FCA whistleblowing rules: SYSC 18, the champion and non-financial misconduct

The FCA's whistleblowing rules are set out in SYSC 18, the whistleblowing chapter of the Financial Conduct Authority's Handbook. They bind UK deposit takers with assets of £250 million or more, investment firms designated by the Prudential Regulation Authority (PRA) and Solvency II insurers. For every other firm the FCA authorizes, they act as guidance.

A firm in scope must run arrangements for staff to raise concerns, and allocate oversight of them to a senior manager, the whistleblowers' champion. The FCA also expects serious non-financial misconduct, such as bullying and harassment of colleagues, to be raised through the same whistleblowing channels.

Imagine an anonymous letter arriving at a bank, making allegations about a senior person. The chief executive reads it, and his first question is not whether the letter is right but who wrote it.

That instinct has a price, as a real case shows. On 11 May 2018 the FCA and the PRA fined the Barclays chief executive James Staley £642,430. He had breached Individual Conduct Rule 2, the duty to act with due skill, care and diligence, when he "attempted to identify the author of an anonymous letter".

It was the first case the two regulators brought under the Senior Managers Regime. Since 2016 that regime has made named senior managers at banks personally accountable for their areas.

Any FCA-regulated firm can receive that letter. SYSC 18 governs what happens next, and whether the firm can show a supervisor what it did.

Who the rules apply to

SYSC 18 sits in the Senior Management Arrangements, Systems and Controls sourcebook of the FCA Handbook. Under SYSC 18.1.1AR it binds UK banking firms under the Senior Managers and Certification Regime (SM&CR), other than small deposit takers. It also binds Solvency II insurers.

The FCA's October 2015 policy statement on whistleblowing, PS15/24, drew the line. In scope are UK deposit takers with assets of £250 million or more, PRA-designated investment firms, Solvency II insurers and reinsurers, and Lloyd's and its managing agents. These firms had to comply by 7 September 2016.

From 7 September 2017, UK branches of overseas banks had to tell UK staff about the regulators' whistleblowing services. The rest of the chapter does not bind them.

For every other firm the FCA authorizes, the chapter is guidance rather than rule. SYSC 18.1.1CG says a firm outside scope "may adopt the rules and guidance in this chapter as best practice". It is the standard anyway. SYSC 18.3.9G says the FCA "would regard as a serious matter any evidence that a firm had acted to the detriment of a whistleblower".

Such evidence "could call into question the fitness and propriety of the firm", a test every authorized firm sits. The FCA has also said it expects serious non-financial misconduct to be raised through whistleblowing channels, which assumes firms have them. It now also counts reports about a firm's own whistleblowing systems and controls as a category. There were 21 in the second quarter of 2026, about 6.3 percent of its intake.

The PRA has a parallel set. The Whistleblowing Part of the PRA Rulebook applies to Solvency II firms, Lloyd's and third-country branches. Supervisory statement SS39/15 covers deposit takers over £250 million and PRA-designated investment firms.

Rule 2.1 requires reportable concerns to be raised "internally through a specific, independent and autonomous channel". Rules 2.3 to 2.6 require the firm to tell every worker about that channel. Workers must also be told they may go directly to the PRA or the FCA. The firm must also make sure no contract or settlement discourages them.

Firms under UK MiFID (the UK version of the EU Markets in Financial Instruments Directive) carry the same phrase in SYSC 18.6.1R, whatever their size. Collective portfolio management firms are the exception.

What SYSC 18.3.1R requires

The core rule opens with one sentence: "A firm must establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers." The rest lists seven things the arrangements "must at least" do.

1. Handle confidential and anonymous disclosures, through more than one route. The arrangements must work where the whistleblower "has requested confidentiality or has chosen not to reveal their identity". They must also allow disclosures "through a range of communication methods". A single email address to compliance fails both halves.
2. Assess and escalate. Every reportable concern is assessed and, where it warrants it, escalated, "including to the FCA or PRA".
3. Prevent victimization. The rule asks for "reasonable measures to ensure that if a reportable concern is made by a whistleblower no person under the control of the firm engages in victimisation of that whistleblower".
4. Give feedback. The whistleblower receives feedback "where feasible and appropriate". For an anonymous reporter, that is only feasible if the route lets the firm reply without knowing who they are.
5. Keep records and written procedures. The firm must keep "Appropriate records of reportable concerns including the outcome". It must also keep "up-to-date written procedures readily available to the firm's UK-based employees".
6. Report to the board, and to the FCA on tribunal losses. The governing body receives a report "at least annually" on the operation and effectiveness of the arrangements. The firm must also send "prompt reports to the FCA about each case the firm contested but lost before an employment tribunal" where the claimant succeeded on a whistleblowing claim. That means detriment under section 47B or dismissal under section 103A of the Employment Rights Act 1996.
7. Train three populations. These are UK-based employees, managers of UK-based employees "wherever based", and the employees who operate the arrangements. SYSC 18.3.4G sets the content.

SYSC 18.3.3G adds that a firm may run the arrangements itself, within its group or through a third party. The firm remains responsible whichever it chooses.

The whistleblowers' champion

SYSC 18.4 gives an existing senior manager an extra responsibility. The whistleblowers' champion is a senior manager responsible, in the words of SYSC 18.4.4R, "for ensuring and overseeing the integrity, independence and effectiveness of the firm's policies and procedures on whistleblowing, including those intended to protect whistleblowers from being victimised".

It is a prescribed responsibility. Row 13 of the table in SYSC 24.2.1R, "Acting as the firm's whistleblowers' champion", must be allocated to a named senior manager. Insurers must appoint a director or senior manager under SYSC 18.4.2R.

The champion must have authority and independence, and access to independent legal advice and training. The champion need not have a day-to-day operational role. Under SYSC 18.4.5G, the FCA "expects that a firm will appoint a non-executive director". The point is that the person who oversees the system should not be a person whose conduct the system might one day examine.

The Barclays case set the standard a champion is expected to stand behind. The regulators required Barclays to report to them every year, for cases up to the end of 2020. The report had to include any case where the bank had sought to identify an anonymous whistleblower. Its whistleblowers' champions had to attest personally, each year, to the soundness of its whistleblowing systems and controls.

The report had to disclose any such case, and a named champion vouched for the system behind it. To do that, a champion needs to see every case and who accessed it, without having run the investigations.

Telling staff about the regulator

SYSC 18.3.6R requires a firm to tell its UK-based employees three things:

• that they may disclose reportable concerns to the PRA or the FCA
• how to do so
• that reporting to a regulator is not conditional on first using the firm's own arrangements

The rule also says where the message must live. It goes in the employee handbook or its equivalent, so that every employee sees it.

The same principle runs into settlement agreements. SYSC 18.5.1R requires every settlement agreement with a worker to include a term stating that nothing in it prevents the worker from making a protected disclosure. SYSC 18.5.2E sets out the wording the FCA will treat as compliant:

For the avoidance of doubt, nothing precludes [name of worker] from making a 'protected disclosure' within the meaning of Part 4A (Protected Disclosures) of the Employment Rights Act 1996. This includes protected disclosures made about matters previously disclosed to another recipient.

SYSC 18.5.3R bans a firm from asking a departing worker to warrant that they have made no protected disclosure. A warranty of that kind is a way of finding out whether someone has already gone to the regulator.

What the FCA's own numbers say

The FCA publishes an annual report on the whistleblowing reports it receives. The 2025/26 report, published on 9 July 2026, recorded 1,375 reports carrying 4,375 allegations. That was a 22 percent increase in reports on the year before. Of 1,252 cases closed, 523, or 42 percent, led to direct action by the FCA.

Consumer Duty was the subject raised most often, at 35.4 percent of reports against 13.2 percent two years earlier. Two other numbers matter for firms. First, 438 of the 1,375 reporters, 32 percent, were anonymous, and the FCA acts on their reports.

Second, the routes: 655 reports came by online form, 218 by telephone and 40 by letter. People use the method in front of them, which is why SYSC 18.3.1R asks for a "range of communication methods".

The reports also record the FCA learning to be a better recipient. Its 2022 survey of whistleblowers, published on 4 May 2023 from 21 responses, found that people came to the FCA "as a listener of last resort". It also found that "Eight of the 9 individuals who had received final feedback were dissatisfied". Respondents said updates lacked substance, and a firm's own whistleblowers can make the same complaint.

The FCA introduced enhanced final feedback letters in 2024/25. In 2025/26 it restructured the team and brought in a new whistleblowing case management tool. On 6 October 2026 it asked its non-executive director Lea Paterson to review its handling of the whistleblower Simon Andriesz.

Non-financial misconduct

Non-financial misconduct is conduct toward colleagues rather than customers or markets. In consultation paper CP25/18 (July 2025), the FCA confirmed the rule change for firms other than banks and consulted on guidance. In December 2025, PS25/23 said that "the guidance will come into force on 1 September 2026 at the same time as the new rule at COCON 1.1.7FR".

COCON is the Code of Conduct sourcebook, which holds the Conduct Rules. The new rule brings "serious instances of bullying, harassment and similar behaviour" toward colleagues within those rules. It applies to all firms with a Part 4A permission under the Financial Services and Markets Act 2000 (FSMA), matching the position at banks.

The FCA has said where it expects these cases to surface. In an October 2025 letter to the Treasury Committee, it said serious, substantiated non-financial misconduct should be reported as a Conduct Rules breach where applicable. Such cases should also be reflected in regulatory references. The FCA said it expects them to be raised through whistleblowing channels.

A harassment complaint that breaches the firm's policies already falls within SYSC 18's definition of a reportable concern. It is not only an HR matter. The route it arrived by, and what was done with it, are things a supervisor can ask to see.

The FCA's own survey shows the gap. On 25 October 2024 it published its culture and non-financial misconduct survey of 1,028 wholesale firms, covering incidents from 2021 to 2023. Half of the incidents were found through grievances, not the whistleblowing route. The survey also found that "Some relevant policies, like whistleblowing and disciplinary policies, were not in place at all firms surveyed".

A firm that handles harassment through a grievance process alone cannot show that the concern was assessed and escalated as SYSC 18 describes. There is a fair point on the other side: a grievance seeks a remedy for the person, and a report seeks action on the conduct. The fix is one standard for both routes. A serious case entering by either door is recorded, assessed and escalated the same way, and the person who raised it is protected.

What the SM&CR reforms change and do not change

The Senior Managers and Certification Regime is being cut back. HM Treasury and the FCA consulted in 2025 and published their conclusions on 22 April 2026. The FCA's PS26/6 brought most of its Phase 1 changes into effect on 24 April 2026. The non-financial misconduct alignment followed on 1 September 2026, and a Phase 2 consultation is promised for later in 2026.

The Treasury intends to do four things in legislation:

• remove the Certification Regime from primary legislation, including annual recertification
• reduce the number of pre-approved senior management functions
• repeal the statutory provisions on statements of responsibilities
• repeal the legislative requirements to notify regulators of Conduct Rules breaches and to conduct mandatory training

The legislation is to come "as soon as parliamentary time allows". The regulators keep their rule-making power.

Phase 1 does not change SYSC 18. It leaves the whistleblowing rules, the champion's prescribed responsibility and the settlement agreement clause unchanged. It also leaves the individual Conduct Rules in place.

Rule 1 is "You must act with integrity", and Rule 3 is "You must be open and cooperative with the FCA, the PRA and other regulators". Phase 2 has not yet been consulted on.

If the statutory training duty goes, the SYSC 18.3.1R training duty stands on its own. The FCA's expectation is in writing. How breach notification will work if the statutory duty is repealed depends on the Treasury's legislation and Phase 2.

What a regulator-ready system has to show

A supervisor, or a champion preparing an attestation, asks for evidence rather than policy. Most of that evidence comes from one record kept properly, the case file. Expect to show the following.

1. More than one way to report, with at least one that works for someone who gives no name. That is the "range of communication methods" in SYSC 18.3.1R(2)(a), and for a PRA or MiFID firm the "specific, independent and autonomous channel".
2. A register of every reportable concern received, with its assessment, escalation decisions and outcome.
3. Up-to-date written procedures that UK-based employees can get to.
4. The last annual report to the governing body, saying what came in and what was done while preserving confidentiality.
5. Each whistleblowing claim (section 47B or 103A) the firm contested and lost at an employment tribunal, with the prompt report to the FCA, or the record that there were none.
6. Evidence of the champion's oversight, covering authority, resources, independent legal advice and the cases reviewed in the year.
7. Training completion records for UK-based employees, their managers wherever based, and the operators.
8. The handbook passage telling employees they may go to the FCA or the PRA, how to do it, and that they need not report internally first.
9. The SYSC 18.5.2E wording in the settlement agreement template, and no warranty of no protected disclosure.
10. The measures against victimization, meaning what keeps the people a report concerns away from it, and the record of who accessed it and when.
11. Where a third party receives reports, the contract and oversight that keep responsibility with the firm.

How Confide supports SYSC 18 arrangements

A champion signing off the annual board report needs the case record behind it. Confide's Whistleblowing Software keeps that record for the items on the list that depend on it. It does not supply the procedures, training or governance, and it does not make a firm compliant.

Reporters can choose not to give their name and still exchange messages with investigators, reading updates and answering questions later. Reports can come in by web form, voice, QR code or email, and each lands in the same case. Whether and what to tell a reporter is still the firm's decision.

Each report, its evidence and the messages about it stay in one case file until it closes, and every access and action is logged. User roles control who can see or work on each matter, so a champion can be given sight of cases without handling them. If a user is named in a report, Confide automatically revokes their access to that case. The firm still decides how it assesses, escalates and protects, and stays responsible for the arrangements, as SYSC 18.3.3G says.

FCA whistleblowing rules FAQ

Which firms must comply with SYSC 18?

SYSC 18 binds UK deposit takers with assets of £250 million or more, PRA-designated investment firms, Solvency II insurers and reinsurers, and Lloyd's and its managing agents. UK branches of overseas banks must tell their UK staff about the FCA and PRA whistleblowing services. The rest of SYSC 18 does not bind them.

For every other FCA-authorized firm, SYSC 18 is non-binding guidance a firm may adopt as best practice. The FCA would treat detriment to a whistleblower at any firm as a serious matter (SYSC 18.3.9G). Firms outside scope often adopt the chapter as their standard.

Who can be the whistleblowers' champion?

The champion is a senior manager allocated the prescribed responsibility in SYSC 24.2.1R, "Acting as the firm's whistleblowers' champion". The FCA expects a non-executive director, and insurers must appoint a director or senior manager. The champion oversees the integrity, independence and effectiveness of the whistleblowing arrangements. The champion must have authority, independence and access to independent legal advice, and need not have a day-to-day operational role.

Do we have to accept anonymous reports?

Yes, if SYSC 18 binds you. SYSC 18.3.1R requires arrangements that can handle disclosures where the whistleblower has chosen not to reveal their identity, through a range of communication methods. The FCA itself acts on anonymous reports: 32 percent of the 1,375 it received in 2025/26 were anonymous. Following up with an anonymous reporter needs a route that lets the firm reply without identifying them.

What must a settlement agreement say about whistleblowing?

Under SYSC 18.5.1R, every settlement agreement with a worker must include a term stating that nothing in it prevents the worker from making a protected disclosure. SYSC 18.5.2E gives the wording. Nothing precludes the worker from making a protected disclosure within the meaning of Part 4A of the Employment Rights Act 1996, including about matters previously disclosed to another recipient. SYSC 18.5.3R bans any warranty that no protected disclosure has been made.

Does non-financial misconduct go through the whistleblowing process?

The FCA expects it to. In an October 2025 letter to the Treasury Committee, it said serious, substantiated non-financial misconduct should be reported as a Conduct Rules breach where applicable. It should also be reflected in regulatory references.

The FCA also expects such cases to be raised through whistleblowing channels. From 1 September 2026, COCON 1.1.7FR brings serious bullying and harassment within the Conduct Rules at all FSMA firms with a Part 4A permission.

A four-point check for any concern

SYSC 18 is long, but a quick check of your arrangements is short. For any concern that arrives, the firm should be able to show four things. It assessed what the concern says and kept the people it names away from it. It told the reporter something back, and it kept a record a supervisor could read a year later.

A firm that can show all four has the core of what SYSC 18 asks for, whether or not the rule binds it. To keep those four answers in one record, start with Confide's Whistleblowing Software, which holds each concern in one case file from intake to resolution.