What is a vigil mechanism?

A vigil mechanism is the system a company sets up so that directors and employees can raise genuine concerns about wrongdoing without fear of retaliation. In India it is a statutory term: the Companies Act 2013 and SEBI's listing regulations both use it, often alongside "whistle-blower policy". In practice it combines a written policy, one or more reporting channels, an investigation process and a set of protections for the person reporting.

What does the law require?

Section 177(9) of the Companies Act 2013 requires every listed company, and other prescribed classes of company, to establish a vigil mechanism for directors and employees to report genuine concerns. Section 177(10) adds three requirements:

• adequate safeguards against victimisation of people who use the mechanism;
• direct access to the chairperson of the Audit Committee in appropriate or exceptional cases;
• disclosure of the mechanism's details on the company's website (if any) and in the Board's report.

Rule 7 of the Companies (Meetings of Board and its Powers) Rules 2014 extends the obligation to companies that accept deposits from the public and companies that have borrowed more than INR 50 crore from banks and public financial institutions. Where a company has no Audit Committee, the Board nominates a director to oversee the mechanism. Rule 7 also allows action, including reprimand, against people who repeatedly make frivolous complaints.

What do SEBI's regulations add?

For listed entities, SEBI LODR Regulation 22 requires a vigil mechanism or whistle-blower policy for directors and employees, with protection against victimisation of directors, employees "or any other person" who uses it, and direct access to the Audit Committee chair. Regulation 46(2)(e) requires the policy to be published on the website. Under Regulation 18(3) and Schedule II Part C, the Audit Committee must review the functioning of the whistle-blower mechanism and review findings of internal investigations into suspected fraud.

The SEBI Prohibition of Insider Trading Regulations add a specific layer. Regulation 9A(6) requires listed companies to have a whistle-blower policy that allows employees to report leaks of unpublished price sensitive information (UPSI), and to make employees aware of it. Independent directors also have a duty under Schedule IV of the Companies Act to ensure the mechanism is adequate and functional.

In February 2026 the Delhi High Court, in Manoj Kumar Grover v. Union of India, declined to extend the mandate to more companies itself, but directed the Ministry of Corporate Affairs to consult stakeholders and decide whether it should be widened.

How does a vigil mechanism work in practice?

A well-run mechanism usually has these elements:

1. Channels: a dedicated email address, web form, hotline or ombudsperson, often run by an independent third party.
2. Intake and triage: each report is logged, acknowledged and assessed for credibility, seriousness and conflicts of interest.
3. Investigation: credible allegations are investigated by an internal team or an independent investigator, with evidence preserved properly. Our guide on how to investigate a whistleblower complaint sets out the steps.
4. Protection: the identity of the whistleblower is kept confidential and any retaliation is treated as misconduct.
5. Reporting: outcomes, trends and open cases go to the Audit Committee, which can then test whether the wider internal controls failed.

Auditors look at the mechanism too. CARO 2020 asks the statutory auditor whether it considered whistle-blower complaints received during the year, which links the vigil mechanism to auditor fraud reporting under s. 143(12).

What are the signs of a weak vigil mechanism?

• No reports for years in a large organisation, which usually signals distrust rather than an absence of problems.
• Complaints routed to the managers they concern.
• Investigations closed without documented findings or root-cause analysis.
• The Audit Committee receives only headline numbers, never case detail.
• Reporters suffer transfers, poor appraisals or exclusion after raising concerns.

How is it different from related terms?

A vigil mechanism is the organisational framework; a whistleblower is the person who uses it. It also differs from a general grievance process, which handles personal employment complaints, and from the Internal Committee under the POSH Act, which deals specifically with sexual harassment complaints. Boards reviewing their framework may find our article on vigil mechanism requirements under the Companies Act and SEBI LODR useful, and independent investigation support is available through our fraud and whistleblower investigation practice.