Prudential Regulation Authority Rulebook

2.1

The PRA expects relevant firms to put in place systems and controls to support the whistleblowing procedures required by the rules, and for the procedures themselves to be subject to inspection by audit and compliance functions. Internal procedures should:

• ensure the firm protects the confidentiality of whistleblowers, if the individual concerned requests this;
• ensure the firm is able to handle disclosures from people who wish to remain anonymous;
• assess and escalate concerns raised by whistleblowers within the firm as appropriate, and, where this is justified, to the FCA, PRA (or an appropriate law enforcement agency);
• track the outcome of whistleblowing reports;
• provide feedback to whistleblowers, where appropriate;
• prepare written procedures (eg staff handbooks);
• maintain appropriate records; and
• take all reasonable steps to ensure that no person under the firm’s control engages in victimisation of whistleblowers, and take appropriate measures against those responsible for any such victimisation.

2.2

A larger firm may create an internal specialist unit to handle disclosures and perform some of the above tasks. A firm’s arrangements should seek to ensure that there are different methods of communication available to a whistleblower: for example, a dedicated phone line or e-mail address.

2.3

The PRA realises that some firms may use third parties to provide aspects of this service. The PRA expects that firms will consider the quality of the services being offered, and how this can be monitored.

2.4

It may be more appropriate for some matters raised through the whistleblowing function to be dealt with by other areas, such as customer complaints or individual human resources grievances. Firms should be able to filter out genuine whistleblowing cases from those that could be better handled by other functions.