FCA Whistleblowing Obligations for Payment Institutions and EMIs

Whistleblowing is one of the most important mechanisms for detecting regulatory breaches, fraud, money laundering and misconduct within financial services firms. For FCA-authorised payment institutions and electronic money institutions, maintaining effective whistleblowing arrangements is both a regulatory obligation and a practical safeguard against the accumulation of unchecked compliance failures. This article examines the legal framework, FCA expectations and practical implementation steps for payment firms.

What Are the FCA Whistleblowing Requirements?

The FCA's whistleblowing framework is set out in SYSC 18 of the FCA Handbook. Its rules apply to UK banks (other than small deposit takers) and to insurers. SYSC 18.1.1C allows any other firm to adopt the chapter as best practice, which is the sensible benchmark for payment institutions and EMIs. The rules require firms to have appropriate internal arrangements for the disclosure of reportable concerns by whistleblowers: defined broadly to include employees, workers, contractors and, in some cases, former employees. The framework was significantly strengthened in 2016 following the recommendations of the Parliamentary Commission on Banking Standards and the FCA's own review of whistleblowing practices across the industry.

For payment institutions and EMIs, the binding requirements come from elsewhere. PIDA protects their workers, and the PSRs 2017 and EMRs 2011 require sound governance and adequate internal control. Good practice, drawn from SYSC 18, is to: set up internal reporting channels that are accessible and clearly communicated; protect whistleblowers from detriment or retaliation; give a senior individual responsibility for the arrangements; and keep records of disclosures, investigations and outcomes.

The Whistleblowers' Champion Role

UK banks must allocate the whistleblowers' champion responsibility to a senior manager, and insurers must appoint a director or senior manager as champion (SYSC 18.4). The champion oversees the integrity, independence and effectiveness of the firm's whistleblowing arrangements.

Payment institutions and EMIs are not required to appoint a formal champion. Naming a senior individual, ideally a non-executive director, to own the arrangements is good practice and helps show sound governance. This person should not be the compliance officer or MLRO, particularly where the concern may relate to AML failures, to avoid conflicts of interest.

PIDA Statutory Protections

The Public Interest Disclosure Act 1998 (PIDA) provides statutory protections for workers who make qualifying disclosures about matters including criminal offences, regulatory breaches, health and safety dangers, environmental damage, miscarriages of justice and deliberate concealment of any of these matters. Under PIDA, a qualifying disclosure can be made to the employer, a prescribed regulator (including the FCA and PRA), or, in limited circumstances, a wider audience.

Workers who make qualifying disclosures are protected against dismissal and detrimental treatment. An employee dismissed for making a qualifying disclosure can bring an automatic unfair dismissal claim regardless of length of service. Workers subjected to detriment short of dismissal can bring a claim to an employment tribunal. Firms should be aware that settlement agreements cannot prevent a worker from making a disclosure to a regulator: any contractual term purporting to restrict regulatory whistleblowing is void under PIDA and FCA rules.

FCA Direct Reporting and External Channels

The FCA operates its own whistleblowing line and actively encourages individuals to report concerns about regulated firms directly to the regulator. The FCA received 1,131 whistleblowing reports in 2024/25 and 1,375 in 2025/26, a 22% increase. It uses whistleblower intelligence to identify misconduct and prioritise supervision.

Payment firms should assume that some employees will report directly to the FCA rather than using internal channels. This is not a failure of the firm's arrangements: it reflects the statutory framework and the FCA's active encouragement. However, firms where the internal arrangements are perceived as ineffective, retaliatory or lacking confidentiality will see a higher proportion of external disclosures, reducing the firm's ability to address issues internally before they reach the regulator.

Practical Implementation for PIs and EMIs

Effective whistleblowing arrangements for payment institutions and EMIs should include: a written policy that is clearly communicated to all staff during onboarding and periodically thereafter; multiple reporting channels including at least one anonymous option (external hotline or online portal); a named senior individual responsible for receiving and managing disclosures; a documented investigation process with defined timescales; feedback mechanisms for whistleblowers; protections against retaliation embedded in HR policies; regular training for all staff on how to raise concerns; and board or governance committee reporting on whistleblowing activity at least annually.

Common failures observed during FCA assessments include: whistleblowing policies that are technically compliant but buried in employee handbooks with no active communication; absence of anonymous reporting options; investigation processes that are controlled by the subject of the complaint; inadequate record-keeping; and failure to report themes or trends to the board. The FCA takes a dim view of firms where the whistleblowing arrangements are a compliance exercise rather than a genuine safeguard.

Whistleblowing and the SMCR

SM&CR applies only to firms with a FSMA Part 4A permission, so it does not apply to pure payment institutions and EMIs. Where a payment group also holds a FSMA permission, for example for consumer credit, senior managers in that firm have a duty of responsibility, and suppressing or retaliating against whistleblowers could breach the conduct rules in COCON.

For payment group entities within SM&CR, responsibility for whistleblowing arrangements should be allocated to a named senior manager in their Statement of Responsibilities. Pure PIs and EMIs should name an owner in their governance documents. This individual should receive regular reports on disclosures, investigations and outcomes, and should be responsible for ensuring the board is informed.

Regulatory Context and Enforcement

The FCA has made clear that it considers whistleblowing to be a critical component of good governance and firm culture. While enforcement action specifically for whistleblowing failures is relatively rare, the FCA has taken action against firms and individuals for retaliating against whistleblowers or suppressing disclosures. More commonly, inadequate whistleblowing arrangements feature as an aggravating factor in enforcement cases arising from underlying misconduct: demonstrating that the firm lacked the mechanisms to detect and address problems internally.

Regulatory Counsel advises payment institutions and EMIs on whistleblowing policy design, governance frameworks and SMCR compliance. Contact us for a written proposal. See our compliance support page for more on our advisory services.