Whistleblowing in Banks: Fraud, Misconduct and Anonymous Reporting

What is whistleblowing in banking?

Whistleblowing in banking is when a worker raises a concern about wrongdoing, misconduct, or risk that they reasonably believe is in the public interest. This may involve fraud, money laundering, market misconduct, customer harm, regulatory breaches, or the concealment of any of these matters.

UK banking whistleblowing sits under two overlapping frameworks: the general whistleblowing law in the Public Interest Disclosure Act 1998 (PIDA), and additional requirements that the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) apply to certain regulated firms.

The FCA describes a whistleblower as someone who reports wrongdoing by an individual or firm it regulates. That can include an employee, contractor, agency worker, or former worker of a regulated firm. The stakes are high: banks handle public money, and failures in governance and integrity can have serious consequences for customers, markets, and the wider economy. The Parliamentary Commission on Banking Standards, following the LIBOR scandal and other misconduct, recommended in 2013 that banks put in place mechanisms to allow employees to raise concerns internally.

For the legal basics, see What Is Whistleblowing? Meaning, Examples and UK Law. For how Disclosurely supports regulated-firm intake, case ownership, and board-ready records, see Finance & regulated teams.

This guide is for informational purposes only and does not constitute legal advice. Organisations and individuals should consult qualified legal professionals about their specific circumstances.

Examples of whistleblowing in banking

These are realistic examples of concerns that could amount to whistleblowing. Whether a disclosure is legally protected depends on the circumstances, including whether the worker reasonably believes the information tends to show qualifying wrongdoing and that the disclosure is in the public interest.

Important: These are examples only. Whether a specific situation qualifies as a protected disclosure depends on the facts and legal tests. This is not legal advice.

These themes commonly need named ownership across compliance, financial crime, and conduct / People teams—without mixing staff disclosures into customer complaints systems. See Finance & regulated teams.

Why whistleblowing matters in banking

Whistleblowing is critical to banking governance for several reasons:

Systemic risk: Banks that fail to identify and address misconduct can harm customers, destabilise markets, and damage public trust. Whistleblowers can provide vital intelligence that regulators might not otherwise receive.

Regulatory expectation: The FCA and PRA expect senior managers and firms to have adequate procedures for individuals to raise concerns—and for those concerns to be taken seriously and actioned appropriately.

Individual accountability: The Senior Managers Regime places personal accountability on senior leaders. A failure to act on whistleblowing concerns can expose managers to Conduct Rule findings, depending on the facts.

A source of intelligence: The Bank of England and PRA, as prescribed persons, note that whistleblowing can provide a vital source of information which helps them identify risks to the firms they regulate.

FCA whistleblowing rules for banks

Certain banks and other regulated financial firms are subject to specific FCA/PRA whistleblowing requirements under SYSC 18. The exact requirements depend on the firm’s regulatory status and activities. Other firms may use the same framework as good practice.

Where the rules apply, SYSC 18 expects firms to establish effective arrangements for reportable concerns. The Handbook requirements are set out in SYSC 18 – Whistleblowing.

Key FCA requirements

Appropriate and effective arrangements

Firms must establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers.

Anonymous reporting

The arrangements must be able to handle disclosures where the whistleblower has requested confidentiality or has chosen not to reveal their identity. For banks in scope, that effectively requires a workable model of anonymous reporting for banks—not only a policy statement.

Written whistleblowing procedures

Firms must prepare and maintain written whistleblowing procedures that are readily available to all UK-based employees, outlining the firm’s processes.

Whistleblowers’ Champion

Firms must appoint a Whistleblowers’ Champion—a non-executive director and Senior Manager—with individual responsibility for ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing.

Annual report to the governing body

A report must be prepared at least annually to the firm’s governing body on the operation and effectiveness of its whistleblowing systems and controls. The report must maintain the confidentiality of individual whistleblowers.

Feedback to whistleblowers

Firms must provide feedback to a whistleblower about a reportable disclosure, where this is feasible and appropriate.

Employment tribunal reporting

The firm must prepare prompt reports to the FCA regarding each case where the firm lost an employment tribunal claim based on whistleblowing detriment or dismissal.

Training

Firms must include appropriate training for all UK-based employees, managers of UK-based employees (regardless of where the manager is based), and employees responsible for operating the firm’s internal arrangements.

Effective assessment and escalation

Firms must ensure the effective assessment and escalation of reportable concerns, including to the FCA or PRA, where appropriate.

Records

Firms must prepare and maintain appropriate records of reportable concerns and the firm’s treatment of these reports, including the outcome.

What is a “reportable concern”?

The FCA rules apply to “reportable concerns” rather than only statutory protected disclosures. This can be broader than the PIDA test and may encompass:

• any matter that the firm is required to report to the FCA or PRA
• any other matter which the firm considers may be of material significance to the FCA or PRA

PRA requirements for banks

The Prudential Regulation Authority (PRA) has related whistleblowing rules reflecting the joint approach adopted in 2016. The PRA, which forms part of the Bank of England, is also a prescribed person under PIDA.

PRA requirements include

• Direct reporting to regulators: Firms must communicate to UK-based employees that they may disclose reportable concerns to the PRA or FCA, and that reporting to the regulator is not conditional on a report first being made internally.
• Whistleblowers’ Champion: The same Champion-style accountability appears under the PRA regime alongside FCA rules.
• Annual reporting: The Bank of England (including the PRA) publishes an annual report on whistleblowing disclosures, detailing the number of disclosures received and actions taken.

Direct reporting to regulators

Crucially, firms in scope must make clear to employees that they can approach the regulator directly without first raising a concern internally, and that these routes may be used simultaneously or consecutively. This is an important protection for banking whistleblowers.

What is a Whistleblowers’ Champion?

The Whistleblowers’ Champion is a non-executive director and Senior Manager within a regulated firm who has individual responsibility for ensuring and overseeing the integrity, independence and effectiveness of the firm’s whistleblowing policies and procedures.

Responsibilities include

• overseeing the firm’s whistleblowing arrangements
• ensuring that the firm is prepared for regulatory requirements
• receiving reports on the operation and effectiveness of whistleblowing systems and controls
• ensuring that the firm informs the FCA/PRA if it loses an employment tribunal whistleblowing claim

Personal accountability

The Champion’s Senior Manager responsibilities mean failures in oversight can become a personal accountability issue. The FCA would regard as a serious matter any evidence that a firm acted to the detriment of an employee because they made a reportable concern. A failure to comply with applicable SYSC 18 obligations can leave a firm exposed to reputational harm, individual claims, and regulatory enforcement.

How bank employees can raise concerns internally

A bank’s internal whistleblowing procedure should provide clear channels for raising concerns. Where SYSC 18 applies, those arrangements must be accessible and effective.

Internal routes

1. Line manager or senior manager

Often the first step—unless your manager is implicated, conflicted, or you do not feel safe using that route.

2. Whistleblowers’ Champion

The Whistleblowers’ Champion is responsible for overseeing the firm’s policies and can be approached, although they may not handle individual cases day to day.

3. Compliance or legal teams

For regulatory or legal concerns, compliance is often the appropriate contact.

4. HR / People

For employment-related concerns or broader misconduct themes that sit with People ownership.

5. Specialist whistleblowing channels

Many firms provide a confidential or anonymous reporting channel, often via phone or web-based portal. Where the rules apply, arrangements must support anonymity and confidentiality.

Practical considerations

• Records: Keep a careful record of what you have observed and your concerns.
• Clear communication: Make it as clear as possible to your employer that you are making a disclosure (ACAS guidance emphasises this).
• Written disclosure: While not required, putting it in writing helps create evidence.
• Independent advice: Consulting an independent legal or other adviser can be helpful. Advice from a lawyer may attract legal advice privilege.

For firms designing internal routes that staff will actually use, see Speak-up programmes and Ethics & compliance.

How bank employees can report concerns externally

Under both FCA and PRA rules (where they apply), employees can report concerns directly to regulators without first reporting internally.

FCA

The FCA has a dedicated whistleblowing team. Workers can report concerns about wrongdoing by an individual or firm regulated by the FCA.

How to report

Use the FCA’s current guidance and contact routes on Whistleblowing (FCA). That page explains who can make a report, what to include, and how reports are handled. Contact details can change, so rely on the regulator’s own page rather than outdated phone numbers or inboxes copied into policy documents.

What FCA accepts

• workers and ex-workers of regulated firms (employees, contractors, agency staff), and certain people with a clear need for confidentiality in limited circumstances
• anonymous disclosures — but if you provide no contact details, the FCA may be unable to ask follow-up questions, which can restrict meaningful action
• if you provide contact details, the FCA states that this information is known to the whistleblowing team and is not shared with the firm or individual you are reporting

What FCA does not accept

• consumers (use ordinary consumer contact routes)
• shareholders raising ordinary shareholder issues
• a firm reporting another firm through the worker whistleblowing route
• reports that solely relate to employment disputes

What to include

• specific examples of wrongdoing, key dates, and names of individuals involved where known
• enough detail for assessment—insufficient detail can limit action
• do not proactively seek out or obtain new information on behalf of the FCA, as this might place you at risk

Limitations

• every disclosure will be assessed, but not every disclosure results in significant action
• the FCA does not usually comment on or participate in employment tribunal proceedings

PRA / Bank of England

The Bank of England and PRA are prescribed persons under PIDA.

How to report

See the Bank’s current page: Whistleblowing and the Bank of England. Use the contact routes published there for confidential disclosures within the Bank/PRA remit.

Process

• the Bank assigns a dedicated case officer to listen to and understand concerns
• concerns and personal information are treated in confidence

Annual reporting

Since April 2017, prescribed persons are required to report annually on whistleblowing disclosures they have received. The Bank of England’s annual report sets out the number of disclosures received and actions taken.

Always check the current GOV.UK prescribed persons list before disclosing externally.

Can bank employees report concerns anonymously?

Yes. Where the SYSC 18 arrangements apply, firms must be able to handle disclosures where the whistleblower has requested confidentiality or has chosen not to reveal their identity. That is the regulatory backbone of anonymous reporting for banks.

Anonymous vs confidential

How secure anonymous systems work

Traditional anonymous methods can make follow-up difficult. Some anonymous reporting software for banks allows secure two-way communication without requiring the reporter to reveal their identity. When a report is submitted, the reporter receives a unique access code and can return to check status and respond to messages without revealing who they are.

FCA anonymous reporting

The FCA also accepts anonymous disclosures. However, if you submit an anonymous disclosure with no contact details, the FCA notes it may be unable to contact you with additional questions, which may restrict meaningful action. Providing as much specific detail as possible still helps assessment.

For banks evaluating internal anonymous and confidential portals alongside Champion oversight—not as a substitute for FCA/PRA routes—see Finance & regulated teams and Anonymous reporting.

What legal protection do banking whistleblowers have?

Workers who make a protected disclosure are legally protected under UK employment law.

What is a protected disclosure?

Protection depends on:

• a qualifying disclosure — you reasonably believe the information tends to show a specified type of wrongdoing and that disclosure is in the public interest
• a protected route — for example to your employer, a prescribed person such as the FCA or PRA, or another route that meets the statutory conditions

For a fuller walkthrough, see Protected disclosure explained.

Qualifying wrongdoing (summary)

The worker must reasonably believe the information tends to show one or more of:

• a criminal offence has been, is being, or is likely to be committed
• a breach of a legal obligation
• a miscarriage of justice
• a danger to the health or safety of any individual
• damage to the environment
• sexual harassment
• the deliberate concealment of information about any of the above

The belief has to be reasonable, but it does not have to be correct. A worker who reasonably believes wrongdoing is occurring may still be protected even if it turns out they were mistaken—subject to the route-specific tests. Higher thresholds can apply to some external disclosures.

Public interest

This requirement was added by the Enterprise and Regulatory Reform Act 2013 to stop PIDA being used to rebadge personal employment disputes as whistleblowing. A disclosure may be in the public interest even if it affects a relatively small group, such as colleagues or customers. The question is whether the worker reasonably believed the disclosure was in the public interest, and that belief must be objectively reasonable. See Public interest test explained.

A worker’s motive is not the deciding factor—a disclosure may be in the public interest even if the worker also has a personal stake.

Protection from detriment

Workers are protected from being subjected to a detriment because they made a protected disclosure. That can include bullying or harassment, reduced hours, demotion, exclusion from meetings, or refused training.

Protection from unfair dismissal

Where an employee is dismissed because they made a protected disclosure—and the statutory conditions for that protection are met—the dismissal is automatically unfair. Simply labelling a concern as “whistleblowing” does not create that protection on its own.

Key points

• No qualifying service period for automatic unfair dismissal based on whistleblowing
• No ordinary unfair-dismissal financial cap on whistleblowing compensation
• Good faith is no longer a condition of protection (since 2013); a tribunal may still reduce compensation by up to 25% if it finds a disclosure was not made in good faith
• Short tribunal time limits usually apply (often three months less one day, subject to ACAS Early Conciliation)
• Former workers can still bring detriment claims linked to a disclosure made while they worked there

Regulatory protections

• The FCA would regard as a serious matter any evidence that a firm acted to the detriment of an employee because they made a reportable concern.
• From 1 September 2026, FCA non-financial misconduct rules and guidance will also strengthen the regulatory treatment of certain workplace misconduct. Future Conduct Rule guidance expressly identifies subjecting a colleague to significant detriment for using a firm’s whistleblowing procedures as conduct that may breach the integrity rule.

What is not protected

• personal grievances without public interest are not protected as whistleblowing
• malicious or knowingly false allegations made to harm someone are not protected

What happens after a whistleblowing report is made?

The process varies by firm, but the FCA expects robust procedures where the rules apply.

FCA expectations

• Acknowledgment: the report should be acknowledged
• Triage: a triage process may be needed to establish the level of review
• Assessment: assess the concern, identify whether it is a protected disclosure / reportable concern, and determine ownership
• Investigation: if needed, set governance, terms of reference, and escalation protocol
• Feedback: provide feedback where feasible and appropriate
• Records: maintain appropriate records of reportable concerns and outcomes
• Escalation: escalate to the FCA or PRA where appropriate
• Annual reporting: report to the governing body on the operation and effectiveness of whistleblowing systems and controls at least annually

Practical process

1. Report received: the concern is logged and acknowledged.
2. Initial assessment: the firm assesses policy fit and whether the matter involves a protected disclosure / reportable concern.
3. Confidentiality: the firm must protect the reporter’s identity.
4. Investigation or referral: investigate internally or refer to the FCA, PRA, or another appropriate body.
5. Outcome and feedback: inform the reporter of the outcome—or why no action was taken—where contactable.
6. Records: maintain appropriate records for audit, regulatory, and governance purposes.

A careful record should be made of the basis for any decision that a concern does not warrant investigation. This matters for evidencing compliance.

Fraud reporting and whistleblowing

Fraud and financial crime are among the most common subjects of whistleblowing in banking. The connection between whistleblowing and fraud reporting is therefore practical, not theoretical.

How fraud reporting relates to whistleblowing

Fraud reporting is an operational process for receiving and investigating allegations of fraud. It can be a subset of whistleblowing, but not every whistleblowing concern is about fraud, and not every fraud report is whistleblowing (some fraud is identified via other means).

When a concern about suspected fraud is reported through a whistleblowing channel, it may need to move through a structured process:

1. Report received – via a secure channel
2. Triage – assess the nature of the fraud concern
3. Conflict check – ensure the handler is not implicated
4. Case assignment – assign to fraud specialists or investigators
5. Evidence preservation – secure relevant data and documents
6. Investigation – investigate in line with firm policy and regulatory requirements
7. Secure reporter communication – follow up with the reporter for clarification (without revealing identity)
8. Escalation – escalate internally or to regulators as appropriate
9. Outcome – reach a decision and take action
10. Audit/record retention – document the process for regulatory and governance purposes

Why structured fraud reporting systems matter

Relying purely on an email inbox, shared drive, or hotline can make this process difficult. A structured reporting and case management system can support:

• Consistent report capture – ensuring relevant information is gathered
• Reporter identity protection – maintaining anonymity or confidentiality
• Case assignment – directing reports to the right people
• Access control – ensuring only authorised staff see sensitive information
• Evidence preservation – securely storing documents and data
• Audit trails – recording who accessed a case, when, and why
• Investigation tracking – documenting progress, decisions, and outcomes
• Secure follow-up – enabling communication with reporters without compromising identity
• Governance reporting – providing oversight to the Whistleblowers’ Champion and board

For the operational pattern behind that workflow, see Fraud reporting and When reporting tools need case management.

What banks should have in place

Regulated financial services firms subject to SYSC 18 need more than a PDF policy. Good practice also helps firms outside mandatory application who adopt the framework as best practice.

Legal and regulatory requirements (where applicable)

• appropriate and effective whistleblowing arrangements under SYSC 18
• a Whistleblowers’ Champion (non-executive director and Senior Manager)
• written whistleblowing procedures available to all UK-based employees
• anonymous and confidential handling capabilities
• training for all relevant employees and managers
• records of reportable concerns and outcomes
• annual report to the governing body
• feedback to whistleblowers where feasible and appropriate
• escalation to FCA/PRA where appropriate
• employment tribunal reporting
• communication to employees that they may report to regulators directly

Good practice

• A speak-up culture: senior leaders should actively foster speaking up and listening up
• Regular review: policies and procedures should be reviewed regularly
• Handler training: those who receive and deal with reports should understand internal guidance and FCA expectations
• Governance: a whistleblowing working group or similar forum can help
• Triage: use triage to establish the level of review needed
• Confidentiality discipline: train handlers on protecting identity and preserving anonymity

For regulated firms evaluating platform support for intake, ownership, and chronology—not as a substitute for Champion accountability—see Finance & regulated teams, Whistleblowing software, and Case management.

Whistleblowing vs grievance in banking

Grievances can also amount to whistleblowing if they contain an appropriate disclosure of information and should be dealt with as such.

If a personal grievance also involves a wider public interest issue, it may contain whistleblowing elements. A worker’s motive does not of itself prevent a disclosure from qualifying.

For a detailed comparison, see Whistleblowing vs Grievance: What's the Difference?.

Give bank employees a secure way to report concerns

Banks use reporting and disclosure software such as Disclosurely to offer a secure channel for anonymous and confidential concerns—with two-way follow-up, case ownership, evidence handling, and an audit trail—alongside Champion oversight, compliance ownership, and financial-crime escalation (not instead of FCA/PRA routes).

See Finance speaking-up routes →

Also useful when evaluating fit: Anonymous reporting · Whistleblowing software

Whistleblowing in banks FAQs

What is whistleblowing in banking?

Whistleblowing in banking is when a worker raises a concern about wrongdoing, misconduct, or risk that they reasonably believe is in the public interest. This may involve fraud, money laundering, market misconduct, customer harm, regulatory breaches, or the concealment of any of these matters.

What are examples of whistleblowing in a bank?

Fraud, money laundering, market misconduct, customer harm, regulatory breaches, conflicts of interest, bribery, falsification of records, and sexual harassment. These are examples only; whether any particular situation qualifies as whistleblowing depends on the facts.

Can bank employees report fraud anonymously?

Yes. Where SYSC 18 applies, arrangements must handle disclosures where the whistleblower has requested confidentiality or chosen not to reveal their identity. Anonymous reporting for banks works best when firms can still assess, escalate, and—where using anonymous reporting software for banks—follow up securely without forcing identity disclosure.

Can a bank employee report directly to the FCA?

Yes. Firms in scope must communicate that employees may disclose reportable concerns to the FCA or PRA, and that reporting to the regulator is not conditional on first reporting internally. Start with the FCA whistleblowing page.

What is an FCA Whistleblowers’ Champion?

A non-executive director and Senior Manager with individual responsibility for ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing.

Are whistleblowers protected from dismissal?

Not lawfully where the reason for dismissal is that you made a protected disclosure—and only if the statutory tests are met. Simply calling a concern “whistleblowing” is not enough.

What happens after a bank receives a whistleblowing report?

The bank should acknowledge the report, triage it, investigate if necessary, provide feedback where feasible and appropriate, record the outcome, and escalate to the FCA/PRA where appropriate.

What is the difference between whistleblowing and a grievance?

A grievance is usually personal to your employment. Whistleblowing is about public-interest wrongdoing. Grievances can also amount to whistleblowing if they contain an appropriate public-interest disclosure—see Whistleblowing vs Grievance.

Does suspected money laundering count as whistleblowing?

Yes. If a worker reasonably believes money laundering is occurring, or has occurred, this can fall within the “criminal offence” or “breach of legal obligation” category of qualifying disclosures and may be whistleblowing, provided the public interest test is met.

Sources

1. FCA Handbook – SYSC 18 Whistleblowing
2. FCA – Whistleblowing
3. Bank of England – Whistleblowing
4. GOV.UK – Whistleblowing for employees
5. GOV.UK – List of prescribed people and bodies
6. Protect – independent whistleblowing advice
7. ACAS – Whistleblowing at work

This guide is for informational purposes only and does not constitute legal advice. Organisations and individuals should consult qualified legal professionals about their specific circumstances.