Whistleblowing Training: How to Build a Speak-Up Culture in Financial Services

The FCA received 355 whistleblowing reports in Q1 2026 alone, a 26% jump on the same period last year. Every one of those reports pointed to something that internal training and culture should have caught earlier. Yet research from the charity Protect found that 38% of whistleblowers say their concerns were ignored after raising them, and 71% were dismissed, victimised, or resigned after speaking up.³

For compliance officers and HR leaders in financial services, that gap between having a whistleblowing policy and building a culture where people actually use it is where real risk lives. This guide covers the FCA’s whistleblowing training requirements under SYSC 18, the regulatory framework you need to know, and the practical steps to build a speak-up culture that protects your firm and your people.

Why Whistleblowing Training Matters in Financial Services

Financial services firms operate under some of the most intense regulatory scrutiny of any sector. The FCA has been clear: whistleblowing is a critical source of intelligence for identifying harm to consumers, markets, and the wider economy. In its 2024/25 annual report, the regulator confirmed that over half of all whistleblowing reports it reviewed led to direct action, including enforcement, skilled person reviews, and restrictions on firms or individuals.²

But here is the uncomfortable truth. The FCA also found that the top allegations in whistleblowing reports consistently relate to compliance failures, fitness and propriety concerns, organisational culture issues, and consumer detriment. These are not exotic risks. They are the everyday failures that proper training should prevent, or at minimum surface before they become regulatory problems.

The Barclays case remains a cautionary tale. In 2018, then-CEO Jes Staley was fined over £642,000 by the FCA and PRA for attempting to identify a whistleblower who had raised concerns directly with the board.⁷ The case exposed exactly what happens when senior leadership treats whistleblowing as a threat rather than a safeguard.

Whistleblowing training is not just about teaching employees to fill in a form. It is about building the confidence, knowledge, and trust that makes people willing to speak up before a problem becomes a headline. Firms that invest in compliance training that covers whistleblowing as a core topic rather than an afterthought are better placed to meet FCA expectations and avoid the regulatory and reputational damage that follows preventable failures.

The FCA Regulatory Framework for Whistleblowing Training

The FCA’s whistleblowing rules sit primarily in SYSC 18 of the FCA Handbook. These apply to a broad range of regulated firms, including banks, building societies, credit unions, insurers, investment firms, mortgage lenders, and consumer credit firms.

FCA Regulation

SYSC 18 — FCA Handbook: Whistleblowing

“A firm must establish, implement and maintain appropriate internal procedures for the handling of reportable concerns communicated by whistleblowers, and communicate those procedures to all its employees in the United Kingdom.”

Source: FCA Handbook, SYSC 18

What SYSC 18 Requires

Under the current rules, regulated firms must:

• Establish, implement, and maintain appropriate internal procedures for handling reportable concerns from whistleblowers.
• Communicate those procedures to all UK-based employees.
• Provide training so that employees understand the whistleblowing policy and how to use it.
• Maintain a mechanism for anonymous disclosures.
• Ensure that whistleblowers are not subject to detriment for making a protected disclosure.
• Include a term in any settlement agreement making clear that nothing prevents a worker from making a protected disclosure.

The Whistleblowers’ Champion

Firms with 250 or more employees in regulated activities must go further. SYSC 18.4 requires these firms to appoint a Whistleblowers’ Champion, typically a non-executive director or senior manager. The Champion’s responsibilities include overseeing the integrity, independence, and effectiveness of the firm’s whistleblowing policies and procedures; ensuring whistleblowers are not victimised for raising concerns; and reporting to the board at least annually on the operation of the firm’s whistleblowing arrangements.⁶

Genuine oversight, not a rubber stamp

The FCA expects Whistleblowers’ Champions to actively review the volume and nature of disclosures, how investigations were handled, and whether the firm’s culture genuinely supports speaking up. A Champion who simply signs off an annual report without interrogating the data is not meeting the regulatory expectation.

The SM&CR Connection

Under the Senior Managers and Certification Regime (SM&CR), senior managers have a personal duty of responsibility that extends to ensuring effective whistleblowing systems and controls. A failure here can result in individual accountability, not just a firm-level problem. This makes whistleblowing training for managers particularly critical. Senior leaders need to understand not only the policy, but their personal regulatory obligations under SM&CR.

What Changed in 2025: The Employment Rights Act and the Whistleblower Bill

The regulatory environment for whistleblowing shifted significantly in 2025, and firms that have not updated their training are already behind.

Day-one protections

The Employment Rights Act 2025 removed the qualifying period for whistleblowing protections. Employees now have full protection from their first day of employment. They no longer need a minimum service period to bring a claim for detriment or unfair dismissal related to a protected disclosure.⁹

Sexual harassment as a qualifying disclosure

Sexual harassment is now explicitly recognised as a standalone category of protected disclosure under whistleblowing law. Previously, employees had to frame harassment reports as a ‘breach of legal obligation’ to access whistleblowing protections. That barrier is gone. This aligns with the strengthened sexual harassment prevention duty that took effect in October 2025, requiring employers to take “all reasonable steps” to prevent harassment.

The Whistleblower Bill

The Protection for Whistleblowing Bill, currently progressing through Parliament, proposes an independent office to manage whistleblower reports, new civil and criminal offences for retaliation, and extending coverage to contractors, freelancers, volunteers, and trustees. While not yet law, it signals the direction of travel clearly.

Update your training now

Training content that still references pre-2025 legislation, including the old qualifying period requirements or the previous harassment framework, risks creating a false sense of compliance. If your whistleblowing training hasn’t been reviewed since before the Employment Rights Act 2025, it needs updating today.

5 Elements of Effective Whistleblowing Training

Compliance officers know that having a policy is not the same as having a programme. Effective whistleblower training for employees covers five core areas:

From Whistleblowing Training to Speak-Up Culture: Closing the Gap

Training is necessary but not sufficient. The FCA has been explicit that it assesses the quality, not just the existence, of whistleblowing arrangements. A House of Commons Treasury Committee report found that whistleblowing processes within financial services firms are “often ineffective at tackling bad behaviour or protecting those who report harassment.”¹⁰

Closing the gap between training and culture requires action at three levels:

Leadership Commitment

Speak-up culture starts at the top. When the FCA talks about organisational culture as one of the top allegations in whistleblowing reports, it is talking about firms where leadership says the right things but does not follow through. Leaders need to visibly support whistleblowing by referencing it in town halls, sharing anonymised outcomes, and holding themselves accountable when concerns are raised. Under SM&CR, this is not optional.

Continuous Reinforcement

Annual training creates an annual compliance spike followed by 11 months of forgetting. The most effective programmes reinforce whistleblowing awareness throughout the year through regular microlearning modules, scenario refreshers, and timely updates when regulations change. This approach aligns with the FCA’s expectation of ongoing training, not a one-off exercise. 5Mins.ai’s compliance training platform automates this continuous reinforcement, delivering role-specific content on a schedule that keeps knowledge fresh without overwhelming employees.

Feedback Loops and Transparency

Employees need to see that reporting works. When 38% of whistleblowers say their concerns were ignored, the message is clear: the system is broken at the response end, not the reporting end.³ Firms should communicate outcomes (within confidentiality constraints), publish aggregate data on reports received and actions taken, and use their Whistleblowers’ Champion annual report as an opportunity to demonstrate accountability, not just compliance.

Getting Started: A Practical Checklist

Whether you are building a whistleblowing training programme from scratch or updating an existing one, these eight steps will help you meet FCA expectations and build genuine speak-up confidence: