Written by The FCA tells regulated firms that whistleblower identities must be handled with care. The controversy over Ashley Alder’s handling of correspondence from former FCA employees therefore raises a sharper question: can a regulator credibly enforce whistleblowing standards if its own internal handling of confidentiality becomes the issue?
Publication snapshot
- Reports said Ashley Alder forwarded correspondence from a former FCA employee without redacting identity details, after concerns had been raised about hiring practices.
- A later FCA review reportedly found that Alder did not follow the whistleblowing policy “to the letter”, but cleared him of inappropriate conduct.
- The FCA’s public whistleblowing guidance says reports are developed into anonymised intelligence and shared without disclosing the whistleblower’s identity.
- The accountability issue is not only what happened in one case. It is whether the FCA applies to itself the standards it expects from the firms it regulates.
Why whistleblower confidentiality matters
Whistleblowing systems depend on trust. A worker or former worker who raises concerns may be exposing themselves to reputational, professional and financial risk. Even where the law offers protection against detriment or dismissal, practical confidence can collapse if the person believes their identity will be circulated more widely than necessary.
That risk is sharper where the organisation receiving the disclosure is a regulator. The FCA is not simply another employer. It is the body that expects regulated firms to maintain effective governance, internal controls and whistleblowing arrangements. Its own conduct therefore carries symbolic and practical weight.
The issue is not whether an organisation can ever share information internally. Sensitive complaints often require advice, triage, legal input and escalation. The question is whether identity and personal details are controlled on a strict need-to-know basis, with the whistleblower’s expectations handled honestly and consistently.
What is reported to have happened
According to published reporting, a former FCA employee sent correspondence to Ashley Alder, the FCA Chair, raising concerns described as relating to opaque hiring practices. Reports said the correspondence was marked in terms indicating an expectation of privacy.
The complaint that followed was that Alder forwarded correspondence to other FCA officials without redacting the sender’s identity and personal details. That allegation became significant because the FCA’s own whistleblowing materials emphasise confidential handling and anonymised internal reporting.
The disclosure route
A former employee raised concerns with the FCA Chair rather than through a purely routine reporting channel.
The confidentiality concern
The concern was that identifying details were shared internally without prior consent or redaction.
The regulatory significance
The FCA expects others to protect whistleblowers. Its own process therefore becomes part of the public-interest question.
The background is complex. Reports say the complainant was a former employee who had been dismissed, had brought employment tribunal proceedings, and was pursuing an appeal at the time. That context may matter to how the FCA understood the complaint. It does not remove the core question about confidentiality discipline.
What the review found
The later review, led by Richard Lloyd, the FCA’s senior independent director, reportedly concluded that Alder did not follow the whistleblowing policy “to the letter”. It also reportedly concluded that he had acted to ensure the matters were properly addressed and did not act inappropriately.
That outcome is important because it cuts both ways. On one view, it supports the FCA’s position that the handling occurred in unusual and complex circumstances, with information shared internally for advice and progression. On another view, it leaves a difficult governance question: if the policy was not followed, why was the consequence framed as clarification rather than accountability?
Key distinction
Operational need
A board chair may need internal advice on complex correspondence, litigation history, employment issues and regulatory process.
Identity control
That need does not automatically justify sharing identity details more widely than required, particularly where anonymity has been requested.
The public-interest concern is not resolved by saying the case was difficult. Difficult cases are precisely where process discipline matters most.
The policy gap: rules, judgment and trust
Whistleblowing policies often contain two ideas that can pull in different directions. First, they reassure the whistleblower that their identity will be protected. Second, they reserve enough operational flexibility to investigate, obtain advice and comply with legal obligations.
The danger sits in the gap between those ideas. If an organisation tells people that identity will be protected, but then treats senior internal circulation as ordinary administrative handling, the protection can feel hollow. The person raising concerns may not distinguish between a controlled need-to-know escalation and exposure to the institution they distrust.
The core governance question
A whistleblowing policy is only as strong as the decision-making culture behind it. The test is whether senior people pause, minimise disclosure, document necessity, and ask whether the whistleblower should be consulted before identity details are shared.
Law and regulatory expectation
GOV.UK explains that a worker may be protected by law where they report certain types of wrongdoing in the public interest. It also explains that confidentiality or “gagging” clauses are not valid if they try to prevent a worker from making a protected disclosure.
The FCA’s own public whistleblowing guidance tells people they can report concerns in confidence. It says the Whistleblowing Team develops intelligence into an anonymised report and shares intelligence with relevant teams without disclosing the whistleblower’s identity.
Those statements create a legitimate expectation of careful handling. They do not mean anonymity can be guaranteed in every possible circumstance. They do mean that identity disclosure should be controlled, justified and communicated with precision.
Minimise
Only share identifying details where they are necessary for advice, safeguarding, legal compliance or proper investigation.
Record
Document why identity was needed, who received it, and what confidentiality controls applied.
Consult
Where possible, discuss identity disclosure with the whistleblower before it happens.
Protect
Assess retaliation risk and take active steps to avoid avoidable exposure or institutional harm.
The accountability questions the FCA still needs to answer
The controversy has a wider institutional significance because the FCA’s credibility depends on symmetry. It cannot credibly demand high standards from regulated firms if its own whistleblowing arrangements appear uncertain at the top.
Questions for the FCA
- What threshold justifies sharing a whistleblower’s identity internally?
- Who authorises that decision where the disclosure reaches a board member?
- How is the decision recorded and later audited?
- When must the whistleblower be told or consulted before identity details are shared?
Questions for regulated firms
- Would their own senior managers be allowed to handle identity details this informally?
- Are whistleblowing reports separated from grievance, litigation and HR histories?
- Do their policies explain internal escalation in language a whistleblower can understand?
- Are board members trained on confidentiality risk, not just front-line reporting channels?
The lesson is not that every disputed disclosure must be accepted at face value. It is that process credibility matters even when the organisation considers the complainant difficult, persistent, conflicted or wrong.
Closing point
Whistleblowing regimes fail when people conclude that confidentiality is conditional on convenience. The FCA’s position requires more than a revised policy. It requires visible assurance that the most senior people in the organisation understand the discipline that whistleblower protection demands.
The public question is therefore simple: if a regulator expects firms to protect those who raise concerns, it must show that its own systems protect them too.
Source anchors
Raising concerns or managing whistleblowing risk?
Get a free written assessment before confidentiality becomes the dispute
Before raising a protected concern, responding to a whistleblower, or circulating sensitive disclosure material internally, it is worth checking whether the route is clear, proportionate and safe.
Legal Lens can provide a preliminary written assessment of whistleblowing correspondence, confidentiality wording, regulatory-route options, retaliation risk and the practical evidence needed to preserve a clean record.
Independent Legal Lens consultancy. This is not a regulated solicitors’ firm. A preliminary assessment is not a substitute for regulated legal advice where your situation requires a solicitor.