Whistleblowing in Focus: Recent Developments, Emerging Issues, and Considerations for Companies. Part Two: Global Developments

Introduction

In this three-part series, we discuss recent developments relating to whistleblower programs in the United States.  Second, we review whistleblower initiatives in other jurisdictions over the past year.  Third, we consider emerging issues and considerations for companies in relation to whistleblower reports.

Part 2:  Global Developments

Authorities in Brazil and the United Kingdom, considering examples in the United States, are exploring the creation of whistleblower award programs.  In the past year, the European Union and Abu Dhabi have taken action to expand protections for whistleblowers. 

A. Brazil

The Brazilian Congress is currently reviewing Bill 2581/2023,[1] which seeks to establish a whistleblower monetary awards program.[2]  If approved, the bill will entitle whistleblowers to anonymity and protection from retaliation.[3]  The proposed bill also seeks to introduce new

requirements for accurate financial reporting and internal control certifications, and to impose sanctions for misconduct that amounts to securities fraud, accounting fraud, and spoliation of evidence.[4]  The bill was proposed in the wake of financial scandals in Brazil, including recent investigations into accounting fraud at the Brazilian retailer Americanas, and inspired by similar foreign laws, in particular the Sarbanes-Oxley Act and Dodd-Frank Act in the United States.[5]

In October, the Brazilian Comptroller-General Office (Controladoria-Geral da União –  “CGU”), which enforces federal anticorruption regulations, published an updated version of its Guidelines on Compliance Programs.[6]  The guidance explains that effective compliance programs should encourage the use of whistleblowing channels, implement policies and procedures for investigating whistleblower reports, and provide for mechanisms to protect whistleblowers, including confidentiality and anti-retaliation measures.[7]

B. United Kingdom

In his first public speech in February, the Director of the U.K. Serious Fraud Office (“SFO”) expressed his view that the SFO should pay whistleblowers for information as one way to expedite investigations.[8]  Outside of competition law enforcement,[9] U.K. authorities do not offer financial incentives to whistleblowers.  The SFO’s Director cited the United States as a model, pointing out that over 700 whistleblowers from the U.K. have engaged with law enforcement in the U.S. since 2012.[10]  In the same speech, he suggested that the U.K. follow the example of the U.S. in providing immunity from prosecution to individuals involved in criminal conduct who assist in investigations.[11]  The SFO has subsequently integrated whistleblowing into its 2024–2029 strategy plan, which includes exploring incentives for whistleblowers, in conjunction with partners in the U.K. and abroad, and improving the SFO’s use of offenders who assist in investigations.[12]

The Financial Conduct Authority (“FCA”) is conducting a consultation on changes to its enforcement and investigative powers, stating that changes to the FCA’s approach “may encourage witnesses and whistleblowers to come forward.”[13]  However, the FCA’s consultation is focused on what information the FCA should announce about pending investigations rather than proposing any specific reform to whistleblowing policy.

C. European Union

Directive (EU) 2019/1937 (“Directive”), published on November 26, 2019, requires all Member States of the European Union to adopt minimum standards to guarantee whistleblower protections for reporting violations of EU laws in key policy areas,[14] and ensure that:

1. effective channels are available for whistleblowers to make internal and external reports confidentially (i.e., in a secure manner that ensures confidentiality for both the whistleblower and any third parties mentioned in the report);
2. whistleblower reports are properly investigated and acted upon internally and by competent authorities (including by setting specific timeframes for acknowledging receipt of the report and providing feedback to the whistleblower on the outcome of the investigation);
3. whistleblowers are protected from retaliation (including exemptions from liability and the reversal of the burden of proof in favor of the whistleblower); and
4. effective, proportionate and deterrent penalties are provided for in case of, among other things (i) failure to implement reporting channels; (ii) retaliation against whistleblowers; and (iii) breach of confidentiality in respect of the identity of whistleblowers. 

The Directive was due to be implemented by December 17, 2021 (with a second deadline expiring on December 17, 2023 for Member States to require private legal entities with 50 to 249 employees to establish internal reporting channels).  Despite significant delays which led the EU Commission to start infringement proceedings against several Member States, one of which resulted in the European Court of Justice fining Poland for €7 million in April 2024,[15] all Member States have now transposed and implemented the Directive (and, in some cases, also started to enforce it).[16]  However, in its implementation report of July 2024, the EU Commission identified key areas where further improvements are needed (including the scope, the conditions for protection, and the measures to protect against retaliation).  The EU Commission therefore urged Member States to amend their national legislation to fully align with the Directive’s standards, previewing that (i) it will take appropriate measures (including launching infringement proceedings) in case of failure by Member States to fully and correctly implement the Directive; and (ii) it will submit to the EU Parliament and the Council a report on the functioning of the Directive no later than 2026.[17]

D. Abu Dhabi

In July, the Abu Dhabi Global Market (“ADGM”) introduced the Whistleblower Protection Regulations 2024.[18]  The regulations cover information disclosed in good faith that relates to (1) potential violations of local laws or (2) money laundering, fraud, or any other financial crime.[19]  The regulations protect individuals from contractual or civil liability, the enforcement of any remedy, and employment-related action (including retaliation) for making covered reports.[20]  By May 31, 2025, companies and other entities subject to the ADGM’s jurisdiction must institute appropriate and effective systems to facilitate reporting, assess and as appropriate escalate concerns based on reports, and protect the identity of individuals making reports, proportionate to the size and complexity of their business and operations.[21]  The regulations also establish recordkeeping requirements for reports and related investigations.[22]  The regulations authorize sanctions for noncompliance, specifically private or public censure of entities in breach of the regulations, financial penalties, and/or suspension or withdrawal of commercial licenses.[23]

Additionally, the ADGM introduced Amendment No. 1 of 2024[24] to its 2019 Employment Regulations (the “Amendment”), aligning the ADGM’s employment law regime with the Whistleblower Protection Regulations 2024.  Importantly, the Amendment clarifies that the statutory duty of ADGM-based employees not to disclose confidential information of their employers does not apply to protected disclosures covered under the Whistleblower Protection Regulations 2024.[25]  In addition to incorporating the Whistleblower Protection Regulations 2024 into ADGM employment law, the Amendment explicitly prohibits employers and related parties from engaging in different forms of retaliation in response to protected disclosures.  Prohibited retaliation includes:  (1) dismissing employees; (2) requiring retirement; (3) denying various benefits or opportunities to employees; or (4) otherwise discriminating in employment terms or subjecting relevant employees to adverse actions.[26]  ADGM courts may impose compensation orders and specific performance remedies on employers that engage in or threaten retaliation.[27]  Employers that fail to comply with such court orders may also face additional fines and sanctions.[28]

---

[1] Lei No. 2581, Senado Federal, Maio 2023 (Braz.), available at https://www25.senado.leg.br/web/atividade/materias/-/materia/157423.

[2] Cedê Silva, Brazil’s Senate clears Dodd-Frank-inspired whistleblower program, The Brazilian Report Insider (June 5, 2024, 4:53 PM), available at https://brazilian.report/liveblog/politics-insider/2024/06/05/senate-dodd-frank-whistleblower/.

[3] Lei No. 2581, Senado Federal, Maio 2023 (Braz.), available at https://www25.senado.leg.br/web/atividade/materias/-/materia/157423.

[4] Id.

[5] Id.

[6] Controladoria-Geral da União, Programa de Integridade: Diretrizes para Empresas Privadas (Aug. 2024), available at https://www.gov.br/cgu/pt-br/assuntos/noticias/2024/10/cgu-publica-novo-guia-de-diretrizes-para-empresas-privadas/GuiaDiretrizes_v14out1.pdf (translated as Compliance Programs: Guidelines for Private Companies).  The original guidelines had been published in 2015.

[7] Id.

[8] Nick Ephgrave QPM, Director of the Serious Fraud Office (SFO), Speech at Royal United Services Institute (Feb. 13, 2024), available at https://www.sfo.gov.uk/2024/02/13/director-ephgrave-speech-at-rusi-13-february-2024/.

[9] The UK Competition and Markets Authority offers rewards to informants of up to £250,000 for reporting cartel activity.

[10] Ephgrave, supra note 8.

[11] Id.

[12] Serious Fraud Office, SFO Strategy 2024-29 at 10, 15 (2024), available at https://www.sfo.gov.uk/wp-content/uploads/2024/05/SFO-2024-29-Strategy.pdf.

[13] Financial Conduct Authority, Consultation Paper CP24/2 Part 2 (November 2024), available at https://www.fca.org.uk/publication/consultation/cp24-2-part-2.pdf.

[14] The policy areas include rules on public procurement, financial services, products and markets, anti-money laundering and terrorist financing, product safety and compliance, transport safety and protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, breaches of rules on public health, consumer protection, data protection, security of network and information systems, and breaches affecting the financial interests of the Union or relating to the internal market.

[15] See Judgment of the Court (First Chamber), Case C-147/23, Comm’n v. Republic of Poland, ECLI:EU:C:2024:346 (Apr. 25, 2024), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62023CJ0147.

[16] See, e.g.,Decision No. 380 of July 30, 2024, available at https://www.anticorruzione.it/-/news.20.09.24.whistleblowing, in which ANAC (the Italian Anticorruption Authority, in charge of enforcing Italian rules implementing the Directive) issued a fine for alleged retaliation against a whistleblower.

[17] European Commission, REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL (July 3, 2024), available at https://commission.europa.eu/document/download/7cc63350-88c9-4c0b-a46e-04fc11e673e7_en?filename=COM_2024_269_1_EN_ACT_part1_v6.pdf.

[18] ADGM, Whistleblower Protection Regulations (“ADGM Regulation”) at 1 (July 5, 2024), available at https://adgmen.thomsonreuters.com/sites/default/files/net_file_store/ADGM1547_26684_VER01071024.pdf.

[19] ADGM Regulation § 4.

[20] ADGM Regulation § 5.

[21] ADGM Regulation § 6.

[22] ADGM Regulation § 6(7).

[23] ADGM Regulation § 7.

[24] ADGM, Employment Regulations (Amendment No. 1) (2024), available at https://en.adgm.thomsonreuters.com/rulebook/1-amendments-employment-regulations-2019.

[25] Id.

[26] Id.

[27] Id.

[28] Id.