FCA Handbook - SYSC 18 Whistleblowing

You are viewing SYSC 18 Whistleblowing as of . SYSC 18 Whistleblowing was last updated on 19/01/2026.

SYSC 18.1 Application and purpose

Application

This chapter applies to:

(1)
a firm;
(2)
in relation to the guidance in SYSC 18.3.9G, every firm;
(3)
in relation to SYSC 18.3.6R and SYSC 18.3.10R, EEA SMCR banking firms and overseas SMCR banking firms only in relation to a branch maintained by them in the United Kingdom; and
(4)
in relation to SYSC 18.6.1R to SYSC 18.6.3G (Whistleblowing obligations under MiFID):
1. (a)
  a UK MiFID investment firm, except a collective portfolio management firm; and
2. (b)
  a third country investment firm; and
(5)
in relation to SYSC 18.6.4G to SYSC 18.6.5G (Whistleblowing obligations under other EU legislation), a person within the scope of the identified EU sectoral and cross-sectoral legislation.

Firms are reminded that for the purpose of SYSC 18 (except for SYSC 18.3.9G) “firm” has the specific meaning set out in paragraph (8) of that definition in the Glossary, namely:

“(8) (in SYSC 18, with the exception of the guidance in SYSC 18.3.9G):
(a) a UK SMCR banking firm except a small deposit taker; and
(b)
a firm as referred to in Chapter 1.1 of the PRA Rulebook: Solvency II Firms: Whistleblowing Instrument 2015.”

In this chapter, a reference to a provision of the Employment Rights Act 1996 includes a reference to the corresponding provision of the Employment Rights (Northern Ireland) Order 1996.

A firm not referred to in SYSC 18.1.1AR may adopt the rules and guidance in this chapter as best practice. If so, it may tailor its approach in a manner that reflects its size, structure and headcount.

Purpose

(1)
The purposes of this chapter are to:
1. (a)
  set out the requirements on firms in relation to the adoption, and communication to UK-based employees, of appropriate internal procedures for handling reportable concerns made by whistleblowers as part of an effective risk management system (SYSC 18.3);
2. (b)
  set out the role of the whistleblowers’ champion (SYSC 18.4);
3. (c)
  require firms to ensure that settlement agreements expressly state that workers may make protected disclosures (SYSC 18.5) and do not include warranties related to protected disclosures;
4. (ca)
  set out the requirements which implemented the whistleblowing obligation under article 73(2) of MiFID, which requires MiFID investment firms (except collective portfolio management firms) to have in place appropriate procedures for their employees to report potential or actual infringements of the MiFID regime (SYSC 18.6);
5. (cb)
  outline other EU-derived whistleblowing obligations similar to those in article 73(2) of MiFID, some of which may also be applicable to MiFID investment firms (SYSC 18.6);
6. (d)
  outline best practice for firms which are not required to apply the measures set out in this chapter but which wish to do so; and
7. (e)
  outline the link between effective whistleblowing measures and fitness and propriety.
(2)
[deleted]

SYSC 18.3 Internal arrangements

Arrangements to be appropriate and effective

(1)
A firm must establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers.
(2)
The arrangements in (1) must at least:
1. (a)
  be able effectively to handle disclosures of reportable concerns including:
  1. (i)
    where the whistleblower has requested confidentiality or has chosen not to reveal their identity; and
  2. (ii)
    allowing for disclosures to be made through a range of communication methods;
2. (b)
  ensure the effective assessment and escalation of reportable concerns by whistleblowers where appropriate, including to the FCA or PRA;
3. (c)
  include reasonable measures to ensure that if a reportable concern is made by a whistleblower no person under the control of the firm engages in victimisation of that whistleblower;
4. (d)
  provide feedback to a whistleblower about a reportable concern made to the firm by that whistleblower, where this is feasible and appropriate;
5. (e)
  include the preparation and maintenance of:
  1. (i)
    appropriate records of reportable concerns made by whistleblowers and the firm’s treatment of these reports including the outcome; and
  2. (ii)
    up-to-date written procedures that are readily available to the firm’s UK-based employees outlining the firm’s processes for complying with this chapter;
6. (f)
  include the preparation of the following reports:
  1. (i)
    a report made at least annually to the firm’s governing body on the operation and effectiveness of its systems and controls in relation to whistleblowing (see SYSC 18.3.1R); this report must maintain the confidentiality of individual whistleblowers; and
  2. (ii)
    prompt reports to the FCA about each case the firm contested but lost before an employment tribunal where the claimant successfully based all or part of their claim on either detriment suffered as a result of making a protected disclosure in breach of section 47B of the Employment Rights Act 1996 or being unfairly dismissed under section 103A of the Employment Rights Act 1996;
7. (g)
  include appropriate training for:
  1. (i)
    UK-based employees;
  2. (ii)
    managers of UK-based employees wherever the manager is based; and
  3. (iii)
    employees responsible for operating the firms’ internal arrangements.

(1)
When establishing internal arrangements in line with SYSC 18.3.1R a firm may:
1. (a)
  draw upon relevant resources prepared by whistleblowing charities or other recognised standards setting organisations; and
2. (b)
  consult with its UK-based employees or those representing these employees.
(2)
In considering if a firm has complied with SYSC 18.3.1R the FCA will take into account whether the firm has applied the measures in (1).
(3)
A firm may wish to clarify in its written procedures for the purposes of SYSC 18.3.1R(2)(e)(ii), that:
1. (a)
  there may be other appropriate routes for some issues, such as employee grievances or consumer complaints, but internal arrangements as set out in SYSC 18.3.1R(2) can be used to blow the whistle after alternative routes have been exhausted, in relation to the effectiveness or efficiency of the routes; and
2. (b)
  nothing prevents firms taking action against those who have made false and malicious disclosures.

(1)
A firm may wish to operate its arrangements under SYSC 18.3.1R internally, within its group or through a third party.
(2)
Firms will have to consider how to manage any conflicts of interest.
(3)
If the firm uses another member of its group or a third party to operate its arrangements under SYSC 18.3.1R it will continue to be responsible for complying with that rule.

Training and development

A firm’s training and development in line with SYSC 18.3.1R(2)(g) should include:

(1)
for all UK-based employees:
1. (a)
  a statement that the firm takes the making of reportable concerns seriously;
2. (b)
  a reference to the ability to report reportable concerns to the firm and the methods for doing so;
3. (c)
  examples of events that might prompt the making of a reportable concern;
4. (d)
  examples of action that might be taken by the firm after receiving a reportable concern by a whistleblower, including measures to protect the whistleblower’s confidentiality; and
5. (e)
  information about sources of external support such as whistleblowing charities;
(2)
for all managers of UK-based employees wherever the manager is based:
1. (a)
  how to recognise when there has been a disclosure of a reportable concern by a whistleblower;
2. (b)
  how to protect whistleblowers and ensure their confidentiality is preserved;
3. (c)
  how to provide feedback to a whistleblower, where appropriate;
4. (d)
  steps to ensure fair treatment of any person accused of wrongdoing by a whistleblower; and
5. (e)
  sources of internal and external advice and support on the matters referred to in (a) to (d);
(3)
all employees of the firm, wherever they are based, responsible for operating the firm’s arrangements under SYSC 18.3.1R, how to:
1. (a)
  protect a whistleblower’s confidentiality;
2. (b)
  assess and grade the significance of information provided by whistleblowers; and
3. (c)
  assist the whistleblowers’ champion (see SYSC 18.4) when asked to do so.

Where a firm operates its arrangements under SYSC 18.3.1R through another member of its group or a third party it should consider providing the training referred to in SYSC 18.3.4G(3) to the persons operating the arrangements by the group member or third party.

Reporting of concerns by employees to regulators

This rule applies to an EEA SMCR banking firm and an overseas SMCR banking firm.

(1)
A person subject to this rule (‘P’) must, in the manner described in (2), communicate to its UK-based employees that they may disclose reportable concerns to the PRA or the FCA and the methods for doing so. P must make clear that:
1. (a)
  reporting to the PRA or to the FCA is not conditional on a report first being made using P’s internal arrangements;
2. (b)
  it is possible to report using P’s internal arrangements and also to the PRA or FCA; these routes may be used simultaneously or consecutively; and
3. (c)
  it is not necessary for a disclosure to be made to P in the first instance.
(2)
The communication in (1) must be included in the firm’s employee handbook or other equivalent document.

Firms must ensure that their appointed representatives or, where applicable, their tied agents, inform any of their UK-based employees who are workers that, as workers, they may make protected disclosures to the FCA.

Appointed representatives and tied agents

Firms are encouraged to invite their appointed representatives or, where applicable, their tied agents to consider adopting appropriate internal procedures which will encourage workers with concerns to blow the whistle internally about matters which are relevant to the functions of the FCA or PRA.

Link to fitness and propriety

The FCA would regard as a serious matter any evidence that a firm had acted to the detriment of a whistleblower. Such evidence could call into question the fitness and propriety of the firm or relevant members of its staff, and could therefore, if relevant, affect the firm’s continuing satisfaction of threshold condition 5 (Suitability) or, for an approved person or a certification employee, their status as such.

Additional rules for UK branches

(1)
This rule applies where an EEA SMCR banking firm or an overseas SMCR banking firm has:
1. (a)
  a branch in the United Kingdom; and
2. (b)
  a group entity which is a UK SMCR banking firm.
(2)
An EEA SMCR banking firm and an overseas SMCR banking firm must, in the manner described in (3), communicate to the UK-based employees of its UK branch:
1. (a)
  the whistleblowing arrangements of the group entity that is a UK SMCR banking firm; and
2. (b)
  indicate that these arrangements may be used by employees of its UK branch.
(3)
The communication in (2) must be included in the branch’s employee handbook or other equivalent document.

SYSC 18.4 The whistleblowers’ champion

(1)
A UK SMCR banking firm is required under SYSC 24.2.1R to allocate the FCA-prescribed senior management responsibility for acting as the firm’s whistleblowers’ champion.
(2)
SYSC 18.4.2R requires the appointment by an insurer of a director or senior manager as its whistleblowers’ champion.
(3)
This section sets out the role of the whistleblowers’ champion.
(4)
The FCA expects that a firm will appoint a non-executive director as its whistleblowers’ champion. A firm that does not have a non-executive director would not be expected to appoint one just for this purpose.

An insurer must appoint a director or senior manager as its whistleblowers’ champion.

A firm must assign the responsibilities set out in SYSC 18.4.4R to its whistleblowers’ champion.

A firm must allocate to the whistleblowers’ champion the responsibility for ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing (see SYSC 18.3 (Internal Arrangements)) including those policies and procedures intended to protect whistleblowers from being victimised because they have disclosed reportable concerns.

The whistleblowers’ champion:

(1)
should have a level of authority and independence within the firm and access to resources (including access to independent legal advice and training) and information sufficient to enable him to carry out that responsibility;
(2)
need not have a day-to-day operational role handling disclosures from whistleblowers; and
(3)
may be based anywhere provided he can perform his function effectively.

The role of a whistleblowers’ champion, before the introduction of his or her responsibilities under those provisions of SYSC 18 which are to come into force on 7 September 2016, includes oversight of the firm’s transition to its new arrangements for whistleblowing.

SYSC 18.5 Settlement agreements with workers

A firm must include a term in any settlement agreement with a worker that makes clear that nothing in such an agreement prevents a worker from making a protected disclosure.

(1)
Firms may use the following wording, or alternative wording which has substantively the same meaning, in any settlement agreement:
“For the avoidance of doubt, nothing precludes [name of worker] from making a “protected disclosure” within the meaning of Part 4A (Protected Disclosures) of the Employment Rights Act 1996. This includes protected disclosures made about matters previously disclosed to another recipient.”
(2)
Compliance with (1) may be relied on as tending to establish compliance with SYSC 18.5.1R.

(1)
Firms must not request that workers enter into warranties which require them to disclose to the firm that:
1. (a)
  they have made a protected disclosure; or
2. (b)
  they know of no information which could form the basis of a protected disclosure.
(2)
Firms must not use measures intended to prevent workers from making protected disclosures.

SYSC 18.6 Whistleblowing obligations under the MiFID regime and other sectoral legislation

Whistleblowing obligations under the MiFID regime

(1)
A MiFID investment firm (except a collective portfolio management investment firm) must have appropriate procedures in place for its employees to report a potential or actual breach of:
1. (a)
  any rule which implemented MiFID; or
2. (b)
  a requirement imposed by MiFIR or any onshored regulation which was previously an EU regulation adopted under MiFID or MiFIR.
(2)
The procedures in (1) must enable employees to report internally through a specific, independent and autonomous channel.
(3)
The channel referred to in (2) may be provided through arrangements made by social partners, subject to the Public Interest Disclosure Act 1998 and the Employment Rights Act 1996 to the extent that they apply.

[Note: article 73(2) of MiFID]

SYSC 18.6.1R applies to a third country investment firm as if it were a MiFID investment firm (unless it is a collective portfolio management investment firm) when the following conditions are met:

(1)
it carries on MiFID or equivalent third country business; and
(2)
it carries on the business in (1) from an establishment in the United Kingdom.

When considering what procedures may be appropriate for the purposes of SYSC 18.6.1R(1), a UK MIFID investment firm or a third country investment firm may wish to consider the arrangements in SYSC 18.3.1R(2).

Whistleblowing obligations under other sectoral legislation

In addition to obligations under the MiFID regime, similar whistleblowing obligations apply to miscellaneous persons subject to regulation by the FCA under the following non-exhaustive list of legislation:

(1)
article 32(3) of the Market Abuse Regulation, as implemented in section 131AA of the Act;
(2)
[deleted]
(3)
the UK provisions which implemented article 99d(5) of the UCITS Directive (see SYSC 4.1.1ER in respect of UK UCITS management companies, and COLL 6.6B.30R in respect of depositaries);
(4)
article 24(3) of the securities financing transactions regulation; and
(5)
regulation 45 of the Public Offers and Admissions to Trading Regulations as regards reporting of infringements.

Depending on the nature of its business, in addition to SYSC 18.6.1R, a MiFID investment firm may, for example, be subject to one or more of the requirements in SYSC 18.6.4G.