Whistleblower protection refers to the laws and policies that protect people who report wrongdoing from retaliation, such as dismissal, demotion, harassment or legal action, and that keep their identity confidential. In financial services it covers employees, contractors and others who report fraud, market abuse, money laundering, sanctions breaches or other misconduct to their employer or to the authorities. Some regimes, notably in the United States, also pay financial awards to whistleblowers whose information leads to successful enforcement.
Protection is what makes whistleblowing possible in practice, because a whistleblower often risks their career. It sits alongside internal controls and compliance programmes as a way of uncovering problems that audits and supervision miss. Rules differ widely: the US relies on several agency programmes and anti-retaliation laws, the EU has a general directive, and the UK combines employment law with regulator-specific rules.
Whistleblower protection in plain terms
Imagine an employee who sees their manager moving money in a way that looks like fraud. Speaking up could cost them their job, their reputation and their income. Many people would stay silent unless they knew the law would back them.
Whistleblower protection is that backing. It says an employer cannot punish someone for reporting genuine concerns through the right channels, that their identity should be kept secret, and that they can go to court or a tribunal if they are punished anyway. In some places, if the tip leads to a large fine, the person who reported it can receive a share as a reward.
United States
- Securities and commodities. The Dodd-Frank Act of 2010 created whistleblower programmes at the Securities and Exchange Commission and the Commodity Futures Trading Commission. Eligible whistleblowers who provide original information leading to sanctions of more than $1 million can receive 10 to 30 per cent of the money collected. The SEC's anti-retaliation protection applies to those who report to the SEC, as the Supreme Court held in 2018. Tips can be submitted anonymously if the whistleblower is represented by a lawyer.
- Anti-money laundering and sanctions. The Anti-Money Laundering Act of 2020 created a FinCEN whistleblower programme for violations of the Bank Secrecy Act, and a 2022 amendment extended it to sanctions violations and set award levels of 10 to 30 per cent.
- Corporate fraud. The Sarbanes-Oxley Act of 2002 protects employees of public companies who report fraud, and other federal and state laws cover specific sectors.
European Union
The EU Whistleblower Directive (Directive (EU) 2019/1937), which member states had to transpose by December 2021, protects people who report breaches of EU law in areas including financial services, anti-money laundering, consumer protection and data protection. Its key features include:
- Private and public entities with 50 or more workers must set up secure internal reporting channels.
- Reports must be acknowledged within seven days and followed up, with feedback normally within three months.
- Whistleblowers may report externally to authorities and, in defined circumstances, publicly.
- Protection extends to facilitators, colleagues and relatives, and the burden of proof shifts to the employer to show that any detrimental action was not retaliation.
The directive does not require financial rewards, and few member states offer them.
United Kingdom
The Public Interest Disclosure Act 1998 inserted protections into employment law, allowing workers who make a protected disclosure in the public interest to claim compensation if they are dismissed or treated badly as a result. The Financial Conduct Authority and the Prudential Regulation Authority also require banks, insurers and larger investment firms to have internal whistleblowing arrangements and to appoint a senior person as whistleblowers' champion. The UK does not pay awards to whistleblowers, an approach that has been debated in Parliament.
Practice and criticism
Firms are expected to run confidential, well-publicised reporting channels, investigate reports promptly, prevent retaliation and record outcomes. Regulators view a weak whistleblowing culture as a sign of poor governance and may treat retaliation as a regulatory breach in its own right, separate from any enforcement action over the underlying conduct. Critics argue that protection is still uneven: many whistleblowers suffer career damage despite the law, legal remedies come only after harm has occurred, and confidentiality agreements can discourage reporting. US-style award programmes are credited with producing high-value tips but are criticised for encouraging people to bypass internal channels, while countries without awards are criticised for offering too little incentive to take the risk.