UK whistleblowing law requirements: What Your Organisation Must Actually Do

The UK is not bound by EU Directive 2019/1937, the Whistleblowing Directive that governs whistleblowing protections across EU member states. Instead, UK organisations fall under the Public Interest Disclosure Act 1998 (PIDA), which protects employees who report wrongdoing but takes a fundamentally different approach to how that protection is delivered.

This distinction matters because PIDA does not mandate that organisations establish an internal whistleblowing channel. With one significant exception: Financial Conduct Authority (FCA) regulated firms must comply with SYSC 18 (Senior Management Arrangements, Systems and Controls), which requires them to have internal reporting channels.

For all other UK organisations with 50 or more employees, an internal channel is not legally compulsory.

PIDA protects workers who make a qualifying disclosure of information they reasonably believe shows wrongdoing. Qualifying disclosures include breaches of law, miscarriages of justice, dangers to health and safety, damage to the environment, and deliberate concealment of such matters.

The protection is broad: an employee cannot be dismissed, subjected to detriment, or victimised for making a qualifying disclosure to a legal adviser, a prescribed person (such as their regulator), or in certain circumstances, to their employer or wider public.

However—and this is crucial—PIDA does not require an organisation to provide an internal channel through which employees can make these disclosures safely. The legal protection exists regardless of whether a channel exists. An employee can report directly to a regulator or law enforcement and still benefit from PIDA protection.

The absence of a legal mandate does not mean organisations should avoid establishing internal channels. There are compelling reasons to do so:

• Internal channels allow organisations to address wrongdoing before it escalates or becomes public.
• They provide better data on concerns within the organisation.
• They demonstrate a commitment to ethical culture—something increasingly expected by investors, regulators, and employees.

The absence of a legal requirement also means organisations have flexibility in how they design their procedures, unlike their EU counterparts or FCA firms, which operate within tighter regulatory constraints. Organizations seeking to understand their compliance obligations in detail should review our whistleblowing compliance checklist, which breaks down the specific requirements and best practices applicable to UK firms.

If your organisation is regulated by the FCA, SYSC 18 applies. This rule requires firms to establish and maintain internal procedures that allow employees to report concerns about breaches of financial services law. The rule reflects the EU Whistleblowing Directive's framework, even though the UK is no longer bound by the Directive itself.

For FCA firms, an internal channel is legally required. The rule does not, however, specify the precise mechanisms or timescales that apply under the EU Directive—such as the seven-day acknowledgement requirement in Article 9 of Directive 2019/1937—because UK regulatory rules operate independently.

For context, the EU Whistleblowing Directive (2019/1937) sets a higher baseline. Organisations with 50 or more employees must establish internal reporting channels. Organisations must acknowledge reports within seven days and provide feedback within three months. The Directive mandates external channels (via prescribed persons) and allows public disclosure under defined conditions. These protections apply to EU member states and organisations operating within their jurisdictions.

The UK's departure from this framework means organisations here have greater flexibility—but also a clearer responsibility to decide whether to implement similar protections voluntarily. For a detailed comparison of how different jurisdictions approach these requirements, consult our whistleblowing regulatory guide covering the UK, EU, and South Africa.

Many UK organisations—particularly those operating across Europe or competing for talent and investment against organisations with more robust procedures—implement channels that exceed legal requirements. This is good practice, not compulsion.

A well-designed internal channel typically includes:

• An accessible, confidential route to report concerns.
• Training for staff and managers on how to recognise and handle disclosures.
• A documented process that acknowledges reports promptly and investigates fairly.
• Protection for reporters against victimisation and confidentiality breaches.
• Clear outcomes communicated back to the reporter.

These elements reflect the spirit of the EU Directive, even though they are not legally mandated in the UK. If you're ready to build or strengthen your whistleblowing programme, explore our comprehensive whistleblowing solution designed to meet UK requirements and exceed best practice standards.

Your legal obligations depend on your circumstances:

• Non-FCA regulated organisations: PIDA applies. You must not dismiss or subject employees to detriment for qualifying disclosures. An internal channel is optional, but good practice.
• FCA-regulated firms: SYSC 18 applies. You must establish and maintain internal reporting procedures. PIDA applies in addition.
• Organisations with 50+ employees operating in the EU: If you have a physical presence in EU member states, those offices fall under Directive 2019/1937 regardless of UK law.

The practical takeaway: UK law is less prescriptive than EU law, but that does not diminish the importance of creating a culture where employees feel safe reporting wrongdoing. The absence of legal requirement is not permission to ignore the issue.