FCAC provides further clarifications on new Financial Consumer Protection Framework

The Financial Consumer Agency of Canada (FCAC) recently released for consultation a draft Guideline on Whistleblowing Policies and Procedures for Banks and Authorized Foreign Banks (the Guideline), which is intended to provide guidance with respect to banks’ implementation of the new Bank Act (the Act) whistleblowing provisions coming into force on June 30, 2022.

What you need to know

• The FCAC expects that banks will develop whistleblowing programs that are effective, accessible, and protective of employees.
• The FCAC expects banks to develop policies and procedures to provide for fair, timely, and impartial investigation of reports of wrongdoing (including the allocation of adequate resources to achieve these results); to provide for regular and ongoing training of employees with respect to whistleblowing; and to protect employees who report wrongdoing by maintaining their confidentiality and by protecting them from reprisals.
• While the Guideline provides some additional clarification with respect to the whistleblowing provisions (and the FCAC’s expectations), key questions remain outstanding, including with respect to the application of the whistleblowing regime to third parties.
• The deadline to provide comments in response to the Guideline is January 29, 2022.

Background

The Budget Implementation Act, 2018, No. 2 introduced amendments to the consumer protection provisions of the Act, including new whistleblowing provisions (see our bulletin on the provisions). The whistleblowing provisions come into force on June 30, 2022.

Among other things, the new whistleblowing provisions will require banks to establish policies, procedures, and processes to enable them to deal with wrongdoing reported by bank employees. Because the whistleblowing provisions fall within the Act’s consumer protection framework, intermediaries, third parties and agents selling or furthering the sale of bank products or services that comply with the Act (collectively, Third Parties) are also required to comply with the whistleblowing provisions. Accordingly, banks must ensure that Third Parties have policies, procedures and processes to deal with wrongdoing reported by an employee in a manner that complies with the Act¹.

The Guideline

The Guideline is intended to set out FCAC’s expectations with respect to banks’ implementation of the whistleblower provisions.

Key principles for whistleblowing policies

While the Guideline confirms that institutions may tailor their whistleblowing policies and procedures (whistleblowing policies) to reflect their unique circumstances, FCAC expects that all whistleblowing policies will reflect the three key principles of effectiveness, accessibility, and protection. More particularly:

• Effectiveness. Effective whistleblowing policies should demonstrate and implement organizational commitment, provide for the investigation of wrongdoing, and include regular and ongoing training. In order to respond to reports of wrongdoing in a fair, timely, and impartial manner, FCAC expects banks to:
  • allocate adequate financial, technical, and human resources;
  • appoint an employee dedicated to working with senior management to develop and implement the bank’s whistleblowing policies; and
  • develop whistleblowing policies which include processes for investigating reports of wrongdoing, and for ensuring effective employee communication and training, including tailored training for employees who deal with reports of wrongdoing or those who are more likely to “witness, detect or contribute to wrongdoing because of the responsibilities of their position”.
• Accessibility. To ensure that employees are aware of their ability to report wrongdoings, FCAC expects banks to develop whistleblowing policies that:
  • are easy for employees to find, navigate and understand;
  • define “wrongdoing” and provide examples²;
  • raise employee awareness of their internal and external reporting options; and
  • ensure employees have access to confidential advice throughout the reporting process.
• Protection. To protect employees who report wrongdoing from potential retribution, FCAC expects whistleblowing policies to:
  • enable employees to anonymously report wrongdoing;
  • safeguard the confidentiality of employee information, including in circumstances in which an employee’s identity may be disclosed to outside agencies; and
  • protect employees from repercussions for filing a report (such as dismissal, suspension, or harassment).  

Interaction with mandatory reporting obligations

In addition to the guidance above regarding the development of whistleblower policies, FCAC indicates in the Guideline that, following a report and investigation of wrongdoing, a bank must assess whether or not there has been a breach of a consumer provision of the Act that must to be reported to the FCAC (see the FCAC’s “Mandatory reporting guide for federally regulated financial institutions”). In such cases, reports to FCAC must specify that the bank became aware of the breach through a whistleblowing report. FCAC indicates in the Guideline that whistleblower policies should be transparent about this requirement.

Open questions

The Guideline is a welcome addition to the growing body of FCAC guidance with respect to the new Consumer Protection Framework of the Act, including the whistleblower provisions. However, while the Guideline provides general guidance with respect to FCAC’s expectations, some important questions remain unanswered, particularly with respect to the application of the whistleblower provisions to third parties. More particularly:

• Competing whistleblowing regimes. As noted above, Third Parties must comply with the new whistleblower provisions. However, it is unclear how the Bank Act whistleblower provisions will work with other competing whistleblower legislation to which such Third Parties may also be subject (for example, whistleblower legislation under securities legislation). For example, if a Third Party receives a whistleblower report which includes, but is not limited to, concerns relating to a bank product, is the Third Party expected to initiate two different investigations: one under its own governing legislation and another under the Act (and if so, what if the two investigations arrive at conflicting conclusions)?
• Sharing of information and cooperation between a bank and Third Parties. The Act and Guideline are not clear on how—and whether—information may be shared between a bank and a Third Party relating to allegations of wrongdoing, and how Third Parties and banks must cooperate in any investigations into wrongdoing. If a Third Party receives a complaint of wrongdoing relating to a bank’s products or services, to what extent can (or must) the Third Party report the complaint to the bank? And who—as between the bank and the Third Party—should be responsible for investigating the complaint? Similarly, if a bank receives a complaint of wrongdoing that implicates a Third-Party employee, to what extent can (or must) the Bank report the complaint to the Third Party? And how must a Third Party cooperate in connection with such an investigation (including by making its employees available for interviews, producing documents, etc.).

To ensure that i) the bank has knowledge of all allegations of wrongdoing relating to its products and services and ii) investigations into wrongdoing are conducted in a consistent manner, further guidance on these issues would be helpful.

To discuss these issues, please contact the author(s).

This publication is a general discussion of certain legal and related developments and should not be relied upon as legal advice. If you require legal advice, we would be pleased to discuss the issues in this publication with you, in the context of your particular circumstances.

For permission to republish this or any other publication, contact Janelle Weed.

© 2024 by Torys LLP.

All rights reserved.