Whistleblowing Arrangements for FCA Firms: A Practical Guide to SYSC 18

Who SYSC 18 applies to, and the proportionate approach

The mandatory whistleblowing rules in SYSC 18 do not fall equally on every regulated firm. When the FCA introduced the rules, it confirmed that the binding requirements apply to deposit-takers (banks, building societies and credit unions) with over 250 million pounds in assets, and to insurers that are subject to the Solvency II Directive. These are the firms that must comply with the full internal arrangements and appoint a whistleblowers' champion as a matter of rule.

For every other firm the FCA supervises, the rules take effect as non-binding guidance rather than binding obligations. The FCA has said it expects all firms to consider adopting these arrangements and that it regards them as good practice for the wider population. In practice that means a smaller firm should still put proportionate whistleblowing arrangements in place, scaled to its size and the nature of its business, even though it is not caught by the letter of the rules.

This split reflects the origins of the regime. The framework followed recommendations made in 2013 by the Parliamentary Commission on Banking Standards, which asked banks to put in place mechanisms allowing employees to raise concerns internally and to appoint a senior person responsible for the effectiveness of those arrangements. The table below summarises how the obligation differs across the two groups.

Firms that want a single place to hold their whistleblowing policy, log concerns and evidence the annual board report can align the workflow with the Nasara Connect control platform, which keeps the policy, the records and the review dates together and auditable.

The whistleblowers' champion

A firm caught by the rules must appoint a whistleblowers' champion. This is a senior individual whose job is to protect the independence and effectiveness of the firm's whistleblowing arrangements from the top of the organisation. The FCA expects the champion to sit at board level so that the arrangements have genuine authority behind them.

The FCA expects that a firm will appoint a non-executive director as its whistleblowers' champion. A firm that does not have a non-executive director would not be expected to appoint one solely for this purpose, and an insurer must appoint a director or senior manager to the role. Under the Senior Managers and Certification Regime the responsibility is a prescribed senior management responsibility, so it is allocated to a named senior manager and recorded in their statement of responsibilities.

The substance of the role is set out in the rules. A firm must allocate to the whistleblowers' champion the responsibility for ensuring and overseeing the integrity, independence and effectiveness of the firm's policies and procedures on whistleblowing, including those policies and procedures intended to protect whistleblowers from being victimised because they have disclosed reportable concerns. The champion does not have to handle individual cases day to day, but they own the health of the system.

What the internal arrangements must include

At the heart of SYSC 18 is the requirement to build proper internal arrangements. A firm must establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers. A reportable concern is broad: it covers concerns about anything that would count as a protected disclosure under the employment legislation, but also concerns about the firm's own compliance, its risk management and its treatment of customers, whether or not they would attract statutory protection.

The arrangements have to do several things at once. They must ensure the effective assessment and escalation of reportable concerns, including escalation to the FCA or the Prudential Regulation Authority (PRA) where appropriate. They must include reasonable measures to ensure that, if a reportable concern is made, no person under the control of the firm engages in victimisation of the whistleblower. And they must provide feedback to a whistleblower about a reportable concern they have made, where this is feasible and appropriate.

The FCA also expects the arrangements to be able to handle all types of disclosure from all types of person, to protect a whistleblower's identity where confidentiality is requested, and to allow concerns to be raised through a range of communication methods. Records of reportable concerns, how they were handled and their outcome should be kept, and the firm should prepare an annual report on the operation and effectiveness of its arrangements for its governing body. The steps below set out a workable order for putting this in place.

Because whistleblowing crosses into wider governance and senior manager accountability, firms building or reviewing their framework should treat it as one thread in a joined-up control environment rather than a standalone policy sitting in a drawer.

Telling employees about the FCA and PRA services

One requirement is easy to overlook but expressly set out in the rules. A firm must communicate to its UK-based employees that they may disclose reportable concerns to the PRA or the FCA, and the methods for doing so. The point is that an internal channel is not the only route open to a worker; the regulators run their own whistleblowing services, and staff are entitled to know they can go there directly.

The FCA expects this message to reach the whole UK-based workforce rather than a select few, and to be reinforced through training. When a firm devises and introduces a training and development programme on whistleblowing, that programme should cover all UK-based employees, make clear that the firm takes the reporting of concerns seriously and explain the methods for raising them, both internally and to the regulators.

Communicating the external route is not a sign that a firm expects its own arrangements to fail. It is part of building a culture where staff trust that speaking up is legitimate and safe, which is exactly the outcome the regime is designed to encourage.

Settlement agreements and the ban on gagging clauses

Settlement agreements have historically been a way in which employers could, deliberately or otherwise, discourage staff from blowing the whistle. SYSC 18 addresses this head on. A firm must include a term in any settlement agreement with a worker that makes clear nothing in the agreement prevents the worker from making a protected disclosure.

This mirrors the position in the underlying legislation. Under the Employment Rights Act 1996 any provision in an agreement is void in so far as it purports to preclude a worker from making a protected disclosure. A so-called gagging clause that tried to buy a worker's silence about wrongdoing would therefore have no legal effect, and including one would run directly against the FCA's expectations.

For firms, the practical takeaway is to review settlement and compromise wording so that the whistleblowing carve-out is present and clear. It is a small piece of drafting, but its absence is exactly the kind of detail the FCA points to when it questions whether a firm's culture genuinely supports people who raise concerns.

Statutory protections for whistleblowers

The FCA rules operate against a statutory backdrop. The Public Interest Disclosure Act 1998 amended the Employment Rights Act 1996 to give workers protection when they make a protected disclosure. The mechanics live in Part IVA of the Employment Rights Act 1996, which defines a qualifying disclosure as information that the worker reasonably believes is made in the public interest and tends to show one or more relevant failures.

The legislation lists the categories of relevant failure. These are that a criminal offence has been, is being or is likely to be committed; that a person has failed, is failing or is likely to fail to comply with any legal obligation; that a miscarriage of justice has occurred, is occurring or is likely to occur; that the health or safety of any individual has been, is being or is likely to be endangered; that the environment has been, is being or is likely to be damaged; and that information tending to show any of these has been deliberately concealed. A concern raised in a firm about a breach of FCA rules will usually fall within the second category, as a failure to comply with a legal obligation.

A qualifying disclosure becomes a protected disclosure when it is made through a route the legislation recognises. Section 43C covers disclosure to the worker's employer, which is why strong internal arrangements matter so much: they keep concerns inside the firm where they can be dealt with. Section 43F covers disclosure to a prescribed person, which includes the FCA and PRA as regulators prescribed for these purposes. Once a disclosure is protected, the worker gains the right not to be subjected to a detriment or dismissed for having made it.

What firms must report to the FCA

The regime does not stop at handling concerns internally. Firms subject to the rules have to keep their governing body and the regulator informed about how the arrangements are working. The whistleblowers' champion oversees the preparation of an annual report to the firm's board on the operation and effectiveness of its whistleblowing systems and controls.

There is also a specific external notification. Where a firm loses an employment tribunal case brought by a whistleblower, it must tell the FCA. When the FCA introduced the rules it confirmed that firms must report to the FCA if they lose an employment tribunal case with a whistleblower, so that the regulator has a window on how firms are treating people who raise concerns and whether detriment is occurring in practice.

The FCA treats the treatment of whistleblowers as a serious indicator of culture. It has said it would regard as a serious matter any evidence that a firm had acted to the detriment of a whistleblower, and that such evidence could call into question the fitness and propriety of the firm or of relevant members of its staff. Getting the arrangements right is therefore not only a compliance obligation but a way of protecting the firm and its senior managers.

Conclusion

Whistleblowing arrangements are one of the clearest tests of whether a firm's stated commitment to good conduct holds up in practice. SYSC 18 gives in-scope deposit-takers and Solvency II insurers a binding framework: appoint a whistleblowers' champion, build internal arrangements that assess and escalate concerns, protect people from victimisation, tell UK-based staff they can go to the FCA and PRA, and keep settlement agreements free of anything that would gag a protected disclosure. Every other firm is expected to treat the same framework as good practice and adopt a proportionate version of it.

Behind the Handbook sits the Public Interest Disclosure Act 1998 and Part IVA of the Employment Rights Act 1996, which give a worker who makes a protected disclosure the right not to suffer detriment or dismissal. Firms that build genuine, well-run arrangements keep concerns inside the business where they can be fixed, and they protect their own fitness and propriety in the eyes of the regulator. Firms that want to see how a single platform can hold the policy, the case log and the annual board report in one place can request a demo to walk through it.

Frequently asked questions