For FCA-authorised firms · SYSC 18 · Non-financial misconduct
Whistleblowing you can show the FCA.
Anonymous reporting, case management and the audit trail your Whistleblowers' Champion needs — and a low-cost route for smaller authorised firms.
ISO 27001 · AES-256 · No IP logging · Full audit trail · 50+ languages
Does this apply to your firm?
From 1 September 2026, the FCA's conduct rules on bullying, harassment and violence apply to every FCA-authorised firm — not only the larger firms already covered by the detailed whistleblowing rules in SYSC 18.
If you hold FCA permissions and have a Firm Reference Number, that includes you. In practice, that means firms like:
- Mortgage brokers and mortgage advisers
- Independent financial advisers and wealth managers
- Insurance brokers and intermediaries
- Consumer credit firms
- Payment and e-money firms
- Claims management companies
- Investment firms and asset managers
Smaller firm, no compliance department?
What changes for you on 1 September
Larger firm with a Whistleblowers' Champion?
How this maps to SYSC 18
Not FCA-authorised? See our UK whistleblowing page
From 1 September 2026, this is not just a large-firm question
SYSC 18 has bound the larger end of the sector since 2016 — SMCR banking firms, Solvency II insurers, UK MiFID investment firms. Those firms must operate internal whistleblowing arrangements and appoint a Whistleblowers' Champion.
The FCA's non-financial misconduct regime, set out in PS25/23 and effective from 1 September 2026, reaches considerably further: every FSMA Part 4A authorised firm. Firms that have never had to think formally about a speak-up route now need one that works, and need to be able to show what happens to a concern once it is raised.
- 1,131
- whistleblowing reports received by the FCA in 2024/25FCA Prescribed Persons Annual Report 2024/25
- 908
- times whistleblower information enabled direct FCA action against firms in that yearFCA Prescribed Persons Annual Report 2024/25
- +104%
- year-on-year rise in whistleblowing detriment claims reaching employment tribunalsMinistry of Justice tribunal statistics, reported March 2026
Every one of those reports is someone who did not feel able to raise it internally, or did and was not heard.
What SYSC 18 asks of your firm, and how this supports it
| What your firm must do | How Whistlelink supports it |
|---|---|
| Operate internal arrangements able to handle all types of disclosure from all types of person | Web, voice and optional phone hotline, open to employees, contractors, agency workers and third parties, in 50+ languages |
| Ensure the arrangements allow disclosures to be made anonymously | No IP addresses logged; optional voice distortion; anonymous two-way messaging so cases can be progressed without identifying the reporter |
| Appoint a Whistleblowers' Champion with oversight of the integrity, independence and effectiveness of the arrangements | Oversight dashboard and exportable reporting pack: volumes, categories, time to first response, time to close, outcomes |
| Prepare reports for the governing body on the operation and effectiveness of the arrangements | Board and committee reporting built from the case record, not reassembled by hand from a spreadsheet |
| Protect the confidentiality of the whistleblower | Category-based access control, so a case about a business area is not visible to that business area |
| Be able to evidence how a concern was handled | Immutable audit log of every action, with configurable retention |
| Inform staff of the FCA and PRA whistleblowing services | Configurable notices in the reporting flow |
Handbook reference: FCA SYSC 18. This table is a summary written to help you scope a system, not regulatory advice, and it is not a substitute for reading the rules as they apply to your permissions.
What your Whistleblowers' Champion actually sees
Every report lands in one secure case record: category, submission time, status and deadline, with an encrypted two-way message thread so your case officer can ask follow-up questions without ever learning who raised it.
- Anonymous, encrypted two-way dialogue with the reporter
- Case status, owner and deadline visible in one view
- 1
Raised
A worker reports anonymously in their own language, from any device.
- 2
Acknowledged
Your case officer confirms receipt within the deadline you set.
- 3
Investigated
Follow-up questions and evidence stay inside the encrypted case record.
- 4
Closed
Outcome and every action logged, ready for oversight reporting.
See the case record and the oversight report for yourself.
A fifteen-minute walkthrough, with a compliance lead who knows SYSC 18.
The channel exists so the concern reaches you first
Under section 43C(2) of the Employment Rights Act 1996 (Article 67C(2) of the Employment Rights (Northern Ireland) Order 1996 for firms in Northern Ireland), a disclosure to a third party under a procedure your firm has authorised counts as a disclosure to you. Under section 43G(3)(f), when a tribunal weighs whether a worker was reasonable in going public, it must consider whether they used your procedure first.
Whistleblowing detriment claims reaching employment tribunals rose 104% year on year, to 1,546 in a single quarter, and compensation in whistleblowing cases is uncapped. Since 6 April 2026, HMRC's strengthened reward scheme pays informants 15% to 30% of tax recovered in cases above £1.5m.
Sources: Ministry of Justice tribunal statistics, reported March 2026; HMRC.
Two more changes worth noting
Sexual harassment is now an express protected disclosure
Section 23 of the Employment Rights Act 2025 added it to the qualifying disclosure categories under the Employment Rights Act 1996, with effect from 6 April 2026. Read alongside the FCA's non-financial misconduct rules, conduct concerns and whistleblowing obligations now overlap directly. This change extends to England, Wales and Scotland; Northern Ireland has its own whistleblowing regime under the Public Interest Disclosure (Northern Ireland) Order 1998.
Failure to prevent fraud
If your firm meets two of three tests — more than 250 employees, more than £36m turnover, or more than £18m in total assets, assessed group-wide — it has been in scope of the Economic Crime and Corporate Transparency Act's corporate offence since 1 September 2025. The only defence is reasonable fraud prevention procedures, and the Home Office's statutory guidance addresses whistleblowing arrangements directly.
Smaller FCA-authorised firm? What changes for you on 1 September
What changes, and what doesn't
Until now, the FCA's detailed whistleblowing rules — SYSC 18 — have applied only to larger firms: SMCR banking firms, Solvency II insurers and UK MiFID investment firms. If you are not one of those, you have never had to operate a formal whistleblowing channel. That has not changed, and you still don't.
What changes on 1 September is narrower and more practical. Bullying, harassment and violence in the workplace become a conduct matter the FCA can act on, at every authorised firm.
And separately, since 6 April 2026, reporting sexual harassment is a protected disclosure under UK whistleblowing law. So the same complaint can be a conduct matter and a whistleblowing matter at the same time — with statutory protection for the person who raised it, and uncapped compensation if they are treated badly for having done so.
The practical consequence is not that you must buy a system. It is that if a concern like this arises, you need to be able to show how it reached you and what you did about it.
What you actually need to have in place
- 1
A route in.
Somewhere a colleague can raise this kind of concern that isn't only "tell your manager" — because in a firm of fifteen people, the manager is quite often the subject of the concern.
- 2
A record.
What was raised, when, who handled it, what was decided. A conversation in a corridor leaves nothing behind, and "we dealt with it informally" is not an answer you can give a regulator.
- 3
Evidence that something happened.
Not an outcome the FCA necessarily agrees with — a documented, reasonable response.
What you don't need
- A telephone line staffed around the clock.
- A compliance project or an implementation programme.
- A Whistleblowers' Champion. That obligation sits in SYSC 18 and still applies only to larger firms.
- A policy rewrite before you can start. You can have a working channel today and tidy up the policy afterwards.
To be plain about it: the FCA is not requiring you to buy whistleblowing software. It is requiring you to be able to answer the question. We think a proper channel is the cheapest and most defensible way to be able to answer it — but you should be sceptical of anyone who tells you it is compulsory, because it isn't.
What it costs for a smaller firm
| Firm size | Price per month |
|---|---|
| Up to 49 employees | £69 |
| 50–149 employees | £89 |
| 150–249 employees | £129 |
Flat price per band, not per employee. No implementation fee. No multi-year contract. Setting up your channel takes about ten minutes.
250 employees or more? See all pricing bands
Security, data and retention
- ISO 27001 certified. AES-256 encryption at rest.
- No IP addresses logged.
- Configurable retention periods and deletion.
- Category-based access control and full audit logging.
- Hosted in the EU. Case data stays within the European Economic Area. The European Commission renewed the UK's data adequacy decision in December 2025, in effect until December 2031, so transfers between the UK and the EU require no additional safeguards.
- DPIA support and a documented processor agreement.
Ready to take it to your risk assessment?
We can hand over our security documentation ahead of the demo.
Straight answers
The questions compliance officers, Whistleblowers' Champions and SMF holders at FCA-authorised firms ask before they scope a system.
15 minutes, and you will know whether it fits.
A short walkthrough of the reporting flow, the case record, and the oversight reporting your Champion would see.