In March, the FCA launched its “In confidence, with confidence” campaign, aimed at encouraging employees and ex-employees of financial services firms to report potential wrongdoing directly to the FCA. Whilst the reporting of potential wrongdoing directly to the FCA is not a new concept, the launching of this campaign signals that the FCA continues to view whistleblowing as a key priority, and as playing a key role in helping the regulator to discharge its duties of protecting consumers, markets and firms.
Interestingly, the campaign extends its reach to also encourage individuals who have a personal relationship with employees and ex-employees of firms to report potential wrongdoing for example, family members, close friends and neighbours. No doubt the pandemic and the new norm of remote working have played a part in the decision to extend the reach, with working from home arrangements creating further opportunities for conduct risk, and for potential misconduct to be spotted by those outside of the organisation.
To support the campaign the FCA has produced:
- materials for firms to share with their employees, including an employee leaflet and campaign posters; and
- a toolkit for industry bodies and consumer groups to encourage people to blow the whistle.
The FCA has also updated its website with further information for potential reporters, including emphasising the confidentiality processes that exist around whistleblowing, and explaining that whistleblowers can remain anonymous. It has also increased its internal whistleblowing resourcing, meaning that every report will be reviewed and whistleblowers will have a dedicated case manager who they can meet with, in addition to enhancing training provided to those within its whistleblowing team so they are better placed to respond to information provided and protect identities of reporters. In addition, the FCA is working to expand the channels through which individuals can blow the whistle, by developing an online confidential form.
Impact for financial services firms
If more employees and/ or close connections decide to report concerns directly to the FCA, there are several challenges for firms including:
- Losing control over the investigation into the issues – key decisions will be taken by individuals who are disconnected from the firm and lack relevant corporate memory. As such, decisions may be made in absence of important and relevant context as to the firm and its internal workings. It may be difficult for the regulator to form an early view on whether a report is a disgruntled employee or an issue requiring wider investigation. Further, decisions around scope, what data is considered, who is spoken to, overall findings and what is done with findings will be directed by the FCA.
- Data security / confidentiality – the firm will be one step removed from the investigation process and any controls put in place. As such, firms may lose an element of control over what data is shared and in what format (including a risk that privileged or highly confidential material is inadvertently disclosed), in addition to the channels through which data is shared. This may in turn increase the risk of leaks to the press.
- The opening of another lens through which the FCA can scrutinise firms – FCA whistleblowing channels will supplement supervisory and enforcement work and may lead to more opportunities for independent review (i.e., S.166 reviews) or referrals to enforcement. Whistleblowing reports inherently have an individual focus and therefore reports to the FCA may result in more enforcement action taken against individuals than has historically been seen.
- The opportunity for regulators to form more of a holistic view of culture – whilst regulators are typically notified of reports involving senior managers, the potential for a wider range of concerns to be referred to the FCA will provide regulators with more of a holistic view of a firm’s culture / cultural direction.
- Disruption to business – FCA whistleblowing channels may lead to a multiplicity of investigations running concurrently and focussed on the same issue or business area which could, in turn, cause business disruption which may be difficult to manage.
- Less opportunity to have disciplinary / conduct investigations running in tandem with the whistleblowing process – it may be necessary to await findings of FCA investigations before instigating these internal processes. This may result in the overall process being drawn out for longer, meaning a poorer colleague experience.
- Reporters remaining anonymous – if a reporter to the FCA wishes to remain anonymous, firms may not be able to ensure that the individual has appropriate pastoral care internally, or consider whether changes to job roles and working patterns are necessary during the investigation process.
- Working from home arrangements – increases the opportunity for family members / friends of employees to report to the FCA, particularly as they may not be privy to internal whistleblowing arrangements. Further, challenges may arise if family members or friends make a report to the FCA without the consent of the employee. That raises a number of wider issues including the potential for adverse impact on the employee in undertaking their day job.
- Loss of privilege in investigation material – less opportunity for firms to instruct external counsel to investigate particularly sensitive reports and assert privilege over investigation materials / advice.
What financial services firms should be doing in response
Firms should continue to focus efforts on fostering an environment where it is safe to speak up internally, and ensuring that employees have faith in internal whistleblowing arrangements, so that employees feel confident in using internal channels as the first port of call. At the same time, firms should also ensure there are appropriate controls around, and staff awareness of, data security risks. This may be achieved through several means including:
- Refreshing whistleblowing, conduct, internal investigation and disciplinary processes and policies to ensure they are robust, fair and independent, but also account for the interplay with potential FCA investigations.
- Ensuring whistleblowing governance arrangements and decisions made by senior staff can stand up to regulatory scrutiny.
- Providing a number of channels through which employees can raise concerns and that those channels are accessible to third parties.
- Considering trends in whistleblowing reports and proactively addressing any concerns in particular areas.
- Embedding lessons learned from previous whistleblowing investigations.
- Refreshing the tone of strategies, plans, values and mission statements, to include a focus on purpose and psychological safety.
- Having in place appropriate and independent pastoral care for employees who blow the whistle and/or are involved in a whistleblowing investigation, and generating awareness of the support channels available.
- Delivering managerial training with a focus on the importance of culture, setting expected behaviours and encouraging employees to speak up, in addition to soft skills needed to identify and appropriately address / escalate reports.
- Rolling out communications to remind employees of the right to blow the whistle, the investigation process and arrangements in place to protect reporters.
- Revisiting data security policies and contractual arrangements around data security and confidentiality – with a view to reminding employees of their contractual obligations, the different categories of data, risks around privileged and confidential materials and data security controls.
- Early engagement with press teams to ensure the firm is well equipped to identify and respond to any potential leaks associated with investigations being undertaken by the FCA.
- Undertaking frequent cultural reviews with a view to gathering feedback on psychological safety, and ensuring that findings are addressed and embedded.
Ultimately it is hoped that the campaign will be a catalyst for positive change. It not only provides a further opportunity for misconduct to be reported, and therefore strengthens the culture and conduct toolkit available to the sector, but is also a useful opportunity for firms to ensure that their policies and processes are robust and effective. If the campaign assists in encouraging a culture where individuals can escalate incidents when they see misconduct, safe in the knowledge that their identity will be protected and the misconduct dealt with, then it will have achieved its aim.