Barclays fined $15 Million for CEO’s Attempt to Identify Whistleblowers

The New York Department of Financial Services (DFS) issued a press release this past December  announcing a $15 million penalty against Barclays Bank PLC for violations of New York state banking laws. The sanctioned conduct involved Barclays CEO, James E. Staley, who attempted to discover the identity of an anonymous whistleblower or whistleblowers.  The saga began in 2016 when an anonymous person or persons sent two letters to a senior member of Barclays’ management.

The first letter identified concerns about the fitness of a Barclays’ executive who was recruited by Staley to head the bank’s Financial Institutions Group. The letter also raised questions about the CEO’s role in hiring the executive, who was a friend and former colleague of Staley’s at JP Morgan Chase & Co.

About one month after receiving the first letter, Barclays received a second letter which claimed it had been sent by a group of concerned Barclays employees in the Financial Institutions Group. The second letter raised similar concerns about the qualifications and fitness of the new executive, some of which involved personal issues.

Investigations to Identify the Letter Writers

According to the DFS investigation, both Barclays’ Group Chief Compliance Officer and its General Counsel advised CEO Staley against any attempt to identify the author(s) of the letters. The bank’s Group Compliance Department advised Staley that it would investigate the letter’s allegations, and that the situation should be treated as a whistleblowing matter. Staley was also told that an investigation would have to be completed before any type of response was undertaken.

Despite these warnings, Staley, on two separate occasions, personally directed the head of Barclays’ Group Security to attempt to identify the author(s) of the letters. On the second occasion, Barclays’ security team was reportedly assisted by a U.S. law enforcement agency; however, the identity of the whistleblower(s) was not discovered.

According to the DFS investigation, Staley’s actions were motivated by his desire to protect the new executive, Staley’s friend and former colleague, from a personal attack that Staley believed was false and malicious. Staley also sought to defend his ability to continue recruiting other high-level executives. DFS noted that Staley was conflicted because the letters criticized his actions, as well as those of Barclays’ management, in recruiting and employing the senior executive.

Violations of Barclays’ Internal Policies and Procedures

Under Barclays’ internal policies in effect at the time, the senior executive who received the first letter should have immediately forwarded it directly to Barclays’ Investigations & Whistleblowing Team and no one else. Instead, the first letter was circulated among the bank’s most senior executives, including Staley.

The DFS investigation found that senior member of Barclays’ management, who counseled Staley in the matter, repeatedly failed to properly document their interactions with Staley in the bank’s internal records. DFS also found that several members of senior management failed to follow or apply the Barclays’ whistleblowing policies and procedures in a manner that protected Staley and the bank itself. DFS further noted that some gaps in Barclays’ whistleblowing policies and procedures were identified during the investigation of the matter.

Barclays’ Past Violations

As a result of several prior enforcement actions brought by other government agencies, Barclays commissioned an independent review of its business practices and culture. A report known as the “Salz Review” was issued in 2013 which found, among other things, a “cultural unwillingness to escalate issues” involving risk and controls. As a result of the Salz review, Barclays implemented a series of measures designed to improve the bank’s compliance culture, including new protections and incentives for anonymous whistleblowers.

In 2015, Barclays consolidated most of its internal whistleblowing functions into a new unit known as the Investigations & Whistleblowing division. The actions were taken in advance of new U.K. whistleblowing regulations that would take effect in 2016.

The 2016 U.K. Whistleblower Regulations

The U.K.’s 2016 whistleblower rules require regulated institutions, such as Barclays, to assign an individual who is responsible for “ensuring and overseeing the integrity, independence and effectiveness of the firm’s policies and procedures on whistleblowing . . . including those policies and procedures intended to protect whistleblowers from being victimized because they have disclosed reportable concerns.”

In order to comply with the requirements of the newly implemented U.K. regulations, Barclays created a new position known as a “whistleblower champion,” a non-executive director who chairs the board’s audit committee. The whistleblower champion must personally attest to the integrity of Barclays’ whistleblowing systems on an annual basis.

Remedial Measures and the Consent Order

On December 18, 2018, Barclays entered into a consent order with DFS.  In addition to a monetary penalty of $15 million, Barclays agreed to implement certain remedial measures, including a written plan to improve oversight of Barclays’ implementation of, and compliance with, best practices for whistleblowing programs. DFS mandated that the plan include (i) protections for all whistleblowers, regardless of the whistleblower was anonymous, (ii) appropriate independence of the bank’s whistleblowing, investigative and security functions involving whistleblowing matters, and (iii) adequate training for all employees (including senior management) and Board members. The consent order required that DFS review and approve the plan before implementation.

“Whistleblowers are vital to uncovering and addressing intentional wrongdoing.”

Maria T. Vullo, Superintendent of the New York Department of Financial Services

DFS credited Barclays for its “substantial cooperation” in connection with the investigation. Among the actions cited by DFS was Barclays’ engagement of an outside consultant to perform an independent review of the bank’s whistleblowing policies, processes and controls.

Based on the recommendations of its outside consultant, Barclays added internal controls to address the deficiencies identified in the consent order, including “(a) procedures to recognize that concerns raised outside certain whistleblowing channels may nevertheless constitute whistleblows, (b) procedures to avoid escalating a whistleblow to the subject of the concern, and (c) preserving whistleblower anonymity.” Barclays also created a “Whistleblowing Oversight Forum” to ensure consistent treatment of all whistleblower claims and inform employees on legal issues related to such claims.

Blowback for Barclays’ CEO

Since Barclays is a U.K.-registered entity, it is also subject to the regulatory and enforcement powers of the U.K.’s financial oversight authorities. The U.K. Financial Conduct Authority and Prudential Regulation Authority together imposed a financial penalty on Staley in the amount of £642,430 ($868,501).

In a statement released by the Financial Conduct Authority last November, the agency said “Mr. Staley breached the standard of care required and expected of a Chief Executive in a way that risked undermining confidence in Barclays’ whistleblowing procedures. . . . Whistleblowers play a vital role in exposing poor practice and misconduct in the financial services sector. It is critical that individuals are able to speak up anonymously and without fear of retaliation if they want to raise concerns.”

The statement also noted that Staley’s misconduct occurred during a period when Barclays’ whistleblowing policy applied only to employees. In September 2016, the two U.K.  regulatory agencies introduced new rules requiring firms to provide whistleblowing protections for “reportable concerns” raised by “any person” in the company. The rules also require that all employees have appropriate training in a company’s whistleblowing processes.

In response to the U.K. sanctions, Staley said, “I have consistently acknowledged that my personal involvement in this matter was inappropriate, and I have apologized for mistakes which I made.” As a result of his actions, Barclays cut Staley’s bonus by £500,000 ($403,135). In 2016, Staley earned £2.35m ($3,190,487) and received a bonus of £1.3m ($1,048,152). According to the BBC, the fine amounted to about one-fifth of his total compensation. The penalty could have been more than £900,000, but U.K. authorities gave Staley a 30% discount for settling during an early stage of the investigation.

U.S. Protections for Whistleblowers

Section 3730(h) of the False Claims Act provides protection for any employee, contractor or agent of a company who lawfully engages in whistleblowing activity designed to stop one or more violations of the False Claims Act. If an employee is subject to discriminatory action as a result of their status as a whistleblower, he or she can bring a cause of action in federal district court for double back pay, interest, and compensation for special damages, such as litigation costs and attorneys’ fees. The federal False Claims Act protects whistleblowers for three years from the date of retaliation. Other state and local false claims act laws may provide additional anti-retaliation protections.