported themes.
The new EU whistleblowing laws
A new EU Whistleblowing Directive (which applies to all sectors) must be transposed by EU member states by 17 December 2021. The UK has indicated that it will not change its whistleblowing laws to align with the directive, however, the directive will clearly impact UK firms who operate in EU jurisdictions. Under the new regime, EU companies with more than 50 employees, and all legal entities in the public sector unless exempt under national law, must set up internal whistleblowing procedures, with guaranteed confidentiality for whistleblowers.
Importantly, the Directive goes further than the UK regime in terms of timing and feedback to whistleblowers:
• Feedback to whistleblowers: There is a new requirement to provide “feedback” to the reporting person on the outcome of the investigation.
• Time limits: There are time limits within which organisations and authorities that receive protected disclosures must handle whistleblowers’ reports. The entity must acknowledge receipt of the report within seven days and provide feedback within a reasonable timeframe “not exceeding three months from the acknowledgement of receipt”.
Final word
It is in the public interest that legal systems provide adequate protections to whistleblowers to allow them to speak out (without retaliation) if they discover wrongdoing in an organisation. Such safeguards are critical to the reputation and public confidence of the UK financial sector. It is significant that the new EU regime provides additional procedural rights to the whistleblower – such as time limits and feedback – which will ensure that organisations are not only taking active steps to investigate quickly, but it will ensure whistleblowers are appropriately informed. While such rights are not included in the current UK regime, such additions would strengthen the current UK rules even further and would likely encourage more whistleblowers to come forward.
