Overview

• A survey conducted by the United Kingdom Financial Conduct Authority (FCA) in early 2022, but published only in 2023,¹ has revealed the stark reality that the regulator is not doing enough for whistleblowers.
• 15 of 21 respondents reported that they were “extremely or somewhat dissatisfied” with the FCA’s handling of their report, and almost 40% stated that they would be “unlikely” to, or “definitely would not”, make a whistleblowing report to the FCA again.
• The FCA has responded by renewing its focus on improvement, having set out a number of proposed steps to enhance the whistleblowing framework.
• The FCA’s identified shortcomings contrast with the recent successes of the United States Securities and Exchange Commission (SEC) in receiving tip-offs, acting on them, and protecting and rewarding whistleblowers. One key difference in the regimes is the SEC’s ability to offer financial incentives to whistleblowers.
• The increased scrutiny of the FCA’s activities surrounding whistleblowing will almost certainly translate into greater focus on the practices of regulated firms. This should encourage firms to revisit their policies and procedures to ensure compliance with the FCA’s rules.

Why Does Whistleblowing Matter?

In her first public speech following her appointment as the FCA’s Joint Director of Enforcement, Therese Chambers, exhorted firms to “do the right thing”.² Whilst an attractive phrase for the regulator, despite the best will and culture in the world, things can, and do, still go wrong. Both to meet FCA requirements (which are prescriptive and not insubstantial) and as a matter of good business practice, firms must have in place structures to ensure that malpractice is identified and dealt with quickly. Whilst it can be expected only to be needed in somewhat unusual circumstances—as hopefully the number of “reportable concerns”³ are few and far between, and to the extent such issues do arise personnel are hopefully able to flag matters in the normal course of their employment—having procedures in place so that firms are able to appropriately respond to concerns raised by whistleblowers is an important component of this.

In light of recent publicity and criticism directed at the FCA in connection with its whistleblowing practices, it would not be surprising for the regulator to deflect some of this attention onto regulated firms.

Current FCA Requirements

As well as general obligations under the FCA’s Principles for Businesses, such as Principle 3 (“A firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems”), specific rules on whistleblowing are found in the Senior Management Arrangements, Systems and Controls Sourcebook (SYSC) of the FCA Handbook - SYSC 18.⁴

SYSC 18.3.1R, in particular, provides that firms “must establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers”.⁵ As part of this, firms must ensure:

• The effective handling of a whistleblower’s concerns, including (i) protecting a whistleblower’s identity when confidentiality is requested, and (ii) allowing for disclosures to be made through a range of communication methods.
• The effective assessment and suitable escalation of concerns (including escalation to the FCA if appropriate).
• Reasonable measures are put in place to prevent victimisation of whistleblowers.
• Feedback is provided to the whistleblower where feasible and appropriate.
• The preparation and maintenance of (i) appropriate records of reportable concerns, together with the firm’s treatment of these reports and the outcome, and (ii) an annual report for the board.
• They have in place up-to-date written procedures, which are readily available, outlining the firm’s policies in respect of whistleblowing.
• That personnel are suitably trained on the firm’s whistleblowing policies and procedures. The FCA prescribes a number of topics that should be included in the training; for example, on how to recognise when there has been a disclosure of a reportable concern and examples of events that might prompt the making of a reportable concern.

There are also employment law obligations which have parallels in the FCA Handbook, and which should not be overlooked.

Is the FCA Doing Enough?

Despite both commercial and legal demands, there is a growing perception that the FCA is failing whistleblowers:

• Only a comparatively small number of notifications made to the FCA lead to an investigation. For example, at the time of a Freedom of Information Act (FOIA) request in May 2022, of the 1,205 whistleblowing reports made to the FCA in 2021, only seven reports had led to “significant action to mitigate harm”, and of the 1,075 reports made in 2020 only 46 reports had led to “significant action”.⁶
• Cases often take a long time for the FCA to deal with them. There are again striking figures from the May 2022 FOIA request, namely that of the 1,179 notifications made in 2019, the FCA was still assessing 149 such reports in May 2022 (29 months after the end of 2019), and of the 1,075 reports from 2020, 304 reports (that is almost 30%) were still being assessed.⁷
• From a qualitative survey conducted by the FCA itself in “early 2022”—which was only published in May 2023⁸—the FCA noted that:
  • 15 out of 21⁹ (71%) respondents were “extremely or somewhat dissatisfied” with the FCA’s handling of the whistleblower report.
  • 8 out of 21 (38%) respondents said that they would be “unlikely” to or “definitely would not” make a whistleblowing report to the FCA again.
  • 12 out of 21 (57%) respondents had not received their final feedback at the time of the survey, pointing to the long length of time which the FCA takes to follow-up on the tip offs.
  • 8 out 9 (89%) respondents who received final feedback said they were dissatisfied with the outcome they had received.

In addition, the UK Parliament has been scathing as to the shortcomings of the FCA, with one Member of Parliament in a debate from 2019 describing the regulator as having a “terrible reputation” in relation to whistleblowing.¹⁰ One example (amongst others) given in that debate was the instance of a high profile chief executive being fined only a modest sum by the FCA and Prudential Regulation Authority for having attempted to uncover the identity of a whistleblower.

Is the SEC More Successful?

In stark comparison to the FCA, the SEC has continued to celebrate successes with its whistleblowing program. The SEC received its highest number of tip-offs in fiscal year 2022 at over 12,300.¹¹Not only is the US regulator receiving more tips, however, but it is also actioning many more too. One of the ways this can be seen is by the sheer magnitude of the awards paid to whistleblowers whose information has led to successful enforcement. Since the beginning of the current SEC whistleblower program in 2010, the SEC has paid out more than $1.3 billion to whistleblowers¹² with the highest single award recently granted in May 2023 at nearly $279 million.¹³ In fiscal year 2022, the SEC issued 103 awards totalling approximately $229 million.¹⁴

The SEC also has a record of imposing penalties on firms which violate whistleblowing rules. For example, earlier this year, an energy and technology firm was ordered to pay $225,000 for using employee separation agreements which forced employees to waive their rights to federal monetary whistleblower awards.¹⁵

Whilst the SEC has the benefit of being able to offer financial incentives to whistleblowers (the FCA lacks the statutory power to do so), there is also a distinct difference in tone, practice and outcomes between the two regulators.

What Is the FCA Proposing?

In the shadow of recent criticism, the FCA has pledged to improve its whistleblowing framework. In particular, and in light of the findings of the qualitative survey earlier this year, the FCA is proposing to:¹⁶

• Furnish whistleblowers with more detail on what has been done with the information provided. In the survey, 10 out of the 17 respondents had said that the FCA whistleblowing teams’ progress updates were “not at all reassuring”, with only two saying that they were “very reassuring”.¹⁷
• Improve the use of whistleblowers’ information across the FCA, by making the best use of the data received and “ensuring that end-to-end whistleblowing processes are as efficient as possible”. The FCA does not elaborate on what this will mean in practice.
• Improve its online webform to try to help the FCA to capture the information which is needed in the first instance, which is particularly important where whistleblowers want to remain anonymous. The FCA’s 2022 Q4 data shows that the online reporting form is consistently the most popular way for whistleblowers to make reports to the FCA,¹⁸ yet survey respondents said that whistleblowers did not feel that there was enough dialogue with the FCA to ensure that the regulator understood the report.¹⁹
• Engage with the Department for Business and Trade to support a review of whistleblower legislation to enhance the wider whistleblowing system.

Summary

It is clear that the FCA recognises its failings and is set to rectify them moving forward. With this in mind, and noting in particular that the FCA may want to move the spotlight from the regulator to the regulated, firms ought to make sure that they are fully aware of their obligations to have effective in-house whistleblowing procedures. The Handbook is prescriptive in terms of the necessary requirements and firms should take a moment to assess whether existing policies, procedures and practices are sufficiently robust.

The contribution of Masha Novikova is acknowledged and appreciated.

^{1 https://www.fca.org.uk/data/whistleblowing-qualitative-assessment-survey-2022.}

^{2 https://www.fca.org.uk/news/speeches/do-right-thing.}

^{3 A “reportable concern” is a concern held by any person in relation to the activities of a firm, including (a) anything that would be the subject matter of a protected disclosure, including breaches of the FCA’s rules, (b) a breach of the firm’s own policies and procedures, or (c) behaviour that harms or is likely to harm the reputation or financial well-being of the firm.}

^{4 https://www.handbook.fca.org.uk/handbook/SYSC/18/?view=chapter.}

^{5 https://www.handbook.fca.org.uk/handbook/SYSC/18/?view=chapter.}

^{6 https://www.fca.org.uk/freedom-information/information-whistleblowing-reports-2019-2021-may-2022.}

^{7 https://www.fca.org.uk/freedom-information/information-whistleblowing-reports-2019-2021-may-2022.}

^{8 https://www.fca.org.uk/data/whistleblowing-qualitative-assessment-survey-2022.}

^{9 After contacting individuals who had made a whistleblowing report in 2021-2022, the FCA received 21 fully completed survey responses out of a sample of 68 whistleblowers. The FCA considers this number of respondents sufficiently varied to meet the needs of its research.}

^{10 https://hansard.parliament.uk/commons/2019-07-03/debates/AA9B34FC-1CA3-4A24-9EEB-E37F6DE8EBF2/Whistleblowing.}

^{11 https://www.sec.gov/files/2022_ow_ar.pdf.}

^{12 https://www.sec.gov/files/2022_ow_ar.pdf.}

^{13 https://www.sec.gov/news/press-release/2023-89.}

^{14 https://www.sec.gov/files/2022_ow_ar.pdf.}

^{15 https://www.sec.gov/news/press-release/2023-172?utm_source=securitiesdocket.beehiiv.com&utm_medium=newsletter&utm_campaign=sec-charges-privately-held-company-with-violating-whistleblower-protection-rules.}

^{16 https://www.fca.org.uk/news/press-releases/fca-sets-out-steps-improve-whistleblower-confidence.}

^{17 https://www.fca.org.uk/data/whistleblowing-qualitative-assessment-survey-2022.}

^{18 https://www.fca.org.uk/data/whistleblowing-quarterly-data-2022-q4.}

^{19 https://www.fca.org.uk/data/whistleblowing-qualitative-assessment-survey-2022.}