Industry guide · Finance & Regulated Teams
Whistleblowing and conduct reporting for regulated firms
Disclosure routes aligned with FCA whistleblowing expectations, SYSC governance, and SMCR accountability—distinct from customer complaints and operational incident systems.
Regulated firms must show that disclosures are received, owned, and documented. The FCA received 281 new whistleblowing reports in Q1 2025 containing 752 allegations; 41% resulted in action to reduce harm. Firms need intake and case management that produces a defensible record—not a shared compliance inbox.
New whistleblowing reports received by the FCA in Q1 2025.
Source: FCA whistleblowing quarterly data, Q1 2025 · View source
Allegations contained in FCA Q1 2025 whistleblowing reports.
Source: FCA whistleblowing quarterly data, Q1 2025 · View source
Of FCA Q1 2025 whistleblowing reports where the FCA took action to reduce harm.
Source: FCA whistleblowing quarterly data, Q1 2025 · View source
Operational context
Typical concerns in regulated financial services
Speaking-up in regulated firms sits between conduct risk, financial crime controls, and personal accountability under SMCR. The FCA's non-financial misconduct survey found bullying and harassment at 26% and discrimination at 23% of reported misconduct types—routing must treat conduct and compliance disclosures with equal rigour.
Disclosures conflated with customer complaints
Staff concerns about conduct, controls, or culture must not be logged in consumer redress or complaints systems lacking investigation workflow and audit trail.
FCA whistleblowing channel vs internal route unclear
Workers may not know when to use the FCA's prescribed-person route versus internal compliance—and internal routes must still produce regulator-ready documentation.
SMCR accountability without case ownership
Senior manager conduct concerns need named investigation owners and controlled visibility—not informal escalation to the SMF holder's inbox.
Follow-up pushes reporters into corporate email
FCA Q1 2025 data shows most whistleblowers included contact details; firms still need secure internal follow-up that protects identity when reporters choose anonymity.
Process design
Reporting workflow in regulated firms
A six-step route connecting disclosure intake, compliance ownership, and board-ready records—without mixing whistleblowing into unrelated operational systems.
Worker submits via secure portal or documented hotline route
Owner: Anonymous or identified reporter
Category assigned; FCA reportability assessed where applicable
Owner: Compliance intake
Named SMF holder or 2LoD lead takes ownership
Owner: Compliance / risk
Clarification and evidence via protected messaging
Owner: Assigned investigator
Findings documented with role-based access
Owner: Compliance, HR, or financial crime
Outcome logged; themes for audit committee and regulator-ready export
Owner: Company secretariat / board
Organisational design
Typical governance structure
Speaking-up routes map to three lines of defence—business ownership, compliance oversight, and independent assurance.
Speaking-up routes mapped to regulatory governance
Day-to-day conduct and control ownership
Oversight, policy, whistleblowing triage
Independent assurance and board reporting
Scenarios
Industry-specific examples
Illustrative scenarios—ownership varies by firm type, SMF structure, and whether the FCA prescribed-person route applies.
Paraplanner reports targets that encourage unsuitable product recommendations; requests anonymity from line management.
Operations analyst flags systematic easing of CDD checks on a high-value client segment.
Relationship manager reports undisclosed hospitality from a vendor linked to procurement decisions.
Control-function staff raise bullying by a senior manager with certified SMF responsibilities.
Taxonomy
Risk categories commonly reported
Taxonomy aligned to FCA whistleblowing themes and internal conduct frameworks—supporting triage between compliance, HR, and financial crime owners.
Conduct (NFMI)
Bullying, harassment, discrimination, and non-financial misconduct—26% and 23% respectively in FCA survey data.
Financial crime
AML, sanctions, fraud, and market abuse concerns requiring financial crime investigation.
Regulatory breach
Policy, permissions, and conduct-of-business failures with regulatory reporting implications.
Governance & SMCR
Senior manager conduct, control failures, and board-level accountability concerns.
Governance
Ownership models
Regulated firms typically combine internal compliance ownership with FCA prescribed-person escalation and, where required, independent intake.
| Route | Primary owner | Escalation |
|---|---|---|
| Internal compliance route | Head of compliance or whistleblowing champion | SMF holder → audit committee |
| FCA prescribed-person escalation | FCA (external); firm documents internal handling separately | Regulatory correspondence; firm response record retained |
| Independent / external intake | Third-party hotline with compliance handoff | Audit committee with full case export |
Operating model
Team responsibilities
Clear 2LoD ownership reduces the gap between a disclosure arriving and a record the firm can defend to the FCA or internal audit.
Compliance (2nd line)
- Own whistleblowing triage and regulatory reportability assessment
- Assign investigators and maintain SMCR-relevant documentation
- Coordinate FCA correspondence where disclosures escalate externally
Financial crime
- Investigate AML, fraud, and market integrity categories
- Preserve evidence for SAR and regulatory reporting decisions
- Maintain separation from business-line pressure on cases
Company secretariat / board
- Support audit committee reporting on speaking-up themes
- Ensure serious outcomes reach board oversight
- Maintain regulator-ready exports and retention policies
Product fit
Why organisations use Disclosurely
Disclosurely structures the internal route firms must operate alongside FCA whistleblowing—it does not replace regulatory reporting obligations or SMCR accountability.
Audit trail for regulatory review
Receipt, ownership, messages, files, and status changes in one case record—supporting internal audit and FCA interaction documentation.
Role-based access for sensitive conduct cases
Need-to-know visibility for NFMI and SMCR investigations without circulating details through corporate email.
Secure follow-up without breaking anonymity
Compliance teams can request clarification and evidence through protected messaging when reporters choose not to identify themselves.
Buyer resources
Commercial pages for finance & regulated teams buyers
Use these pages when your team moves from industry context to vendor evaluation, pricing, or procurement requirements.
See how Disclosurely supports finance & regulated teams reporting workflows.