Whistleblower Policy Under SEBI LODR

Every listed company in India has a whistleblower policy on file somewhere. Far fewer have one that would actually survive scrutiny if SEBI, a proxy advisory firm, or an activist investor decided to look closely. The gap almost always sits with the company secretary — not because CS professionals are careless, but because the whistleblower policy tends to get filed away as a one-time listing requirement rather than treated as a living compliance obligation with annual verification duties attached.

This guide sets out exactly what SEBI's LODR Regulations require, where the requirement overlaps with (and differs from) the Companies Act vigil mechanism, and most usefully a practical checklist of what a company secretary should be personally verifying, not just filing.

SEBI LODR whistle blower policy

Under SEBI's Listing Obligations and Disclosure Requirements (LODR) Regulations, 2015, every listed entity must establish a whistleblower policy / vigil mechanism as set out under Regulation 4(2)(d)(iv) and detailed further under Regulation 22. The policy must provide adequate safeguards against victimisation of directors and employees who report genuine concerns, allow direct access to the chairperson of the audit committee in exceptional cases, and be disclosed on the company's website and in the Corporate Governance Report. Company secretaries are responsible for ensuring the policy is current, properly disclosed, operationally functional, and reviewed at least annually.

What Does SEBI LODR Actually Require?

SEBI's whistleblower requirements sit in two places within the LODR Regulations:

Regulation 4(2)(d)(iv) — establishes the principle-level obligation: the listed entity shall devise an effective vigil mechanism / whistleblower policy enabling stakeholders, including individual employees, to freely communicate their concerns about illegal or unethical practices.

Regulation 22 — the operative provision, which requires that:

• The listed entity shall formulate a vigil mechanism for directors and employees to report genuine concerns.

• The mechanism shall provide adequate safeguards against victimisation, including direct access to the chairperson of the audit committee in appropriate or exceptional cases.

• The details of the mechanism shall be disclosed on the website of the listed entity and in the Board's Report.

Note the deliberate overlap in language with Section 177 of the Companies Act — SEBI's requirement was designed to run alongside, not replace, the Companies Act obligation. For most listed companies, one integrated policy satisfies both, provided the drafting explicitly references both statutory bases.

Why Is This Regulation-Level Detail More Than a Formality?

Because SEBI treats corporate governance non-compliance as a disclosure and enforcement matter, not just a paperwork gap. Governance lapses — including inadequate whistleblower mechanisms — feed directly into:

• Corporate Governance Report scoring reviewed by proxy advisory firms (IiAS, SES) ahead of AGMs

• SEBI's periodic compliance reviews of listed entities

• Increased scrutiny during forensic or investigative proceedings, where the adequacy of the whistleblower channel becomes a factual question SEBI or courts may examine directly

• Institutional investor governance assessments, which increasingly treat whistleblower mechanism quality as a proxy for board oversight quality generally.

SEBI LODR Whistleblower Policy vs. Companies Act Vigil Mechanism

Aspect	SEBI LODR (Reg. 22)	Companies Act (Sec. 177)
Applies to	All listed entities	Listed companies + deposit-accepting companies + companies with borrowings > ₹50 crore
Disclosure location	Website + Corporate Governance Report	Website + Board's Report
Oversight body	Audit committee	Audit committee (or nominated director)
Enforcement authority	SEBI	Ministry of Corporate Affairs / NCLT
Compliance verification	Annual secretarial audit, Corporate Governance Report certification	Board's Report disclosure, statutory audit trail

What Company Secretaries Must Personally Verify (Not Just File)

This is where most compliance failures actually originate — not in drafting the policy, but in the ongoing verification duties that fall to the company secretary as compliance officer.

1. Confirm the policy is board-approved, not management-approved.Check board meeting minutes for explicit approval language referencing both Section 177 and Regulation 22, not a generic "noted and approved" entry.

2. Verify the direct-access mechanism to the audit committee chairperson is operational, not just written. Ask: if an employee tried to use this route today, would they know how? Is there a published email address, phone line, or named contact? A policy clause with no operational pathway is a disclosure risk.

3. Confirm annual disclosure consistency across all three locations.The Board's Report, the Corporate Governance Report, and the website disclosure should say the same thing about the mechanism's existence and functioning. Inconsistencies here are a common finding in secretarial audits.

4. Track whether the mechanism was actually used, and how.Even where confidentiality prevents disclosing complaint details, the CS should confirm the audit committee received and reviewed usage data — this is what "oversight" means in substance, not just in the org chart.

5. Verify no retaliation complaints are outstanding or unresolved.An unresolved retaliation allegation connected to a whistleblower complaint is a governance red flag that can surface in secretarial audit qualifications or, worse, in SEBI enquiries.

6. Confirm secretarial audit report language matches actual practice.The secretarial auditor will typically confirm compliance with Regulation 22 based on representations from the CS — this makes accurate internal verification, not just documentation review, essential.

7. Reassess after any listing status change or M&A activity.Newly listed companies, or companies undergoing reverse mergers, often inherit legacy whistleblower policies that don't reference SEBI LODR at all. This needs remediation before the first Corporate Governance Report is filed.

Step-by-Step Compliance Verification Process for Company Secretaries

Step 1: Pull the current whistleblower/vigil mechanism policy and confirm it cites both Section 177 and Regulation 22.

Step 2: Cross-check board minutes for the original approval and any subsequent amendments.

Step 3: Test the direct-access channel to the audit committee chairperson — confirm it is documented with a named or role-based contact point.

Step 4: Reconcile disclosure language across the website, Board's Report, and Corporate Governance Report.

Step 5: Request a summary (not case-level detail) from the audit committee secretary on mechanism usage for the reporting period.

Step 6: Confirm with HR/Legal whether any retaliation-related grievances are open, and their status.

Step 7: Update the secretarial audit working papers with evidence supporting the Regulation 22 compliance representation.

Step 8: Flag any gaps to the audit committee at least one quarter before the annual report is finalized — not during sign-off week.

Common Mistakes Company Secretaries Encounter

• Assuming the vigil mechanism policy filed at IPO time is still adequate years later without revisiting operational functionality.

• Disclosure inconsistency between Board's Report and Corporate Governance Report often because two different teams draft each document without cross-referencing.

• No documented evidence of audit committee oversight, relying instead on an assumption that "the audit committee is aware."

• Confusing the frivolous-complaint provision (a Companies Act, Rule 7 concept) with SEBI's framework, which does not contain an equivalent explicit provision — applying it incorrectly under LODR disclosures can misstate the compliance basis.

• Failing to update the policy after a merger, demerger, or change in audit committee composition, leaving the chairperson reference outdated.

Best Practices for Listed Companies

• Run an annual "whistleblower mechanism health check" separate from the general secretarial audit — a short, structured review focused solely on Regulation 22/Section 177 compliance.

• Give the audit committee a standing agenda item each quarter (or at minimum annually) specifically for whistleblower mechanism metrics, not folded into a general compliance update.

• Benchmark disclosure language against peer companies' Corporate Governance Reports to identify gaps in your own disclosure completeness.

• Keep a version-controlled policy history, documenting every amendment with the board resolution reference — this becomes critical evidence if SEBI or auditors ever question mechanism continuity.

• Train new audit committee chairpersons immediately upon appointment on their direct-access obligations under the mechanism — this is frequently missed during committee reconstitution.

Whistleblower Policy Compliance Checklist for Company Secretaries

•  Policy explicitly cites Section 177 (Companies Act) and Regulation 22 (SEBI LODR)

•  Board approval documented with specific resolution reference

•  Direct-access channel to audit committee chairperson is operational and documented

•  Disclosure consistent across website, Board's Report, and Corporate Governance Report

•  Audit committee receives periodic usage/oversight data

•  No unresolved retaliation complaints linked to whistleblower reports

•  Secretarial audit working papers reflect actual verification, not assumption

•  Policy reviewed and re-approved at least annually

•  Policy updated following any M&A, listing change, or audit committee reconstitution

•  New audit committee chairpersons briefed on direct-access obligations

Is a whistleblower policy mandatory for all listed companies under SEBI LODR?

Yes. Regulation 22, read with Regulation 4(2)(d)(iv), makes it mandatory for every listed entity, regardless of size or sector.

What is the difference between SEBI's whistleblower policy requirement and the Companies Act vigil mechanism?

They're closely aligned but arise from different statutes. Most listed companies address both through a single unified policy. See the comparison table above for specific distinctions.

Where must the whistleblower policy be disclosed?

On the company's website and in both the Board's Report (Companies Act requirement) and the Corporate Governance Report (SEBI LODR requirement).

What happens if SEBI finds a listed company's whistleblower policy non-compliant?

This can result in enforcement action, including monetary penalties and adverse observations that affect governance ratings and investor perception; the specific consequence depends on the nature and severity of the finding.

How often should the whistleblower policy be reviewed?

At minimum annually, and immediately after any material corporate event — M&A, listing change, or audit committee reconstitution.

Who is responsible for verifying whistleblower policy compliance within the company?

Primary operational responsibility typically sits with the company secretary/compliance officer, with oversight from the audit committee and ultimate accountability resting with the Board.

Can the audit committee chairperson delegate the direct-access role?

The policy should specify a clear fallback (e.g., another audit committee member) if the chairperson is unavailable, but the primary direct-access route should remain with the chairperson as the regulation contemplates.

Does the secretarial auditor independently verify whistleblower mechanism functioning?

The secretarial auditor typically relies on management/CS representations and documentary evidence rather than conducting an independent operational test — this is exactly why internal CS-level verification matters so much.

What should a company do if it discovers its whistleblower policy has been non-functional for a period?

Document the gap, remediate immediately, disclose transparently in the next Board's Report/Corporate Governance Report cycle, and consider whether retrospective review of the affected period is warranted.

Are private companies subject to SEBI LODR whistleblower requirements?

No — SEBI LODR applies only to listed entities. Private companies fall under Companies Act vigil mechanism rules only if they meet the deposit-acceptance or borrowing thresholds under Section 177/Rule 7.