Section 177 of the Companies Act, 2013 and SEBI's LODR Regulations require listed and specified companies to run a vigil mechanism that protects people who raise concerns. A policy only works if employees trust it and managers know how to respond.
Our whistleblower course explains how to raise a concern and what protection applies. The articles below explain why speak-up programmes usually fail at the manager level and what the law actually requires.
Quick answer
Section 177(9) of the Companies Act, 2013 requires listed companies and certain other companies to run a vigil mechanism for directors and employees, with safeguards against victimisation. SEBI LODR Regulation 22 adds a whistle-blower policy for listed entities, and the SEBI insider trading rules require employees to be made aware of it. All employees and directors should be trained.
The course
What the law requires
Companies Act, 2013: section 177(9) and (10)
Section 177(9) of the Companies Act, 2013 requires every listed company, and other classes of companies prescribed by rules, to establish a vigil mechanism for directors and employees to report genuine concerns. Section 177(10) says the mechanism must provide adequate safeguards against victimisation of people who use it and direct access to the chairperson of the Audit Committee in appropriate or exceptional cases. Details of the mechanism must be disclosed on the company's website, if it has one, and in the Board's report.
Companies (Meetings of Board and its Powers) Rules, 2014: Rule 7
Rule 7(1) extends the vigil mechanism requirement beyond listed companies to companies that accept deposits from the public and companies that have borrowed more than fifty crore rupees from banks and public financial institutions. Companies that must have an audit committee oversee the mechanism through that committee, and a member with a conflict in a particular case must recuse (Rule 7(2)). Other companies must have the board nominate a director to play the audit committee's role (Rule 7(3)).
Rule 7(4) repeats the safeguards against victimisation and the right of direct access to the audit committee chairperson or nominated director in exceptional cases. Rule 7(5) allows the audit committee or nominated director to take suitable action, including a reprimand, against a director or employee who repeatedly makes frivolous complaints.
SEBI LODR Regulations, 2015: Regulation 22 and Regulation 4(2)(d)(iv)
Regulation 22 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (as amended) requires a listed entity to formulate a vigil mechanism or whistle-blower policy for directors and employees to report genuine concerns. The mechanism must protect directors, employees "or any other person" who use it against victimisation, and provide direct access to the audit committee chairperson in appropriate or exceptional cases.
Regulation 4(2)(d)(iv), one of the corporate governance principles, says the listed entity shall devise an effective vigil mechanism or whistle-blower policy enabling stakeholders, including individual employees and their representative bodies, to freely communicate concerns about illegal or unethical practices. Schedule II Part C lists reviewing the functioning of the whistle-blower mechanism as a role of the audit committee. Regulation 22 sits among the governance provisions that Regulation 15(2) does not apply to listed entities with paid-up equity capital up to ten crore rupees and net worth up to twenty-five crore rupees, though the Companies Act requirement still applies to every listed company.
SEBI (Prohibition of Insider Trading) Regulations, 2015: Regulation 9A(6)
Regulation 9A(6) of the SEBI (Prohibition of Insider Trading) Regulations, 2015 requires every listed company to have a whistle-blower policy and to make employees aware of it, so that they can report leaks of unpublished price sensitive information. This is one of the few places in Indian corporate law that expressly requires employee awareness of the policy.
Whistle Blowers Protection Act, 2014
The Whistle Blowers Protection Act, 2014 is a separate law dealing with complaints of corruption or wilful misuse of power by public servants, made to the Central Vigilance Commission or other competent authorities. It does not create the vigil mechanism duty for private companies, which comes from the Companies Act and SEBI regulations above. Its provisions take effect only from a date notified by the Central Government.
Who must be trained and how often
Neither the Companies Act nor SEBI LODR sets a training frequency. The vigil mechanism is for directors and employees, so both groups need to know it exists and how to use it. For listed companies, PIT Regulation 9A(6) expressly requires the company to make employees aware of the whistle-blower policy. LODR Regulation 22(2) also protects "any other person" who uses the mechanism, so many listed companies extend awareness to contractors and vendors.
Common practice, not a legal requirement, is to cover the policy at induction, run annual refresher training for all staff, and give managers additional training on receiving concerns and avoiding retaliation, since that is where most speak-up programmes fail.
| Audience | Legal basis | Common practice |
|---|---|---|
| All employees | Companies Act s.177(9); LODR Reg. 22; PIT Reg. 9A(6) | Induction and annual refresher |
| Directors | Companies Act s.177(9); LODR Reg. 22 | On appointment and annual briefing |
| People managers | Safeguards against victimisation: s.177(10), Rule 7(4), LODR Reg. 22(2) | Annual training on receiving concerns and non-retaliation |
| Audit committee and ethics or investigation team | Rule 7(2); LODR Schedule II Part C | Periodic training on handling, recusal and investigation |
Penalties and consequences
Neither section 177 nor Rule 7 contains its own penalty clause. Consequences come from general provisions:
| Breach | Provision | Consequence |
|---|---|---|
| Listed entity fails to comply with LODR Regulation 22 or Regulation 4(2)(d)(iv) | LODR Reg. 98(1) | Action by the stock exchange, including fines, suspension of trading and freezing of promoter holdings, as specified by SEBI |
| Contravention of SEBI regulations with no separate penalty | SEBI Act s.15HB | Penalty of not less than one lakh rupees, up to one crore rupees |
| Failure to disclose the vigil mechanism in the Board's report or on the website | Companies Act s.177(10) proviso | Non-compliance with the Act; the general penalty provisions of the Companies Act apply |
| Repeated frivolous complaints by a director or employee | Rule 7(5) | Suitable action by the audit committee or nominated director, including reprimand |
Retaliation against a whistle-blower breaches the safeguards the company is legally required to maintain, and is normally a disciplinary offence under the company's own policy.
What good Whistleblower Policy training covers
- What the vigil mechanism is for: genuine concerns about illegal or unethical conduct, fraud, policy breaches and UPSI leaks
- Who can use it: directors, employees and, under LODR, other persons such as vendors
- Every reporting channel, including direct access to the audit committee chairperson in exceptional cases
- How confidentiality and anonymity work in practice, and their limits
- What protection against victimisation means and how to report retaliation
- What happens after a report: acknowledgement, assessment, investigation and closure
- How managers should receive a concern, escalate it and avoid retaliation, including subtle forms
- The difference between a good-faith report that turns out to be wrong and a frivolous or malicious complaint
- Reporting suspected leaks of unpublished price sensitive information under the insider trading rules
- Recusal when an investigator or committee member has a conflict
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| Whistleblower Policy | All Staff | 25 min | English | SCORM eLearning |
Laws & standards covered
- Companies Act 2013 – Section 177 (Vigil Mechanism)
- SEBI LODR Regulations
- SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations
Who it's for
- All employees
- Directors and officers
- Contractors and vendors with access to internal systems
Guides & insights
Frequently asked questions
Does an unlisted company need a whistle-blower policy?
An unlisted company needs a vigil mechanism under Rule 7 if it accepts deposits from the public or has borrowed more than fifty crore rupees from banks and public financial institutions. Other unlisted companies are not required to have one by the Companies Act, though many adopt one as good practice.
Is a vigil mechanism the same as a whistle-blower policy?
The Companies Act uses "vigil mechanism"; SEBI LODR refers to a "vigil mechanism / whistle blower policy". In practice most listed companies adopt one whistle-blower policy that meets both requirements.
Does the Whistle Blowers Protection Act, 2014 protect private sector employees?
No. That Act deals with disclosures about public servants. Private sector protection comes from the vigil mechanism safeguards in section 177(10), Rule 7 and LODR Regulation 22, and from the company's own policy.
Must anonymous complaints be accepted?
The Act and LODR do not say. They require safeguards against victimisation and direct access to the audit committee chairperson in appropriate cases; whether anonymous reports are accepted is a policy choice the company should state clearly.
Who should oversee the mechanism?
In companies required to have an audit committee, the committee oversees it under Rule 7(2), and LODR lists reviewing the whistle-blower mechanism among the audit committee's roles. Other companies covered by Rule 7 nominate a director to play that role.
Where must the mechanism be disclosed?
Under the proviso to section 177(10), on the company's website, if any, and in the Board's report. Listed entities also report on it in their annual report under LODR.
Which Whistleblower Policy Training courses does Compliance at Workplace offer?
Whistleblower Policy (25 min, for All Staff).
Which laws and standards does Whistleblower Policy Training cover?
Companies Act 2013 – Section 177 (Vigil Mechanism); SEBI LODR Regulations; SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations.
Who should take Whistleblower Policy Training?
All employees, Directors and officers, Contractors and vendors with access to internal systems.
Can the Whistleblower Policy Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- Companies Act, 2013 (India Code)
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 (consolidated, SEBI)
- SEBI (Prohibition of Insider Trading) Regulations, 2015 (consolidated, SEBI)
- Securities and Exchange Board of India Act, 1992 (as amended, SEBI)
Last updated by the Compliance at Workplace Editorial Team.