Whistleblowers: The UK Perspective
Firms should look to cultivate a working environment within which their employees feel confident in raising concerns about potential failings or misconduct. Fostering the right culture is key in identifying and combating damaging behaviours. Employees should feel able to raise issues without fear of retaliation or being disadvantaged in some way, whether within their current role or with a future employer.
Providing recourse to an external whistleblowing channel, through which individuals can make anonymous and confidential disclosures, can also assist public bodies in detecting areas of malpractice that are of wider interest. Many regulatory and prosecuting authorities have their own whistleblowing services that provide an important source of intelligence.
While employees have no general legal duty to disclose misconduct, senior individuals in a fiduciary position may owe a fiduciary duty to their employer to expose their own wrongdoing (or that of fellow employees) and those in the regulated sector may owe regulatory obligations to report certain matters internally or externally to regulatory authorities. Express contractual obligations may also be included in employment contracts (again, particularly in the regulated sector), which impose a duty of disclosure on employees.
The Public Interest Disclosure Act (PIDA) 1998 provides protection to whistleblowers. Any dismissal of an employee for making a ‘protected disclosure’ will automatically be unfair. Similarly, any detriment caused to such an employee will be unlawful. Employees may not, however, be protected from criminal liability even if they may qualify for protection as whistleblowers. Prosecutors may still consider a prosecution where an employee has participated in criminal conduct, even if they later report their involvement. Advice about the risks involved may be important both for the corporate and the individual whistleblower. Criminal offences may also be committed by whistleblowers who mishandle confidential information even if it is in the course of whistleblowing.
19.2 The corporate perspective: representing the firm
19.2.1 FCA/PRA individual accountability
Under the FCA/PRA Individual Accountability Regime, the majority of those employees working in the UK banking sector are required to comply with the FCA/PRA’s Individual Conduct Rules (COCON). Senior Managers must comply with the FCA and PRA Senior Manager Conduct Rules. Similar Conduct Standards/Rules apply to those working in the insurance sector, although they do not have such broad application. Under the Bank of England and Financial Services Act 2016, the PRA and FCA may make rules of conduct applicable to non-executive directors (NEDs) who are not otherwise approved under the Senior Managers Regime and the Senior Insurance Managers Regime. From July 2017, certain of the FCA and PRA conduct rules now apply to these NEDs. The FCA Handbook provides guidance on the application of these rules. The government intends to extend the new regime to the wider financial services sector in 2019.
126.96.36.199 Individual Conduct Rules
FCA/PRA Individual Conduct Rule 3: You must be open and co-operative with the FCA, the PRA and other regulators.
This rule applies not only to the FCA and PRA but also to any other regulator which has recognised jurisdiction. The obligation will most obviously apply where an express information request has been made. COCON 4.1.10 confirms that there is no duty to report information directly to the regulator unless they are one of the persons in the firm responsible for reporting matters to the authority. A report should generally be made through the firm’s mechanisms for reporting information to the regulators. If a person influences or obstructs the reporting of information, they will be viewed as being one of those persons who has taken responsibility for the reporting.
188.8.131.52 Senior Manager Conduct Rules
FCA/PRA Senior Manager Conduct Rule 4: You must disclose appropriately any information of which the FCA or PRA would reasonably expect notice.
This obligation applies to Senior Managers only and again extends to other regulators which have recognised jurisdiction. COCON 4.2.26 confirms that while, for Senior Managers, this rule has some overlap with Individual Conduct Rule 3, the latter normally relates to responses from individuals to regulators’ information requests. Senior Manager Conduct Rule 4 imposes a greater duty on Senior Managers than that set out in Individual Conduct Rule 3 in that there is a positive disclosure obligation even where no express regulator request has been made. Consequently, for Senior Managers, this rule creates a quasi-external whistleblowing obligation where the matter falls within the scope of their responsibilities.
184.108.40.206 Approved Persons
The Bank of England and Financial Services Act 2016 (the Act) includes statutory changes to the Individual Accountability Regime that will extend the scope to all firms authorised to provide financial services under the Financial Services and Markets Act 2000. The PRA and FCA are consulting on changes to the rules and guidance.
Until the extended regime is in force, individuals at firms outside the banking and insurance sectors will remain governed by the Approved Persons regime. Statement of Principle 4 for Approved Persons largely mirrors Senior Manager Conduct Rule 4, although there are some differences in the accompanying guidance.
19.2.2 FCA systems and controls (SYSC) requirements
Chapter SYSC 18 of the FCA Handbook sets out rules and guidance for firms to apply in adopting appropriate internal whistleblowing procedures as part of an effective risk management system. The FCA says that it would regard as a serious matter any evidence that a firm had acted to the detriment of a worker because they had made a relevant protected disclosure. Such evidence would call into question the fitness and propriety of the firm or relevant members of its staff and could affect the firm’s continuing satisfaction of Threshold Condition 5 (Suitability) or, for individuals, their status as an Approved Person, Senior Manager or certification employee.
19.2.3 FCA/PRA Rules and Guidance on whistleblowing
In February 2015, the FCA and PRA jointly proposed a package of measures to formalise firms’ whistleblowing procedures in the banking and insurance sectors. These measures extend further than general requirements under whistleblowing legislation. These included a requirement to appoint a Senior Manager to take responsibility for the effectiveness of these processes. The requirement to appoint a senior whistleblowers’ champion took effect in March 2016. The remainder of the new measures came into force in September 2016. The new rules apply to banking and insurance sector firms. The rules currently apply as non-binding guidance to all other authorised firms, but this will change with the extension of the Senior Managers Regime to the wider financial services sector in 2019.
In September 2016, the FCA consulted on extending aspects of the new whistleblowing regime to UK branches of overseas (EEA and third-country) banks. The final rules came into effect in September 2017. UK branches of overseas banks are required to tell their UK-based employees about the FCA and PRA whistleblowing services. A UK branch of an overseas bank that has a sister or parent company that is subject to the regulators’ whistleblowing rules must tell staff in that branch that they are able to use the sister or parent company’s whistleblowing arrangements. Firms may continue to have concurrent reporting obligations to their home state regulator.
The whistleblowers’ champion (who will typically be a non-executive director) has overall responsibility for ‘overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing’ and, in effect, protecting whistleblowers from being victimised. This means that a very senior person in the firm must take responsibility for any inappropriate treatment of whistleblowers as well as the firm being potentially liable in an employment tribunal for any breach of PIDA. The individual does not need to have a day-to-day operational role handling disclosures from whistleblowers.
To encourage further openness, the regulators require firms to establish, implement and maintain appropriate and effective whistleblowing procedures enabling people to come forward with ‘reportable concerns’. The regulators do not prescribe what these procedures should be, but the mechanism put in place should:
- be able to handle reportable concerns effectively – including in cases where confidentiality has been requested by the whistleblower or the individual has decided to blow the whistle anonymously;
- allow disclosures through a range of communication methods, for example, hotline, website, designated person;
- ensure that concerns are dealt with effectively and escalated appropriately, including to the regulator;
- ensure that whistleblowers are not victimised;
- provide feedback to the whistleblower where this is ‘feasible and appropriate’;
- keep records of concerns that are raised by whistleblowers, their treatment and the outcome of the process;
- ensure that the firm’s up-to-date whistleblowing procedures are readily available to UK-based employees (though these do not have to be made available to the wider group of persons who are otherwise encouraged to blow the whistle);
- produce reports (at least annually) on the whistleblowing process and its effectiveness to the firm’s governing body and to the regulator; and
- report to the FCA where the firm has lost a whistleblowing case in an employment tribunal.
There are also requirements to give appropriate training to employees and managers that also must comply with minimum standards.
Firms should guard against attempts to identify anonymous whistleblowers. On 11 May 2018 the FCA and PRA announced that they had together fined Mr James Stayley, chief executive of Barclays Group, a total of £642,430. The fine was imposed as a result of Mr Stayley seeking to identify a whistleblower while trying to protect a colleague from what he considered was an unfair personal attack. Despite the identity of the individual not being discovered, the regulators found Mr Stayley’s actions had breached the requirement to act with due skill, care and diligence (Individual Conduct Rule 2). Furthermore, in light of Mr Stayley’s actions, the regulators also made Barclays Bank UK plc and Barclays Bank plc subject to special requirements, requiring annual reports to be made to them in respect of whistleblowing, with personal attestations required from those Senior Managers responsible for the relevant systems and controls.
The FCA says firms should always be prepared to receive anonymous disclosures although firms may wish to discuss with whistleblowers the advantages of disclosing their identity.
In any settlement agreement entered into with a worker, wording must be included making it clear that nothing in such an agreement prevents a worker from making a protected disclosure. In addition, a firm cannot request a worker to enter into a warranty requiring them to disclose that they have made a protected disclosure or they know of no information that could form the basis of a protected disclosure.
The firm’s employee handbook (or equivalent document) must make it clear to employees that they are able to disclose reportable concerns to the regulator and how they can do so. This should explain that the employee can go straight to the regulator without having to make a disclosure to the firm internally and can do so simultaneously or consecutively.
In November 2018, the FCA published its findings from its review of firms’ whistleblowing arrangements in the retail and wholesale banking sector. The review looked at how firms had developed and implemented their whistleblowing arrangements, giving the FCA further insight into their culture.
The FCA’s review found that the new rules were helping to ensure that firms managed whistleblowers fairly, consistently and in a way that protects the individual whistleblower. Non-executive directors appointed as whistleblowers’ champions were providing independent oversight and accountability. Examples of good practice included detailed step-by-step investigation processes and monitoring arrangements for potential victimisation cases. However, there were also areas for improvement, most notably in the provision of whistleblowing training and the requirement to provide an annual report to the firm’s governing body. The FCA also found that firms needed to better document their whistleblowing investigation processes and how to protect whistleblowers against victimisation in practice.
19.2.4 FCA/PRA and whistleblower reports
The FCA encourages whistleblowers to use their own internal reporting processes at work but they are free to contact the FCA if there are none in place or if they are dissatisfied with, or lack confidence in, the firm’s response. The FCA has published statements on its website detailing how it treats whistleblower disclosures: ‘Whistleblowing’ and ‘How we handle disclosures from whistle-blowers’. The identity of the whistleblower will not be revealed without consent unless required by law (in which case the views of the whistleblower will be sought in advance).
In the majority of cases, the FCA is unable to tell the informant exactly what action it has decided to take and will not be able to provide regular updates given policy restrictions and the sensitivity surrounding investigations. The FCA does not investigate individual complaints, and it is rare for a single piece of whistleblower intelligence to lead to an enforcement investigation, but it may assist with lines of enquiry or corroborate other intelligence.
FSMA sets down restrictions on how the FCA or PRA can use and share information. There are, however, a number of prescribed gateways that the authorities may use to carry out their functions effectively. These gateways include the ability to share information with other regulators and government agencies (including overseas).
Financial incentives are not available to those who blow the whistle to the FCA or PRA. Both authorities consider financial rewards would be unlikely to increase the number, or quality, of disclosures they receive and could raise a number of moral implications. Firms should nonetheless be cognisant of the risk that whistleblowers may elect to make a report directly to the US authorities on matters within their jurisdiction where they may be able to take advantage of bounty payments.
19.2.5 Proposed Directive on the protection of persons reporting on breaches of Union Law
Outside the financial services sector, there is currently no legal or regulatory requirement for firms in the United Kingdom to have whistleblowing arrangements in place, although many firms do. Many organisations have embedded formal whistleblowing programmes as part of their strategy for combating the risk of bribery being committed on their behalf.
On 23 April 2018, the European Commission proposed a new law to strengthen whistleblower potection across the European Union. The proposal guarantees a high level of protection for whistleblowers who report breaches of EU law by setting new, EU-wide standards. The Directive mandates that Member States transpose the provisions by 15 May 2021.
The new law will establish safe channels for reporting within an organisation and to public authorities. It will also protect whistleblowers against dismissal, demotion and other forms of retaliation and require national authorities to inform citizens and provide training for public authorities on how to deal with whistleblowers.
All companies with more than 50 employees or with an annual turnover of over €10 million will have to set up an internal procedure to handle whistleblowers’ reports. All state, regional administrations and municipalities with over 10,000 inhabitants will also be covered by the new law.
The Directive set outs how the proposed reporting mechanisms would work,;these are split into the following three categories:
- Internal reporting within companies – this is the first point of call for whistleblowers. However, it may be bypassed if the whistleblower has grounds to believe that an internal report could jeopardise a subsequent investigation into the company’s alleged wrongdoing.
- External reporting to the competent national authorities – this route opens if the company does not respond to the internal report in three months or the internal route has been otherwise exhausted.
- Media reporting – a whistleblower can only turn to the media if no timely action has been taken by either the company or the public authorities, or if the breach must be disclosed immediately as there is an imminent danger to the public interest.
If the appropriate procedure is followed, the whistleblower will be granted
19.2.6 Bribery Act 2010 and adequate procedures
The Bribery Act 2010 created a new offence under section 7 that can be committed by commercial organisations that fail to prevent persons associated with them from committing bribery on their behalf. It is a defence for a firm to prove that it had adequate procedures in place to prevent the commission of an offence. In March 2011, the Ministry of Justice published guidance on adequate procedures, which included the adoption of whistleblowing processes to allow confidential reporting of suspected bribery.
In a similar vein, the Criminal Finances Act 2017 introduced a new corporate offence of failure to prevent tax evasion offences, which is modelled on section 7 of the Bribery Act. It will be a defence to show that the firm had reasonable procedures in place. Guidance issued by HM Revenue and Customs envisages that preventative measures will include a senior management commitment to whistleblowing processes.
19.2.7 Serious Fraud Office (SFO) and online whistleblowing
In 2011, the SFO set up a special whistleblower service, SFO Confidential. SFO Confidential was established to provide anyone with a suspicion of serious fraud or corruption with a channel for making a report. The service complements the SFO’s national fraud reporting service. The aim is to enable workers, professional advisers and business associates to report serious or complex fraud or corruption in confidence. Whistleblowers are encouraged to follow the reporting procedures in their own organisation before going to the SFO, unless they feel uncomfortable in doing so. As in the case of the FCA and PRA, the SFO cannot provide legal advice and does not offer financial incentives to whistleblowers. The SFO has broad powers to share information with other regulatory and prosecuting authorities.
19.2.8 Competition and Markets Authority (CMA) and whistleblowers
The CMA ostensibly offers financial rewards of up to £100,000 (in exceptional circumstances) for information about cartel activity. Cartels are generally hard to detect and prove. Consequently, the CMA believes it should offer financial incentives for information that assists the detection and investigation of cartels and that leads to the fining of companies or the criminal prosecution of the individuals concerned. The CMA prefers whistleblowers to contact them early on so that they can assess how any further information might best be obtained and what would be of most value. Similar to the FCA/PRA, the CMA may share information that it receives with certain other parties. These prescribed gateways are set down in the Enterprise Act 2002.
Where the whistleblower has personally been involved in the cartel activity, it may be possible to seek civil and criminal immunity from sanction under the CMA’s leniency policy provided they are the first to report and confess their involvement, co-operate fully and there was no pre-existing investigation by the CMA.
19.2.9 Employment Rights Act 1996 and PIDA
220.127.116.11 Scope of protection
In brief, workers are protected against detriment and (in the case of employees) from being dismissed because they have made a protected disclosure. To be protected, the disclosure must be made by a worker, it must be a qualifying disclosure, and it must have been made in the correct way. To be a qualifying disclosure:
- the worker must disclose information (and not just, for example, a mere allegation);
- the disclosure must be made in the public interest; and
- the worker must have a reasonable belief that the facts tend to show one or more of six categories of failure (it does not matter that they subsequently turn out to be untrue), which are:
- the commission of a criminal offence;
- failure to comply with any legal obligation;
- miscarriage of justice;
- putting the health and safety of an individual in danger;
- damage to the environment; or
- deliberate concealment of any of the above.
The courts have shown themselves willing to interpret these categories widely. This is despite the introduction of the public interest test in June 2013. The threshold for something being held to be ‘in the public interest’ has been relatively low. For example, complaints by an estate agent in Mayfair about his bonus (the basis for which potentially affected colleagues as well) and about the allocation of overtime among a group of four employees were held to be in the public interest. Since 2013, there is no longer any requirement for the disclosure to be ‘in good faith’ – but a disclosure that is not in good faith may impact any compensation ultimately awarded to an employee in the event of an employment tribunal claim.
For a qualifying disclosure to be protected, the qualifying disclosure must be made in the right way to the right person. Who this is varies depending on the circumstances, but if the disclosure is to be made to anyone other than the worker’s employer, his or her legal adviser for the purposes of obtaining legal advice, ministers of the crown or ‘prescribed persons’, additional requirements apply.
As a result of the introduction of whistleblowing laws, many employers introduced whistleblowing procedures and some set up hotlines (often anonymous) to encourage employees to come forward with their concerns internally. However, a number of concerns and issues have been identified over the years during which the procedures have been in operation. Because of the very wide definition of what constitutes a qualifying disclosure, many things that would previously typically have been dealt with through a grievance procedure or equal opportunities procedure could also be dealt with under the whistleblowing procedure, which is not always the most suitable mechanism for raising such concerns.
18.104.22.168 FCA/PRA whistleblowing in context and PIDA
Notwithstanding the potentially wide scope of the existing whistleblowing regime, as referenced earlier, the FCA and PRA have sought to create an environment within the financial services sector that encourages and protects whistleblowers and goes above and beyond the requirements of general employment law. Their motivation for doing so, fuelled by the recommendations of the UK legislature’s Parliamentary Commission on Banking Standards, was that ‘[i]ndividuals working for financial institutions may be reluctant to speak out about bad practice for fear of suffering personally as a consequence.’
The regulators have decided that whistleblowing arrangements should be wider than simply covering those disclosures that would be regarded as protected under PIDA. To do this, they have the concept of a ‘reportable concern’. The first category of a reportable concern is anything that could be the subject matter of a protected disclosure under PIDA.
The regulators have added two further categories of ‘reportable concerns’, which are:
- a breach of the firm’s policies and procedures; and
- behaviour that harms or is likely to harm the reputation or financial well-being of the firm.
The regulators have not restricted themselves to matters that might reasonably be said to come within their remit and in respect of which they are ultimately empowered to take action. In addition, firms are required to receive disclosures from any person (although the FCA does not expect whistleblower arrangements to be promoted to anyone other than the firm’s UK-based employees). This means that the range of whistleblowers extends beyond the definition of ‘worker’, and they would therefore not all be protected by PIDA. Firms in the financial services industry may find themselves inundated with reports that ought more properly to be channelled through other routes and that, on the face of it, are not really of concern to the authorities. During the consultation process, some respondents queried whether firms’ whistleblowing channels may become overwhelmed by trivial matters that might take up time more valuably directed towards encouraging workers to come forward on matters of financial regulation. The regulators declined to limit the scope of the obligation, commenting that they judged the benefits to outweigh the risks.
Senior Managers will want to ensure that matters of serious concern are identified and investigated without delay, without being drowned out by less significant issues. They may wish to consider providing training to workers on the appropriate channels through which concerns can be escalated, informing them that grievances and everyday differences of opinion can more properly be dealt with through other processes, such as customer complaints or grievance procedures. That said, it should be made clear to workers that the whistleblowing line does remain an option.
Another area that may be of concern to lawyers, particularly those in-house, is that under PIDA a disclosure is not a qualifying disclosure if it discloses a matter covered by legal professional privilege. While there are general notification obligations under the regulatory regime and rules of professional conduct for lawyers, some query whether an unintended consequence of the new FCA/PRA regulatory regime (which provides that protections should apply to all whistleblowers) will be a concern for firms over the sanctity of their discussions with their legal counsel. On a related point, in 2016 the FCA announced its intention to consult on whether an individual in charge of a firm’s legal function requires approval under its Senior Managers Regime. The Law Society responded that inclusion within the Senior Managers Regime could place in-house counsel in direct conflict with their employers, affecting their ability to provide full and frank legal advice. There were concerns that requiring general counsel to be a Senior Manager could create an expectation of disclosure of privileged information where legal functions are required to defend their conduct. The FCA does not now intend to consider the issue further until 2019–2020 at the earliest.
PIDA also only protects employees and workers of the institution in respect of whom the whistleblowing is made. However, under the regulatory regime, relevant firms must take disclosures from any person. This may put the recipient in a difficult position as the individual in question may well not have the protection of PIDA and if his or her employer is not covered by the regulatory regime, may not have protection under that regime either. While keeping the identity of the whistleblower confidential will help, the person’s identity may inevitably come out or may be required to enable the issues to be investigated.
19.3 The individual perspective: representing whistleblowers
The limitations on the protection afforded to whistleblowers by PIDA, which is a purely civil law statute, is often not fully understood by would-be whistleblowers. The exposure to criminal prosecution where an individual has played any part in alleged wrongdoing is very real. An employer may be restricted in what action it can lawfully take against an individual whistleblower but an investigator or prosecutor is not bound to exercise leniency and may not do so. In some cases, the potential whistleblower may initially be treated as a suspect and interviewed under caution.
There may also be exposure to foreign criminal liability and so individuals who seek advice about their rights in relation to whistleblowing often need to consider whether they may have overseas exposure too.
Even where an individual secures an assurance of non-prosecution, being a whistleblower may carry a very heavy and often unforeseen burden in the form of obligations to offer continuing assistance to regulators or prosecutors in different countries, sometimes lasting years.
Where an individual does not qualify for whistleblower protection, perhaps because of the degree of involvement in the alleged misconduct, it may be necessary to consider whether some form of co-operation agreement with the authorities would be available, assuming that the individual wishes to mitigate his or her involvement in criminal conduct and there is a high risk of prosecution. There may be circumstances where an investigating authority will agree to treat an individual as a witness, in very rare and extreme circumstances by an immunity agreement. More often such agreements will require a plea of guilty and continuing co-operation, including giving evidence in criminal proceedings followed by a sentence discounted to reward co-operation.
Whistleblowers can commit serious criminal offences by mishandling information they use to support their disclosures. When information is removed from an employer’s computer system as a result of unauthorised access, an offence may be committed. A summary offence of unlawful obtaining of personal data may apply, and in some cases theft of documents or other records such as CDs or memory sticks, although not the information contained on them. Offences under the Fraud Act 2006 may also apply, such as fraud by abuse of position. In other cases, would-be whistleblowers have been accused of blackmail where inappropriate demands are made to employers and where unlawful interception or recording is involved there are potential offences of unlawful interception of communications. In addition, there may be civil exposure to action for breach of confidence, injunctions and costs.
19.3.1 How the role of the individual affects the representation
22.214.171.124 In-house counsel
For in-house counsel there is a significant obstacle to securing protection under PIDA because where legal professional privilege may apply to the subject matter of the contemplated disclosure, as noted earlier, there can be no statutory protection for the employee. In-house counsel may therefore need to think carefully about other means of bringing concerns to the attention of their employers; whether via a non-executive director or perhaps through an external lawyer instructed by the in-house counsel to assist in this task. There may be another route via a disclosure to a professional body.
126.96.36.199 People with professional licences or certifications
Those with other professional qualifications or regulatory approval may also face investigative scrutiny from their professional bodies or regulators as a result of a whistleblowing disclosure. Just as with a criminal prosecutor, such external bodies are not bound by PIDA and may not exercise leniency in relation to those who have participated in misconduct, even if the individual initiates a disclosure via the regulatory or disciplinary organisation’s whistleblowing procedure. A decision to make a disclosure, particularly one made to an external organisation and not the employer, can have far-reaching and long-term consequences. Once an external disclosure is made, it can be very hard to control how an investigation develops and whether sanctions are applied to the whistleblower.
There may also be professional obligations to consider. Individual professionals will often have a duty to report their own serious misconduct and that of other persons in the same profession. These professional obligations exist entirely independently of whistleblowing protection but there may be overlapping considerations so professional duties must always be examined alongside any whistleblowing procedures.
188.8.131.52 Junior employees
For junior employees similar considerations apply, but it can be harder to convince employers and others to take the disclosure seriously or to prevent the disclosure being dismissed without being properly considered. This can happen where the junior employee has limited access to information about the wrongdoing concerned and an employer is able to respond to the disclosure without conducting a sufficiently detailed investigation. Where the junior status of the employee means that they have a limited notice period and exposure to damages for unfair dismissal is low, employers may be able successfully to manage an employee out of the organisation without being in breach of PIDA. As with all whistleblowing situations, independent legal advice is very important to safeguard the interests of the whistleblower and guard against any unlawful retaliation by the employer.
184.108.40.206 More senior employees
For more senior managers and board members, there may be potential issues of breach of fiduciary duty or duty of loyalty where a disclosure is being considered. Senior employees will need to pay careful attention to their contractual obligations and to the internal procedures available for the reporting of concerns and whistleblowing. Individuals who may be tempted to leak information to the press or other third parties may be vulnerable to injunctive relief by their employer where there is evidence to suggest unlawful disclosure of confidential information. This may be so even where the employer is itself the subject of a serious fraud investigation. However, there are limitations on what an employer can do where the individual has been made subject to an order or statutory notice to produce confidential information to an investigating authority. Such an order or notice will take precedence over an employer’s right to the return of confidential information and delivery up or destruction of all copies.
220.127.116.11 Public servants
Public servants are especially at risk in whistleblowing cases where their conduct may leave them exposed to allegations of misuse of their privileged access to confidential information protected by state secrecy laws. Adherence to internal whistleblowing procedures will be of particular importance. Public servants are exposed to the risk of significant special criminal offences depending on the nature of their employment, including the Official Secrets Act 1989 and the common law offence of misconduct in a public office.
19.3.2 Blowing the whistle internally or externally
Where employees have not blown the whistle externally, it will be important to maintain the confidentiality of the information disclosed and to ensure that the internal whistleblowing procedures are followed. Failure to observe confidentiality is likely to render the individual more vulnerable to the various criminal offences applicable in whistleblowing cases and to civil action for breach of confidence. An employee will need to give careful consideration to a decision to blow the whistle externally because doing this may result in loss of the statutory protection afforded by PIDA. This is especially so if the whistleblower makes an external disclosure other than to a prescribed person such as a regulator or prosecutor.
Determining whether to report to a prescribed person will involve a careful assessment of the individual’s own exposure to criminal, regulatory or disciplinary sanctions and the likely consequences of a report to a regulatory or disciplinary body. A report may often lead to an onward referral to a criminal investigating authority so that the person making the disclosure risks becoming the subject of investigation by multiple authorities, possibly in overseas jurisdictions as well.
Only in exceptional circumstances will an employee be able to maintain his or her employment protections rights under PIDA when a disclosure is made to the media as opposed to the employer or a prescribed person. To maintain protection, an employee must reasonably believe that the information disclosed and any allegation contained in it is substantially true and the employee must not be acting for personal gain. Unless the wrongdoing disclosed is exceptionally serious, if an approach has not already been made to the employer or a prescribed person, the employee must reasonably believe that the employer will subject him or her to detriment or conceal or destroy evidence. The employee’s choice to make the disclosure must still be reasonable.
19.3.3 Dealing with the employer
At an early stage it must be established whether the employee is likely to be able to continue in employment following the disclosure. This will depend on the nature of the disclosure and whether it is likely to remain possible for the employee to continue working having regard to the disclosure, which may implicate his or her colleagues in alleged misconduct. It will be necessary to consider the employee’s reputation and future employment prospects in the industry depending on the extent of the disclosure and any consequential publicity.
19.3.4 Dealing with the investigating authority
Before any approach to an investigating authority is made it will be necessary to assess the potential vulnerability of the employee to criminal, regulatory or disciplinary sanctions. Such exposure may arise from the conduct that is the subject of the whistleblowing disclosure itself or from potential misconduct by the whistleblower in making the disclosure, particularly if the disclosure was not made to a prescribed person; for example, to the media.
19.3.5 Co-operating witness or suspect
Where an employee has been personally involved in the misconduct reported, he or she should bear in mind that an investigating authority will need to take an objective view of the conduct and to assess whether the individual whistleblower can fairly be treated as a witness as opposed to a suspect or focus of a regulatory investigation.
In cases where the individual has played no part in the alleged misconduct, an investigator will want to establish what evidence that individual can give that will benefit the investigating authority. Legal advisers should also ensure that appropriate safeguards are agreed covering the maintenance of confidentiality in relation to the individual witness and the use to which the information will be put. Individuals who become witnesses and are relied on by the investigating authority must understand the extent of their obligations, which may extend for months or even years depending on the nature of the investigation. Witnesses may need to appear in subsequent proceedings and, having given evidence to one authority, may find themselves the subject of requests from others seeking similar testimony in the United Kingdom or elsewhere. Whistleblowers and co-operators should not underestimate the significant burden this may entail.
In situations where an individual is exposed to criminal, regulatory or disciplinary sanctions, it will be necessary to analyse, using the information available, the extent of that exposure. It may be difficult to get full information to assess the risk. This is because the employer and the investigating authority may be reluctant to make available relevant documentation and information outside the controlled process of the investigation. Therefore it may be extremely difficult, at an early stage, to establish the full extent of the evidence that may expose an individual to sanction.
Where an individual is exposed to criminal sanctions, in extremely rare cases, it may be possible to obtain an immunity from prosecution or at least an assurance from the prosecutor that no criminal proceedings will be started against the individual if they provide truthful evidence to the investigation.
A statutory immunity is available under section 71 of the Serious Organised Crime and Police Act 2005 (SOCPA). Most but not all criminal prosecutors may issue such immunities. One example of a prosecutor without access to the statutory scheme is the CMA. The common law power of a prosecutor to issue an immunity or to exercise discretion in other ways against prosecution of a witness is preserved and runs in parallel with the statutory scheme under SOCPA.
Such an immunity from criminal prosecution, whether statutory or at common law, will only be available in the most extreme and exceptional situations. In fraud and corruption cases in the United Kingdom the law enforcement authorities are exceedingly reluctant to issue immunities from prosecution, and where an individual who has been involved in criminal conduct seeks a lenient outcome without a trial, there will often be a stark choice of entering a co-operation agreement or negotiating a plea of guilty.
A co-operation agreement is where the individual pleads guilty to one or more criminal offences and agrees to give evidence for the prosecution in exchange for becoming eligible for a reduced sentence. The alternative is to enter plea negotiations with a view to agreeing a basis of plea with the prosecutor and securing a lower sentence by virtue of that early negotiated plea. The latter option does not involve any obligation to co-operate with the prosecutor.
Over the past few years, there has been a growing number of appeal cases involving co-operating witnesses in fraud and corruption cases under the section 73 sentence discount scheme. The trend in sentencing in this type of case appears to be towards a form of super-discount by which, in some cases, custodial sentences have been suspended, resulting in an effective 100 per cent discount on the actual prison time imposed.
Nevertheless, the commitment required to undergo the rigorous process to obtain a section 73 agreement or its common law equivalent is never to be underestimated. There have also been at least two notable cases in the United Kingdom where co-operators pleaded guilty and gave evidence at the trial of their co-defendants only to see the prosecution collapse, meaning nobody else was convicted. The burden of giving evidence, which defendants who plead guilty rarely have to do, carries a significant risk. If the prosecutor or the judge takes a negative view of the credibility of the testimony given, the sentence discount may well not be as great, and it may certainly prove much harder to achieve a suspended sentence.
1 Peter Binning is a partner at Corker Binning and Elisabeth Bremner is a partner at CMS Cameron McKenna Nabarro Olswang LLP. The authors wish to acknowledge the contribution of Catrina Smith, a partner at Norton Rose Fulbright, for her contribution to previous versions of this chapter.
2 The Financial Conduct Authority (FCA) applies its Individual Conduct Rules (COCON) to the large majority of staff working in banking firms. The Prudential Regulation Authority (PRA) applies its Individual Conduct Rules (Conduct Rules) to those Senior Managers approved by the PRA or FCA and members of staff who fall within the PRA’s Certification regime.
3 Solvency II firms.
4 The PRA’s Conduct Standards apply to all approved persons performing a key function (standards 1 to 3) and SIMF and Key Function Holders (standards 1 to 8). The FCA’s Conduct Rules apply to all FCA and PRA approved persons (individual rules 1 to 4) and FCA SIFs/PRA SIMFs (Individual Conduct Rules 1 to 4 and SIF Conduct Rules 1 to 4).
5 In May 2017, the FCA introduced final rules to extend certain of its conduct rules to standard NEDs in banks, building societies, credit unions and dual-regulated investment firms (banks) and insurance firms (i.e., Solvency II firms). At the same time, the PRA also confirmed that certain of its conduct rules would apply to notified NEDs in the banking and insurance sectors.
6 See APER 3 and APER 4.
7 See SYSC 18.3.9G.
8 In 2013, the Parliamentary Commission on Banking Standards recommended that banks put in place formal frameworks to encourage employees to raise concerns internally and expose the risk of potential wrongdoing at an early stage by protecting them from unfair treatment.
9 UK deposit-takers with assets of £250 million or greater and PRA-designated investment firms.
10 Insurance and reinsurance firms within the scope of Solvency II, the Society of Lloyd’s and managing agents.
11 FCA PS17/7, Whistleblowing in UK branches of foreign banks, 3 May 2017.
12 SYSC 18.4.4.
13 See https://www.fca.org.uk/publication/final-notices/mr-james-edward-staley-2018.pdf; https://www.bankofengland.co.uk/-/media/BoE/Files/prudential-regulation/regulatory-action/final-notice-from-pra-to-mr-staley.
14 See https://www.fca.org.uk/publication/requirement-notices/vreq-barclays-bank-uk-plc.pdf; https://www.fca.org.uk/publication/requirement-notices/vreq-barclays-bank-plc.pdf; https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/regulatory-action/written-notice-from-the-pra-to-barclays-bank-uk-plc.pdf?la=en&hash=4C2E35548A0F3218F3297AF93A335E2054EE5FD3; https://www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/regulatory-action/written-notice-from-the-pra-to-barclays-bank-plc.pdf?la=en&hash=FB7D7A9F91A27F1A130EAEC3E4314E19CD07291F.
15 FCA PS15/24: Whistleblowing in deposit-takers, PRA-designated investment firms and insurers.
19 Section 348 FSMA.
20 A full set of gateways is set out in the Gateway Regulations, Financial Services and Markets Act 2000 (Disclosure of Confidential Information) Regulations 2001 (SI2001/2188).
21 Depending on the outcome of Brexit, it may be that the Directive is never transposed into UK law.
22 See Tackling tax evasion: Government guidance for the corporate offences of failure to prevent the criminal facilitation of tax evasion September 2017 and the Facilitation of Tax Evasion Offences (Guidance About Prevention) Regulations 2017.
23 While the telephone hotline was closed in June 2012, reports can still be made electronically. See https://www.sfo.gov.uk/contact-us/reporting-serious-fraud-bribery-corruption/.
24 See https://www.sfo.gov.uk/publications/information-victims-witnesses-whistleblowers/.
25 See https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/299411/Informant_rewards_policy.pdf for more information.
27 Chesterton Global Ltd (t/a Chestertons) and another v. Nurmohamed UKEAT/0335/14.
28 PS15/24: Whistleblowing in deposit-takers, PRA-designated investment firms and insurers.
30 See sections 71-73 of the Serious Organised Crime and Police Act 2005.
31 Section 1 Computer Misuse Act 1990 – maximum two years’ imprisonment, or a fine, or both.
32 Section 55 of the Data Protection Act 1998 – a fine.
33 Oxford v. Moss (1979) 68 Cr App Rep 183.
34 See section 1(1) of the Regulation of Investigatory Powers Act 2000. This Act is due to be replaced by new legislation: the Investigatory Powers Bill has been passed by both Houses of Parliament and is due to come into force by the end of 2016.
35 See for example SRA Outcome 10.3 – you notify the SRA promptly of any material changes to relevant information about you including serious financial difficulty, action taken against you by another regulator and serious failure to comply with or achieve the Principles, rules, outcomes and other requirements of the Handbook; and FCA APER Statement of Principle 4: An approved person must deal with the FCA, the PRA and other regulators in an open and co-operative way and must disclose appropriately any information of which the FCA or the PRA would reasonably expect notice.
36 See Eurasian Natural Resources Corporation Ltd v. Sir Paul Judge  EWHC 3556 (QB).
38 See https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/510962/BIS-16-79-blowing-the-whistle-to-a-prescribed-person.pdf.
39 Although the CMA has the power to issue a no-action letter under the cartel leniency regime, this does not cover the situation of a co-operating suspect who fails to obtain a no-action letter and during the criminal investigation seeks to achieve the same sentence discount outcome as the statutory SOCPA scheme provides. The only option is to pursue negotiations based on the common law arrangements for co-operating defendants.
40 Attorney General’s Guidelines on plea negotiations and relevant Sentencing Guidelines.
41 David Corker, SOCPA: Immunity, leniency and white collar crime, 3 February 2016, available at http://www.corkerbinning.com/socpa-immunity-leniency-and-white-collar-criminals/.
42 The process includes in most cases a requirement for a suspect to be ‘cleansed’ of all prior wrongdoing by admitting in interview all previous criminal conduct whether or not it has been the subject of investigation or prosecution.