Whistleblowing – cross-border considerations

June 2023  |  FEATURE | FRAUD & CORRUPTION

Financier Worldwide Magazine

June 2023 Issue

Over the course of the last decade, whistleblowing has become an increasingly important tool in the fight against corruption and corporate malfeasance. While in some circles the concept of a whistleblower may still have negative connotations, these individuals play a pivotal role in revealing risks and blind spots arising from illegal activities, unethical behaviour and cover-ups, for example. Whistleblowing is prominently associated with corporate fraud, where insider reporting may lead to the identification and apprehension of people involved in financial misconduct.

A 2016 study commissioned by the European parliament found that corruption costs the EU between €179bn and €990bn in GDP each year. According to the World Bank, more than $2.6 trillion, or around 5 percent of global GDP, is lost to corruption annually around the world.

Beyond the financial, there are also significant social and political costs. For instance, corruption suppresses electoral and other democratic participation, and leads to inefficient delivery of public services, all of which erodes public trust. These ripple effects reinforce structural inequality and discourage participation in government and democracy, as well as severely hamper inclusivity and sustainability programmes.

Given the impact, there is pressure on governments, regulators and companies to raise awareness of the threat of unchecked bribery and corruption and to incentivise action to stamp it out. In the US, for example, financial incentives are provided to whistleblowers to encourage them to report. Under the Whistleblower Programme contained within the Dodd-Frank Act, reports are invited from whistleblowers anywhere in the world relating to breaches of securities laws by companies that issue securities in the US. Such offences could entail bribery, financial reporting irregularities or price manipulation. Under the Act, whistleblowers stand to gain between 10 and 30 percent of any penalties ultimately recovered from those convicted, provided these exceed $1m.

Regulatory developments

Irrespective of the underlying nature of a whistleblower’s report, it must be taken seriously, particularly as a number of jurisdictions have introduced new guidance or tweaked existing legislation.

One of the most notable developments in recent years has been the introduction of the EU Whistleblowing Directive, in force since December 2019. Prior to its introduction, many whistleblowing protections throughout the EU were incomplete or poorly enforced. This groundbreaking Directive established minimum standards for whistleblower protections across EU member countries, which have the option to put in place greater protections in their own national laws than what is required under the Directive.

EU countries were required to implement the Directive’s provisions into their national legislation by 17 December 2021. Organisations with 50-249 workers have until 17 December 2023 to introduce appropriate internal reporting channels.

However, omissions within the 2019 Directive, policies left to national discretion and widespread delays in incorporating its provisions into national law could lead to some discrepancies in whistleblower protections between member states. Further, a lack of clear implementation and enforcement mechanisms in many member states may result in weaker protections in practice than in theory. This is especially concerning in cross-border whistleblower cases, where inadequate protections in one member state could have ramifications for international investigations and for whistleblowers themselves depending on their location in the EU.

Though the emergence of new regulatory and legislative developments around whistleblowing is encouraging, the proliferation of contrasting standards can create challenges. There are differences as to what disclosures will qualify for protection and what that protection involves. Compensation for whistleblowers who are discriminated against varies widely, as does the level of punishment for those who break the law by retaliating.

Speak up

Given the increasing regulatory focus on whistleblowing in recent years, it is important for companies to have effective procedures in place that encourage early disclosure of concerns, giving them the opportunity to mitigate more serious damage. Embedding a strong speak-up culture is key.

“The primary concern of companies right now is ensuring that whistleblowers come to them and do not report their knowledge of fraud or other misconduct within the organisation to external reporting channels, such as regulators or the media,” says Alja Poler De Zwart, a partner at Morrison & Foerster LLP. “For this to work, the company must have set up appropriate processes to ensure fair handling of whistleblower reports, and informing the pool of potential whistleblowers that it is in their best interest to report any misconduct to the company as soon as possible.

“Think of it as positive PR action addressed to the pool of potential whistleblowers,” she continues. “This means making informative training sessions and materials available to potential whistleblowers to explain how hotlines work, how whistleblowers are protected, what rights they have and how much the company appreciates well-intentioned whistleblowers and will protect them. This is the trend that we have seen emerge since the new EU whistleblowing rules came into effect. The focus is on encouraging whistleblowers to inform organisations about corporate fraud instead of them approaching regulators or going public via the media, which they have a right to do in certain conditions under the new EU Whistleblowing Directive.”

In light of the new EU whistleblowing rules, companies have a higher stake in ensuring they investigate whistleblowing reports properly, impartially and fairly. “Potential whistleblowers need to trust the company with their concerns,” points out Ms De Zwart. “Under the new EU rules, whistleblowers will now be legally allowed – and even encouraged – to report their concerns to regulatory authorities, and in some instances even to the media. They can do so if they believe, for example, that they could be subject to retaliation or if they feel that the organisation will not take their report seriously and is unlikely to investigate further.

“If a report is made outside the company, it exposes the company to a regulatory investigation that could have been avoided if the issue was resolved internally at an earlier stage. And if a whistleblower chooses to disclose their concerns to the media, this may create additional problems for the company – not only the risk of regulatory investigation but also reputational damage and the distrust of investors, shareholders, customers and other stakeholders, which can result in a world of pain for the organisation.”

Organisations must be aware of the risks and benefits associated with whistleblowing. Of course, any kind of wrongdoing will reflect badly on the organisation, eroding employee morale. It can lead to costly court cases, regulatory fines, damages payouts, or even criminal proceedings against senior management. But encouraging internal whistleblowing reports puts the company in control of resolving the issue and managing the fallout. It reduces the risk of the company suffering from reputational damage if the disclosure is instead made in the public domain.

“Companies should take all available steps to not only encourage whistleblowers to report their knowledge of corporate fraud directly to the organisation, but also reassure individuals that the company will treat them with respect and handle their reports appropriately,” says Ms De Zwart.

Once a company receives a report from a whistleblower, certain important steps should be followed. There is no ‘one size fits all’ approach, but best practice suggests that immediately after receiving an internal report, the company should inform the whistleblower that their allegations are being taken seriously, and manage their expectations about the subsequent process.

“While many organisations acknowledge receipt of a report when it is received, this is generally done as a matter of best practice rather than a specific legal requirement,” says Ms De Zwart. “Under the new EU Whistleblowing Directive, however, organisations must confirm receipt of a whistleblower’s report within seven days.”

Investigations

Navigating an internal investigation arising from a whistleblower report raises many challenges, particularly in a cross-border context. A key step is to implement an appropriate internal investigations protocol that covers not only whistleblowing investigations but any other kind.

“Investigations protocols ensure that organisations conduct internal investigations in a uniform and compliant manner,” notes Ms De Zwart. “Protocols are a roadmap for the company’s investigators, outlining what they are allowed to do, what they have to do and what they should not do when investigating alleged misconduct within the organisation. Without this protocol, an investigation process can itself become non-compliant, and may potentially result in the evidence collected being unusable in litigation – fruit of the poisonous tree.”

In addition, the EU Whistleblowing Directive entitles whistleblowers to receive feedback about reports they submit. According to Ms De Zwart, there are two issues to consider in this context. The first is when that feedback should be provided. “Although the Directive requires feedback to be provided within three months from the date the company acknowledged receipt of the report, companies should consider providing more frequent updates during lengthy investigation processes,” she says. “Prolonged silence from the organisation might cause a whistleblower to consider reporting their concerns to regulators or the media, for example.”

The second issue is what the feedback should contain. The Directive states that the feedback should include a description of any action planned or taken following receipt of the whistleblower report, as well as the grounds for any action planned or taken. “Regulators will hopefully issue more detailed guidance on this aspect,” says Ms De Zwart. “In any case, companies should keep in mind the privacy rights of the implicated individuals and other third parties when providing their feedback, and avoid including specific information about such individuals. Under certain circumstances, companies may also limit the level of detail they provide to avoid compromising the investigation. Companies subject to the new EU whistleblowing rules need to take such considerations into account when setting up an internal investigation.”

Shielding against retaliation

The risk of retaliation is a core issue for those considering whether to make a report. Whistleblowers may find themselves subject to a number of unethical or even illegal practices on the part of the company, such as withholding career progression, changing working hours or place of work, harming an individual’s reputation, early contract termination, blacklisting, or receiving a negative performance review or employee reference.

Protections are needed to safeguard the rights of individuals who do speak up. Weak or unenforced protections may disincentivise individuals to report suspicious behaviour or knowledge of illegal activities which they experience or witness.

“Companies should provide training to all internal stakeholders, such as internal investigators and human resources (HR), to eliminate the possibility of retaliation against a whistleblower,” suggests Ms De Zwart. “The concept of retaliation has become so broad under the new EU rules that just about any kind of consequences perceived as negative by a potential whistleblower could result in them turning to outside channels to make their report.

“Organisations should strive to make their internal whistleblowing and investigation processes as whistleblower-friendly as possible, and make this known to employees so that they feel comfortable reporting concerns to the organisation rather than to regulators or the media,” she continues. “Operating procedures should be clear and whistleblower-friendly. Internal investigation protocols should make it plain to all involved what is and is not allowed. Extensive training should be given throughout the organisation. There should also be additional, independent internal mechanisms for individuals who want to complain about the whistleblowing process itself, such as instances of retaliation. And, of course, the company should be sure to inform potential whistleblowers about everything the company has done to protect them and how appreciated they are by the company.”

Ultimately, an open and honest corporate culture should cultivate an environment where employees feel comfortable speaking up when they spot red flags. The alternative is that they raise their concerns elsewhere, which could have devastating consequences.

© Financier Worldwide

BY

Richard Summerfield