Regulatory framework · Detecting and reporting fraud
Whistleblower protection and vigil mechanisms
A whistleblower has come forward: what protections and duties now apply?
Spectra Forensics7 laws and regulators
Short answer
In India, whistleblower protection for private companies comes mainly from corporate law, not a standalone statute. Listed companies, and companies that accept public deposits or borrow over ₹50 crore from banks and public financial institutions, must run a vigil mechanism with safeguards against victimisation and direct access to the audit committee chair. SEBI adds protection for employees who report insider trading to it. The Whistle Blowers Protection Act 2014 covers public servants and has not been brought into force. Groups with US, UK or EU links face stronger statutory regimes.
The landscape
Laws and regulators in play
- Companies Act 2013 (s.177(9) and (10)) and Rule 7, Meetings of Board Rules 2014
- Require listed companies, companies accepting public deposits and companies borrowing over ₹50 crore from banks and public financial institutions to establish a vigil mechanism with safeguards against victimisation and direct access to the audit committee chair in appropriate or exceptional cases.
- SEBI LODR Regulations 2015 (Regs 18, 22, 46)
- Require a listed entity to have a vigil mechanism or whistle-blower policy protecting directors, employees or any other person who uses it, have the audit committee review its functioning, and publish its details on the website.
- SEBI PIT Regulations 2015 (Reg 9A(6) and Chapter IIIA)
- Require a whistle-blower policy for reporting leaks of unpublished price-sensitive information, and protect employees who file a voluntary information disclosure with SEBI from retaliation (Reg 7I), with rewards of up to ₹10 crore (Reg 7D).
- Companies (Auditor’s Report) Order 2020, clause 3(xi)(c)
- Asks the statutory auditor whether it considered whistle-blower complaints received during the year.
- Whistle Blowers Protection Act 2014
- Covers disclosures about public servants to a competent authority such as the CVC. It received assent on 9 May 2014 but has not been brought into force.
- US Sarbanes-Oxley s.806 and Dodd-Frank s.922
- Protect employees of US-listed companies from retaliation, and pay awards of 10–30% of sanctions over USD 1 million to people who report securities violations to the SEC.
- EU Directive 2019/1937 and UK Public Interest Disclosure Act 1998
- Require internal channels for EU employers with 50 or more workers, with acknowledgement in 7 days and feedback within 3 months, and protect UK workers who make protected disclosures from detriment and dismissal.
Step by step
Decision framework
- 01
Acknowledge and protect from day one
Confirm receipt, explain what happens next and who will know the whistleblower’s identity. Record the date: some regimes, such as the EU directive, run deadlines from it.
- 02
Triage without investigating
Is it a protected disclosure, a grievance or both? Which law areas does it touch: fraud, bribery, insider trading, harassment? Does it name senior management or audit committee members, which changes who oversees the case?
- 03
Route to the right owner
Concerns about directors or senior management go to the audit committee chair. Leaks of price-sensitive information follow the PIT inquiry procedure. Harassment complaints go to the Internal Committee under the POSH Act.
- 04
Preserve evidence before anyone is alerted
Hold email, devices and records of the people involved. An investigation that starts with interviews often ends with missing evidence.
- 05
Investigate independently and proportionately
Scope the allegations, collect documents and data, interview witnesses, then the subject. Keep the whistleblower’s identity on a need-to-know basis throughout.
- 06
Decide outcomes and watch for retaliation
Act on findings, report to the audit committee, consider whether any regulator or auditor must be told, and monitor the whistleblower’s treatment for at least a year after closure.
Duties and deadlines
Who must do what, and by when
| Who | Must do what | By when |
|---|---|---|
| Listed company and prescribed classes of companies | Establish a vigil mechanism for directors and employees with safeguards against victimisation and direct access to the audit committee chair in appropriate cases.Companies Act s.177(9)–(10); Rule 7 | Continuously; disclosed on the website and in the board’s report |
| Company without an audit committee | Nominate a director to play the audit committee’s role in the vigil mechanism.Meetings of Board Rules 2014, rule 7(3) | On becoming subject to Rule 7 |
| Audit committee of a listed entity | Review the functioning of the whistle-blower mechanism, and internal investigations into suspected fraud.SEBI LODR Reg 18; Schedule II Part C | Periodically, as part of its terms of reference |
| Listed entity | Publish details of the vigil mechanism or whistle-blower policy on its website.SEBI LODR Reg 46(2)(e) | Continuously |
| Listed company | Have a whistle-blower policy for reporting leaks of price-sensitive information, and bar retaliation against employees who report insider trading to SEBI.SEBI PIT Reg 9A(6); Reg 7I | Continuously |
| Statutory auditor | State whether whistle-blower complaints received during the year were considered.CARO 2020 clause 3(xi)(c) | In the annual audit report |
Listed company and prescribed classes of companies
Establish a vigil mechanism for directors and employees with safeguards against victimisation and direct access to the audit committee chair in appropriate cases.
By whenContinuously; disclosed on the website and in the board’s report
Companies Act s.177(9)–(10); Rule 7
Company without an audit committee
Nominate a director to play the audit committee’s role in the vigil mechanism.
By whenOn becoming subject to Rule 7
Meetings of Board Rules 2014, rule 7(3)
Audit committee of a listed entity
Review the functioning of the whistle-blower mechanism, and internal investigations into suspected fraud.
By whenPeriodically, as part of its terms of reference
SEBI LODR Reg 18; Schedule II Part C
Listed entity
Publish details of the vigil mechanism or whistle-blower policy on its website.
By whenContinuously
SEBI LODR Reg 46(2)(e)
Listed company
Have a whistle-blower policy for reporting leaks of price-sensitive information, and bar retaliation against employees who report insider trading to SEBI.
By whenContinuously
SEBI PIT Reg 9A(6); Reg 7I
Statutory auditor
State whether whistle-blower complaints received during the year were considered.
By whenIn the annual audit report
CARO 2020 clause 3(xi)(c)
Analysis
How the regimes interact
Why this question matters
Many frauds come to light because someone inside the organisation speaks up, and the way a company treats the first person who speaks up decides whether the second person bothers. Legally, the risk sits in two places: failing to investigate a credible concern, and treating the person who raised it badly afterwards. Both are visible to auditors, regulators and, increasingly, to courts.
How the regimes interact
Corporate law, not a whistleblower statute. India's statutory whistleblower law covers public servants and is not in force. For companies, protection is assembled from section 177 of the Companies Act, Regulation 22 of the LODR and the PIT Regulations. The common thread is safeguards against victimisation and direct access to the audit committee chair. The design question is how to make those safeguards real: confidential intake, independent routing and monitoring of what happens to the reporter.
Different routes for different subjects. A complaint about a price-sensitive leak must follow the inquiry procedure under PIT Regulation 9A(5), which also requires the company to tell SEBI promptly about leaks, inquiries and results. A sexual harassment complaint belongs with the Internal Committee under the POSH Act. A fraud allegation against senior management belongs with the audit committee. One complaint can raise all three, and each route has its own procedure.
Foreign regimes are stricter and reach Indian groups. An Indian subsidiary of a US-listed company is within the reach of Sarbanes-Oxley's anti-retaliation provision and the SEC's award programme. An EU subsidiary with 50 or more workers must run a channel that acknowledges reports within seven days and gives feedback within three months. Where a group has one global policy, it should meet the strictest standard that applies to any part of it.
Whistleblowing feeds the auditor's work. CARO 2020 asks the auditor whether whistle-blower complaints were considered, and a credible complaint can give the auditor reason to believe fraud is occurring, triggering section 143(12). Keeping the audit committee's case register accurate and current helps with both.
How Spectra Forensics can help
We run independent fraud and whistleblower investigations for audit committees, including cases involving senior management. Speak to us in confidence.
Warning signs
Red flags
- The whistleblower’s manager learns of the complaint before the investigation starts.
- Complaints about senior management are handled by the person complained about or their reports.
- Anonymous complaints are closed because the complainant cannot be contacted.
- A pattern of complaints about the same unit, vendor or person, each closed separately.
- The whistleblower is transferred, appraised poorly or excluded shortly after reporting.
- The audit committee sees only numbers of complaints, never the substance.
Checklist
What good looks like
- Multiple reporting channels, including one that does not route through management.
- A written triage and routing protocol, including for complaints about directors.
- A case register the audit committee reviews, with ageing and outcomes.
- Confidentiality rules for the whistleblower’s identity, and access restricted on the case file.
- A retaliation watch: HR actions affecting the whistleblower reviewed for a year after the case.
- Investigations that end in a written finding and a control change where warranted.
- For groups abroad, a check that the policy meets EU, UK or US requirements where they apply.
Myths and corrections
Common misreadings
Misreading
India has a whistleblower protection law for company employees.
Better reading
The Whistle Blowers Protection Act 2014 deals with disclosures about public servants and has not been brought into force. Private-sector protection comes from the Companies Act, SEBI regulations and company policy.
Misreading
Anonymous complaints do not need to be investigated.
Better reading
Nothing in the law excuses ignoring them. Many credible fraud tips are anonymous; assess them on their content.
Misreading
Once the investigation is closed, the company’s duty ends.
Better reading
The safeguard against victimisation continues. Retaliation after closure is a common source of later claims and regulatory scrutiny.
Misreading
Only listed companies need a vigil mechanism.
Better reading
Companies that accept deposits from the public or have borrowed more than ₹50 crore from banks and public financial institutions must also have one.
For the board pack
Takeaways
- 01Indian protection is built from corporate and securities law; design the mechanism to meet it, then to meet any foreign regime that applies.
- 02Route complaints about senior people straight to the audit committee chair.
- 03Preserve evidence before interviews and keep the whistleblower’s identity on a need-to-know basis.
- 04Watch for retaliation long after the case is closed.
Questions we are asked
Can a whistleblower go straight to SEBI?
Yes, for insider trading. Under Chapter IIIA of the PIT Regulations, an informant can file a voluntary information disclosure with SEBI, may be rewarded with up to 10% of the monetary sanctions recovered, capped at ₹10 crore, and the listed company’s code must protect employees who do so from retaliation.
Should the audit committee chair receive every complaint?
Not every complaint, but direct access must exist in appropriate or exceptional cases, and complaints involving directors or senior management should go to the chair or the audit committee as a matter of course.
How does a whistleblower complaint relate to the auditor’s fraud reporting?
The auditor must consider whistle-blower complaints under CARO 2020 and, if they give reason to believe fraud is being committed by officers or employees, may have to report under section 143(12). See our guide on fraud reporting and auditor obligations.
Sources
- Companies Act 2013, s.177, and Companies (Meetings of Board and its Powers) Rules 2014, rule 7 link
- SEBI (Listing Obligations and Disclosure Requirements) Regulations 2015, consolidated text link
- SEBI (Prohibition of Insider Trading) Regulations 2015, last amended 12 March 2025 link
- Whistle Blowers Protection Act 2014 (Act 17 of 2014) link
- US Code, 18 U.S.C. 1514A and 15 U.S.C. 78u-6 link
- Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law link
This guide is general information on the law as stated above, not legal advice. Facts change outcomes; take advice on your own matter.
Go deeper
Further reading
Whistleblowing3 Aug 2026
How to Investigate a Whistleblower Complaint: A Step-by-Step Guide for Indian Companies
A practical, step-by-step guide to investigating whistleblower complaints in India: triage, independence, evidence, interviews, DPDP and reporting.
Whistleblowing6 Aug 2026
Vigil Mechanism under the Companies Act and SEBI LODR: What Boards and Audit Committees Must Get Right
Who must have a vigil mechanism in India, what s. 177 and SEBI LODR require, and how Boards and Audit Committees can make whistleblowing work in practice.
Governance & controls11 Oct 2026
How to Build a Fraud Risk Management Framework: A Board-Level Guide
A board-level guide to fraud risk management: the COSO/ACFE five principles, roles of the board, audit committee and CFO, and Indian legal hooks.
Confidential consultation
Facing this question on a live matter? Talk to us.
Tell us what has happened. A senior member of our team will help you work out who must do what, and in what order, in strict confidence.