Whistleblowing Framework for Financial Institutions¶

MAS expects all financial institutions (FIs) in Singapore to establish and maintain effective whistleblowing frameworks that enable employees, representatives, and other stakeholders to report suspected wrongdoing without fear of retaliation. A well-functioning whistleblowing framework is essential for early detection of misconduct, fraud, regulatory breaches, and other concerns that could harm clients, the FI, or the integrity of the financial system.

The regulatory basis includes MAS Guidelines on Individual Accountability and Conduct, the Securities and Futures Act (SFA) provisions on protected disclosures, the Prevention of Corruption Act, and the Companies Act provisions on auditor reporting obligations.

MAS Expectations¶

Regulatory Framework¶

MAS has set clear expectations for whistleblowing frameworks in the financial sector:

Board responsibility: The Board of Directors is ultimately responsible for ensuring an effective whistleblowing framework is in place. The Board should set the tone from the top that reporting of wrongdoing is encouraged and that retaliation will not be tolerated
Policy requirements: FIs must have a written whistleblowing policy that is approved by the Board, communicated to all staff and representatives, and reviewed at least annually
Independent oversight: The whistleblowing function should be overseen by a function independent of line management, such as the compliance function, internal audit, or a dedicated whistleblowing committee
Reporting to Board: Regular reporting to the Board (or Audit Committee) on whistleblowing cases received, investigated, and resolved, including any identified trends or systemic issues

Scope of Reportable Concerns¶

The whistleblowing framework should cover, at minimum, the following types of concerns:

Regulatory breaches: Breaches of the SFA, FAA, or any MAS rules, notices, or guidelines
Fraud and dishonesty: Fraud, theft, embezzlement, forgery, or any form of financial crime
Market misconduct: Insider trading, market manipulation, or other forms of market abuse
Client harm: Mis-selling, misrepresentation, unauthorized transactions, or other conduct that harms clients
Money laundering: Suspected money laundering, terrorist financing, or sanctions violations
Corruption and bribery: Corruption, bribery, or improper payments
Data breaches: Unauthorized access to or disclosure of confidential client or company information
Health and safety: Concerns about workplace health and safety
Retaliation: Reports of retaliation against previous whistleblowers
Other misconduct: Any other conduct that is illegal, unethical, or contrary to the FI's code of conduct

Protected Disclosures¶

Legal Protections¶

Singapore law provides certain protections for individuals who report suspected wrongdoing:

SFA Section 239(1): Provides protection for persons who report suspected securities offences to MAS in good faith. The whistleblower is protected from civil or criminal liability for making the disclosure
Companies Act Section 211(1A): Protects auditors who report suspected breaches to MAS in good faith
Employment Act protections: While Singapore does not have comprehensive whistleblower protection legislation comparable to some other jurisdictions, the Employment Act provides general protections against wrongful dismissal
Contractual protections: FIs should provide contractual protections to whistleblowers through their employment contracts and whistleblowing policies

Conditions for Protection¶

For disclosures to be protected, they typically must meet the following conditions:

Good faith: The disclosure must be made in good faith, meaning the whistleblower genuinely believes the information is true and is not making the disclosure for malicious purposes
Reasonable belief: The whistleblower must have a reasonable belief that the reported conduct constitutes wrongdoing within the scope of the whistleblowing policy
Appropriate channel: The disclosure should be made through an appropriate channel as defined in the whistleblowing policy (although disclosures to MAS or law enforcement are generally protected regardless of the channel used)
Not for personal gain: The disclosure should not be made primarily for personal gain (this does not affect any legitimate financial incentive programs)

Anonymous Reporting Channels¶

Multiple Reporting Channels¶

FIs must provide multiple channels for reporting concerns, including options for anonymous reporting:

Dedicated hotline: A confidential telephone hotline staffed by trained operators, available during extended business hours. Consider outsourcing to an independent third-party provider to enhance confidentiality
Online reporting portal: A secure web-based reporting portal that allows anonymous submissions. The portal should allow for two-way communication even when the reporter is anonymous (e.g., through a secure message system with anonymous identifiers)
Email: A dedicated email address for whistleblowing reports, managed by the compliance function or an independent third party
Written correspondence: A designated postal address for written reports, clearly marked as confidential
In-person reporting: The option to report concerns in person to a designated whistleblowing officer, the compliance function, or internal audit
External reporting: Information about how to report concerns directly to MAS or other relevant authorities (e.g., the Corrupt Practices Investigation Bureau for corruption allegations)

Channel Design Principles¶

Accessibility: Channels should be easily accessible to all employees, representatives, contractors, and third parties
Confidentiality: All channels must protect the confidentiality of the whistleblower's identity to the greatest extent possible
Anonymity: At least one channel must allow truly anonymous reporting, where the FI cannot identify the reporter even if it wanted to
Language: Channels should accommodate reports in the languages commonly spoken by the FI's workforce
24/7 availability: At least one channel (e.g., online portal) should be available 24/7
Independence: Consider using an external, independent third party to operate reporting channels to enhance trust and confidentiality

Investigation Procedures¶

Receipt and Triage¶

Acknowledgment: Where the whistleblower's identity is known, acknowledge receipt of the report within 3 business days. For anonymous reports made through a secure portal, post an acknowledgment in the anonymous communication channel
Initial assessment: Within 5 business days, conduct an initial assessment to determine whether the report falls within the scope of the whistleblowing policy and whether it warrants a formal investigation
Triage criteria: Assess the severity, credibility, and urgency of the report. Prioritize reports involving imminent risk of harm, significant financial impact, or regulatory breaches
Conflict check: Before assigning an investigator, check for any conflicts of interest between the investigator and the persons implicated in the report

Investigation Process¶

Investigation team: Appoint a qualified investigation team that is independent of the area or individuals implicated. For serious matters, consider engaging external investigators (forensic accountants, law firms)
Investigation plan: Develop an investigation plan outlining the scope, methodology, timeline, witnesses to interview, and documents to review
Evidence preservation: Immediately secure all relevant evidence, including electronic records, documents, communication records, and system logs. Issue preservation notices to prevent destruction of evidence
Interviews: Conduct interviews with the whistleblower (if identity is known and they consent), witnesses, and the subject of the report. Interviews should be documented and, where appropriate, corroborated with documentary evidence
Confidentiality: Maintain strict confidentiality throughout the investigation. Information about the investigation should be shared only on a need-to-know basis
Timeline: Target completion within 60 days for standard investigations and 90 days for complex investigations. Provide regular progress updates to the whistleblower (where identity is known) and to the oversight function

Investigation Outcomes¶

Findings report: Prepare a written report documenting the investigation findings, including evidence reviewed, interviews conducted, conclusions reached, and recommended actions
Substantiated reports: Where the report is substantiated, implement appropriate remedial actions, which may include disciplinary action, process improvements, regulatory notifications, or referral to law enforcement
Unsubstantiated reports: Where the report is not substantiated, document the reasons and close the case. The whistleblower should be informed of the outcome (where possible) and assured that the matter was taken seriously
Inconclusive reports: Where the investigation is inconclusive, document the reasons and consider whether additional monitoring or controls are warranted

Non-Retaliation Policy¶

Scope of Protection¶

The FI's non-retaliation policy must clearly state that retaliation against whistleblowers is prohibited and will be treated as a serious disciplinary offence:

Protected actions: The following actions in response to a good-faith whistleblowing report constitute prohibited retaliation:
Termination of employment or appointment
Demotion, denial of promotion, or adverse change in duties
Harassment, bullying, or intimidation
Reduction in compensation, bonus, or benefits
Exclusion from meetings, projects, or professional development opportunities
Negative performance reviews that are not supported by objective evidence
Transfer to a less desirable role or location
Any other action that disadvantages the whistleblower in their employment or appointment
Duration of protection: Protection extends from the time the report is made and continues for a reasonable period after the conclusion of the investigation (typically at least 12 months)
Scope of persons protected: Protection applies to the whistleblower, and also to any person who assists in the investigation or provides information in support of the report

Enforcement¶

Monitoring: The compliance function should proactively monitor for signs of retaliation against known whistleblowers, including changes in their employment terms, performance ratings, or work environment
Reporting retaliation: Whistleblowers who believe they are experiencing retaliation should report it through the same whistleblowing channels. Retaliation reports should be treated with the same urgency as the original report
Consequences: Individuals found to have retaliated against a whistleblower should face disciplinary action up to and including termination
Remediation: Where retaliation is found to have occurred, the FI must take steps to restore the whistleblower to the position they would have been in absent the retaliation

Governance and Oversight¶

Whistleblowing Committee¶

FIs should establish a whistleblowing committee (or assign oversight to an existing committee such as the Audit Committee) responsible for:

Policy ownership: Approving and reviewing the whistleblowing policy at least annually
Case oversight: Overseeing the handling of all whistleblowing cases, including investigation progress, outcomes, and remedial actions
Trend analysis: Analyzing whistleblowing data for trends, patterns, and systemic issues
Reporting: Reporting to the Board on the effectiveness of the whistleblowing framework
Independence: Ensuring the independence and adequacy of investigation resources

Metrics and Reporting¶

Track and report the following metrics:

Volume: Number of reports received, by channel, category, and business area
Timeliness: Time from receipt to acknowledgment, investigation completion, and case closure
Outcomes: Number of substantiated, unsubstantiated, and inconclusive cases
Actions: Disciplinary actions, process improvements, and regulatory notifications arising from whistleblowing reports
Retaliation: Number of retaliation reports received and investigation outcomes
Awareness: Results of staff surveys or assessments measuring awareness and trust in the whistleblowing framework

Training and Awareness¶

All staff: Annual training on the whistleblowing policy, reporting channels, protections available, and the FI's commitment to non-retaliation
Managers and supervisors: Additional training on how to handle reports of concern from their teams, the obligation not to discourage reporting, and their responsibility to escalate concerns
Investigation staff: Specialized training in investigation techniques, evidence handling, interview skills, and maintaining confidentiality
Board and senior management: Awareness of their oversight responsibilities and the importance of setting an appropriate tone from the top

Record Retention¶

Case files: All whistleblowing case files, including the original report, investigation workpapers, interview notes, evidence, findings report, and records of actions taken, must be retained for a minimum of 7 years from case closure
Register: A central whistleblowing register must be maintained containing summary information for all reports received, their status, and outcomes
Confidentiality: Records must be stored securely with access restricted to authorized personnel. Where the whistleblower's identity is known, additional safeguards must be in place to protect that information
MAS access: Records must be available for MAS inspection upon request