Whistle Blowing Policy for Financial Institutions

Whistle Blowing Policy for Financial
Institutions
August 2019

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 1-7
Table of Contents
I. Introduction .................................................................................................... 2
a. General Framework.................................................................................... 2
b. Objective .................................................................................................... 2
c. Purpose....................................................................................................... 2
d. Scope.......................................................................................................... 3
II. Definitions...................................................................................................... 3
III. Policy Content ............................................................................................... 3
a. General obligations..................................................................................... 3
b. Violation Report Processing Unit................................................................ 4
c. Whistle Blowing Cases................................................................................ 4
d. Obligations of Whistle Blowers................................................................... 5
e. Obligations of Financial Institutions upon Receiving Reports ..................... 6
f. General Obligations for Protecting Whistle Blowers.................................... 7
g. Processing of Reports................................................................................. 7

1. Reporting Channels (Means for Reporting)............................................. 7
2. Objective Processing of Reports............................................................. 7
   3 Approval and Supervision ........................................................................ 7
3. Automated Reporting System................................................................. 7
4. Report Processing Stages........................................................................ 8
   h. Key Performance Indicators ....................................................................... 8

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 2-7
I. Introduction
a. General Framework
The Whistle Blowing Policy for Financial Institutions is an approved reference for determining the financial institution’s policy frameworks to be adhered to as a minimum when receiving and processing violation reports. The general framework of this Policy is summarized by the following main points:
a. General obligations; b. Violation report processing unit;
c. Whistle blowing cases;
d. Obligations of whistle blowers; e. Obligations of financial institutions upon receiving reports; f. General obligations for protecting whistle blowers; g. Processing of reports; and h. Key performance indicators. Such Policy is a key element in protecting the integrity of financial institutions. It requires active support from all financial institution employees and stakeholders who must report any incidents suspected of involving violations. These employees and stakeholders must also cooperate in the investigation of such incidents, and financial institutions should encourage full cooperation by creating a reliable environment and providing maximum protection. b. Objective This Policy aims to provide the minimum controls necessary to receive and process reports so that it is easy for financial institution employees and stakeholders to report violations without being negatively affected.
c. Purpose
The purpose of this Policy is to establish secure channels of communication between whistle blowers and financial institution units responsible for receiving

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 3-7
and processing reports on any violations that have been committed, are being committed or are about to be committed. This is in order to combat fraud, embezzlement and corruption as well as unlawful, unethical or unprofessional conduct in financial institutions. d. Scope This document applies to financial institution employees and stakeholders regarding all actions taken to address a report on a violation committed in a financial institution supervised by SAMA.
II. Definitions
a. SAMA: the Saudi Arabian Monetary Authority. b. Financial Institution: banks, branches of foreign banks, insurers, reinsurers, foreign insurance companies, service providers, finance companies, finance lease registration companies, and credit bureaus operating in the Kingdom of Saudi Arabia and supervised by SAMA.
c. Financial Institution Employees: members of the board of directors and
its committees, executives, permanent and contract employees, consultants, and employees working through a third party. d. Stakeholders: anyone who has interests with the financial institution such as shareholders, creditors, customers, suppliers, and any third party. e. Violation: any act, or concealment of acts, of fraud, corruption, collusion, coercion, unlawful conduct, misconduct, financial mismanagement, accounting irregularities, conflict of interest, wrongful conduct, illegal or unethical practices or other violations of any applicable laws and instructions.
III. Policy Content
a. General obligations
A financial institution shall observe the following:

1. It shall prepare a policy on whistle blowing to be approved by its board of
   directors. If the financial institution does not have a board of directors,

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 4-7
this policy shall be approved by a chief executive officer or a general director and reviewed annually.
2. It shall submit a periodic report to its board of directors and audit
committee on the cases received and actions taken.
3. It shall encourage its employees and stakeholders to report any violation
committed inside or outside the financial institution within the scope of their work.
4. It shall raise awareness among, and reassure, its employees and
stakeholders about the confidentiality of the whistle blowers’ identity and the information contained in reports for all stages of the processing of each report.
5. It shall protect whistle blowers against any retaliation.
6. It shall encourage its employees and stakeholders not to hesitate to report
any violation due to being uncertain of the authenticity of the report and whether or not it can be supported with facts. The financial institution shall also stress that all employees and stakeholders are expected to refrain from rumors, irresponsible behavior and false allegations, and that, if a claim is made in good faith but has not been established as valid during investigation, no action will be taken against the whistle blower.
7. It shall provide its employees and stakeholders with information on all
channels for whistle blowing, which should include as a minimum: a direct telephone number, website, postal service, and e-mail address.
8. It shall prepare awareness programs that urge its employees and
stakeholders to report violations and clarify their responsibilities. b. Violation Report Processing Unit Financial institutions shall establish an independent administrative unit to receive and process violation reports and to report to the compliance department.
c. Whistle Blowing Cases
Financial institutions must encourage their employees and stakeholders to report incidents that might lead to correcting errors or actions, detecting violations or promoting values. Such reports may include any of the following cases:

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 5-7

1. Financial and administrative corruption, which is any illegal exploitation of
   financial resources or administrative organization in a financial institution;
2. Breach of the laws, regulations, instructions and policies which must be
   followed as required by the financial institution's scope of work;
3. Violations related to the environment, health and safety in the workspace,
   including any negative behavior that might harm the environment or workplace or threaten the safety of any individual;
4. Indecent conduct contrary to public order, Islamic ethics, customs and
   traditions;
5. Misuse of the financial institution's property or assets;
6. Abuse of power or decision making by employees of the financial
   institution, which may go against the financial institution's interest;
7. Passing of illegal operations of the financial institution, circumvention of
   laws, or concealment of regulatory errors;
8. Conflict of interest in any business arrangement or contract carried out by
   the financial institution;
9. Misuse of the powers granted by the financial institution to its employees,
   such as exchanging passwords, etc.;
   10.Obtaining undeserved benefits or rewards; 11.Unlawful disclosure of confidential information; 12.Acts of concealment involving bad faith or intentional negligence, destruction of official documents, or concealment of fraudulent financial reports; 13.Serious negligence which may result in damage to the financial institution; and 14.Concealment of any of the acts mentioned above. d. Obligations of Whistle Blowers A whistle blower shall:

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 6-7

1. ensure credibility in reporting by avoiding rumors and allegations that are
   not based on facts, and report whenever real and reasonable information indicating a suspicion of violations is found;
2. avoid malicious reports aimed at defaming others, taking reprisal or
   retaliation against them, or undermining confidence in the financial institution, its employees or stakeholders;
3. exercise due diligence by ensuring accuracy in reporting, providing all
   necessary details relating to the case reported, and attaching all documents containing details and evidence as required by the nature of the violation;
4. report violations as soon as possible;
5. maintain full confidentiality of the report for the good of the financial
   institution; and
6. bear the responsibility for malicious allegations that defame or damage
   the financial institution or any of its employees or stakeholders. e. Obligations of Financial Institutions upon Receiving Reports Upon receiving a violation report, a financial institution shall:
7. treat such report with the necessary seriousness, regardless of the nature,
   language, adequacy of information, impact or importance of the report;
8. take all necessary measures to protect the whistle blower;
9. notify the whistle blower of receipt of the report and, if possible, the
   decision made;
10. take corrective actions for the violation if proved;
11. take into account the interest of its employees and stakeholders;
12. refer reports to the department responsible for control and investigation,
    either inside or outside of the financial institution;
13. keep violation reports and relevant documents, including recordings, for
    the durations specified by the laws and instructions; and
14. prepare reports on whistle blowing instances and the procedures
    followed.

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 7-7
f. General Obligations for Protecting Whistle Blowers

1. Financial institutions shall protect whistle blowers providing unmalicious
   reports from any potential retaliatory action taken by their employees.
2. A whistle blower, whose identity was not revealed and could not be
   discovered by the financial institution, may not claim protection as prescribed by Clause (e/ 2) under Part (III).
3. Financial institutions shall not disclose any information about any whistle
   blower except to competent authorities, such as investigation and judicial authorities. g. Processing of Reports
4. Reporting Channels (Means for Reporting)
   Financial institutions shall provide effective channels that ensure confidentiality of information for all of their employees and stakeholders.
5. Objective Processing of Reports
   Financial institutions shall handle the reports received according to internal instructions that ensure objective and progressive processing of reports and formulation of a corrective action plan. Each report will be classified by type of processing, in line with the financial institution’s administrative structure. 3 Approval and Supervision A financial institution shall develop an internal policy for the approval and supervision on the mechanism for processing violation reports. It shall also assign the individuals authorized to handle these reports.
6. Automated Reporting System
   A financial institution shall establish the controls necessary to review and clearly understand the content of reports. It shall develop an automated system through which, at least, the following information can be viewed:

• The channel for receiving reports;
• Total number of reports;
• Total number of reports by subject;
• Number of reports processed and reports in progress; and
• Type of processing.

Whistle Blowing Policy for Financial Institutions Version Number Issuance Date Page Number
1.0 August 2019 8-7
Such automated system should be designed to generate any reports for any of the processing stages requested by SAMA.
5. Report Processing Stages
The financial institution shall establish working procedures for the processing of reports, describing detailed steps of each procedure and specifying the inputs, outputs, models and automated systems used for each procedure as well as the individuals authorized. These working procedures should include at least the following stages:

1. Report reception;
2. Initial assessment;
3. Identification of verification plan;
4. Documentation of rationale supporting the processing decision;
5. Decision taken for processing;
6. Follow-up on decision implementation; and
7. Record keeping.
   h. Key Performance Indicators
   There should be an indicator for each stage of the working procedures aimed to determine the performance level by measuring the extent of meeting all the requirements of each procedure established by the financial institution.