Expand all
The principles
  • In England and Wales, workers can disclose certain information and obtain protection in relation to that disclosure. In order to be protected, the disclosure must relate to a "qualifying disclosure" and the worker must follow a set procedure when making the disclosure.

    A qualifying disclosure is a disclosure of information which, in the reasonable belief of the worker making the disclosure, is in the public interest and shows one or more of the following:

    • a criminal offence
    • a failure to comply with a legal obligation
    • a miscarriage of justice
    • that the health or safety of an individual has been endangered
    • damage to the environment, or
    • the concealment of information showing any of the above.

    A worker who has made a protected disclosure must not be subject to a detriment or dismissed because they have made a protected disclosure. Compensation for dismissal in these circumstances is uncapped and no qualifying period of employment applies.

    In the regulated sector, large financial institutions that are covered by the Senior Managers and Certification Regime (SMCR) have specific obligations to ensure adequate protection for whistleblowers - a person who discloses a “reportable concern”. Reportable concerns extend to a wider category of conduct than protected disclosures, including:

    • protected disclosures (including breaches of the rules of the Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA))
    • breaches of the firm's policies and procedures, and
    • behaviour that harms or is likely to harm the reputation or financial wellbeing of the firm.

    For more information on the general employment protection for whistleblowers in the UK, see our article Whistleblowing in the UK.

    We have also produced a comprehensive toolkit for employers in relation to whistleblowing which includes a section on the rules that apply to those in the regulated sector.

Recent developments (general)
  • EU Directive:

    • On 16 April 2019, the European Parliament approved an EU Directive intended to strengthen protection for whistleblowers who report on breaches of EU law, including areas such as financial services, product safety, transport safety, consumer protection, environmental protection and data protection. In addition it is intended to address the imbalance of whistleblower protection across the EU member states.

    • The Directive would extend protection beyond employees to all persons who observe a violation of EU law in their work-related activities. This broad definition would include self-employed persons, freelancers, consultants, volunteers, unpaid trainees and even job applicants.

    • The Directive includes provisions designed to protect whistleblowers from any retaliation in the workplace, such as unfair dismissal and demotion.

    •  Companies in scope will be required to set up an internal reporting channel to ensure confidentiality for whistleblowers and will be subject to specific requirements in terms of the processing and management of whistleblower concerns.


    • The UK government has been consulting on changes to ensure that employers use non-disclosure agreements only where legitimate and do not constrain or deter individuals from raising whistleblowing concerns. Whilst UK legislation already renders void any provision in an agreement which purports to remove a worker’s right to “blow the whistle”, the proposals include additional requirements to ensure that the impact of relevant confidentiality clauses are clear to individuals and that employers make clear in non-disclosure agreements what is not prevented from disclosure. The consultation closed on 29 April 2019 and new legislation and guidance is to be expected in October 2019 or April 2020.

    2018 Corporate Governance Code:

    • The 2018 Corporate Governance Code was finalised on 16 July 2018 and applies to financial years beginning on or after 01 January 2019. The revised code is a much shorter document which places greater emphasis on shareholder and key stakeholder engagement and more focus on integrity and corporate culture, diversity and how overall governance contributes to a company’s long-term sustainable success. The current requirement for a company to have arrangements which allow staff to raise concerns relating to financial reporting matters has been expanded to allow the workforce (a wider group than employed staff) to raise any matters that appear inconsistent with the company’s values and long-term sustainable success. This is now the board’s responsibility rather than that of the audit committee.


    • A new All-Party Parliamentary Group (APPG) on whistleblowing was founded on 10 July 2018. Its focus is on the effectiveness of the existing UK whistleblowing legislation and how it might be improved.

    Financial Services sector requirements:

    • In October 2015, the PRA and FCA introduced new rules on whistleblowing that now apply to large financial institutions covered by the SMCR. In September 2016, the PRA and FCA consulted on whether to extend these obligations to UK branches of overseas banks. A response was issued on 03 May 2017, confirming that the FCA would proceed with its proposals requiring that:
      • UK branches of overseas banks tell their UK-based employees about the FCA and PRA whistleblowing services, and
      • that where a branch of an overseas bank sits alongside a UK-incorporated bank that is subject to the FCA’s whistleblowing rules, the UK based staff of that branch should be informed of the sister or parent company’s whistleblowing arrangements.
    • The new rules came into force on 07 September 2017. See our article for further details. Although not directly applicable to financial services firms outside the SMCR or FCA solo-regulated firms who will be subject to the extended SMCR on 09 December 2019 (further details are available on our microsite, "SMCR extension"), the FCA considers the new whistleblowing rules to be guidance for these firms.
Recent developments (case law)
    • In the recent case of Ibrahim v HCA International Ltd (2019), the EAT held that “breach of legal duty”, in order to constitute a protected disclosure, can include tortious duties including defamation. Although dismissing the appeal, The EAT agreed with the claimant in that a complaint he made to HR, regarding false rumours about him in the workplace, could amount to a protected disclosure as defamation is a breach of a legal duty. The claimant’s case was unsuccessful however, as the EAT found the disclosure was not in the public interest.

    • In a further recent case, Saad v Southampton University Hospitals (2018), the EAT confirmed that when considering whether a claimant acts in bad faith, this concerns their honestly in their belief of the allegation(s), as opposed to their motive for making the allegation(s). In cases of victimisation, making false allegations are only protected disclosures where they are not made in bad faith. In this case, when facing the likelihood he would fail the assessment required to qualify as a Consultant Surgeon, Mr Saad raised a grievance regarding a racially discriminatory remark made four years prior, which turned out to be false, although Mr Saad believed it to be true. The ET found that as Mr Saad’s motive for making the false allegation was in bad faith (to postpone his performance assessment). The EAT allowed Mr Saad’s appeal on the basis that whilst his motive was in bad faith, his honesty in his belief of the allegation was not in bad faith.

    • Some developments may result in more whistleblowing claims being brought against employers, co-workers and other individuals (including NEDs):
      • In the recent case of Kilraine v London Borough of Wandsworth (2018), the Court of Appeal clarified that there should be no rigid dichotomy between “information” and “allegations” as disclosed by an employee for the purpose of whistleblowing protection. Previous case law has established that a protected disclosure must involve information, and not simply voice a concern or raise an allegation. Kilraine v London Borough of Wandsworth clarified this position, stating that sometimes an allegation will also constitute information and amount to a qualifying disclosure, so long as it has sufficient factual content and is sufficiently precise. Therefore, there is no rigid binary of “information” and “allegation”.

      • In the recent case of Timis & anor v Osipov (2018), the Court of Appeal upheld the decision that individual co-workers can be personally liable on a joint and several basis with the employer for a whistleblower’s post-dismissal losses. In this case Mr Osipov was the CEO for IP Ltd and made protected disclosures. Mr Timis and Mr Sage, two non-executive directors, dismissed Mr Osipov. They were both held jointly and severally liable with IP Ltd for Mr Osipov’s losses by both the ET, EAT and consequently the Court of Appeal.

      • The recent case of Bamieh v EULEX (Kosovo) & ors (2018) illustrated that a whistleblower could bring a detriment claim against overseas colleagues as well as their employer. The EAT held that the test in Lawson v Serco, which is used to determine whether an overseas employee can sue their employer in a UK employment tribunal, also applies to claims for whistleblowing detriment against co-workers. Accordingly, the EAT held that an employment tribunal had territorial jurisdiction to hear whistleblowing claims brought by an employee of the Foreign and Commonwealth Office against two FCO colleagues in relation to detriments alleged to have been committed while all three were on secondment in Kosovo.
    • The case of Malik v Cenkos Securities Plc (2018) may be helpful to employers facing whistleblowing claims. In that case, the EAT confirmed that for a whistleblowing claim to succeed, the person who subjects the whistleblower to a detriment must have personal knowledge of and be motivated by the protected disclosure(s). In connection with this, it will be helpful for firms to ensure that they have systems in place to keep details of whistleblowers and the issues that they raise.
Practical tips in an investigation
    • Establish immediately whether the information raised by an individual could be a protected disclosure. If it is (or could potentially be), maintain good records of whistleblowers' details as well as the issues which they raise and ensure that all involved in the handling of the whistleblower are aware of obligations not to victimise the individual.

    • Similarly, in the regulated sector, consider whether the issue raised by an individual falls within the wider definition of a “reportable concern”. If it does, ensure that appropriate procedures are followed and all involved are aware of obligations not to victimise. How that person is treated could be relevant to the fitness and propriety of the person handling the situation.

    • In the regulated sector, if an allegation relates to a specific individual it could, of course, be relevant to that individual’s fitness and propriety.

This document (and any information accessed through links in this document) is provided for information purposes only and does not constitute legal advice. Professional legal advice should be obtained before taking or refraining from any action as a result of the contents of this document.