The first case brought by the Prudential Regulation Authority and Financial Conduct Authority under the Senior Managers and Certification Regime (SM&CR) has resulted in a finding that Barclays Group CEO Mr James Staley breached Individual Conduct Rule 2 (the requirement to act with due skill, care and diligence) in attempting to unmask a whistleblower. However, Mr Staley's conduct was not found to be breach of the requirement to act with integrity (Individual Conduct Rule 1). Though the PRA and FCA each imposed a financial penalty on Mr Staley the fact that he has remained in his current role has been criticised by some commentators.

Facts

• On 21 June 2016, Barclays received an anonymous letter, purporting to be from a Barclays shareholder, containing various allegations (relating to recruitment practices at Barclays), including allegations against Mr Staley.
• Mr Staley considered that the letter fell outside of the firm's whistleblowing policy as its author did not purport to be an employee and further, that the allegations were false and submitted for malicious reasons (ie to undermine his hiring strategy).
• On 24 June, a second anonymous letter, purporting to be written by a Barclays employee, expressing similar concerns was received. Mr Staley recognised that this letter could fall within the scope of the whistleblowing policy as it purported to come from an employee and did not attempt to identify its author.
• Concerned that the letters were part of a campaign to undermine his hiring policy, on 28 June, Mr Staley instructed Security to try to identify the First Letter's author.
• On 29 June Mr Staley was informed that it might be treating the first letter as a whislteblow, and was advised not to attempt to identify the first letter's author which Mr Staley accepted. 
• On 8 July, Mr Staley was informed that the allegations appeared to be unsubstantiated and that the investigation would shortly be concluded. Mr Staley mistakenly understood this to mean that the first letter was no longer being treated as a whislteblow and that he was therefore free to resume his attempts to unmask the first letter's author. However, he failed to confirm this expressly with Group Compliance and did not inform Group Compliance that he intended to resume his efforts to identify the first letter's author.
• Mr Staley then instructed Group Security to resume its efforts to identify the first letter's author.

Findings by the PRA and FCA

The PRA and FCA determined that Mr Staley failed to comply with Individual Conduct Rule 2 (ICR2) which provides that he must act with due skill, care and diligence. However there was no finding Mr Staley breached his obligation to act with integrity (ICR1). More particularly, the regulators found that Mr Staley:

• Should have maintained an appropriate distance from the investigation into the allegations and the response to the allegations, given his conflict of interest (ie the fact that the allegations in part related to him).
• The regulators also found that Mr Staley should have recognised the possibility that the first letter fell within the scope of Barclays' whistleblowing policy and that the author was entitled to protections under the policy.
• The regulators found that given his lack of expertise in whistleblowing, Mr Staley should have explicitly consulted with those with whistleblowing expertise and responsibility and sought their express confirmation that what he wanted to do (ie identify the whistleblower) was permissible.

The FCA commented: 'Given the crucial role of the CEO, the standard required of Mr Staley under ICR2 is more exacting than for other employees. Where (as happened here) the CEO is faced with circumstances that undermine or risk undermining the impartiality of their judgement, they need to ensure that appropriate standards of governance (including independence of decision-making) are maintained. Further, whistleblowers play a vital role in exposing poor practice and misconduct in the financial services sector. It is critical that individuals who wish to raise concerns feel able to speak up anonymously and without fear of retaliation. Mr Staley's actions fell short of the standard of due skill, care and diligence expected of a CEO in a regulated firm: he risked compromising the value of an important resource by which the financial services industry and regulators can identify poor behaviours. That risk was exacerbated given the high profile of Mr Staley and Barclays within the financial services industry'.

Penalties against Mr Staley and Barclays

• Penalty against Mr Staley: The PRA and FCA each imposed penalties of £458,000 on Mr Staley with a 30% discount for early settlement, bringing the total combined penalty to £642,430. In addition, the regulators noted that Mr Staley is 'censured by the publication of the regulators' Final Notices'. Separately, Barclays announced that it had 'reduced the awarded value of Mr Staley's variable compensation for 2016 by £500,000'. 
• Penalty against Barclays: Barclays has agreed to additional reporting requirements in relation to its whistleblowing systems including a requirement for Barclays' Whistleblowers' Champions — who are approved by the FCA and PRA under the Senior Managers Regime — to attest personally to the soundness of its whistleblowing systems and controls annually among others. The measures, which apply to all cases until the end of 2020, are the first of their kind applied to a regulated firm in relation to whistleblowing the regulators note.

Barclays commented: In a statement welcoming the conclusion of the investigation, Barclays noted that 'There were no findings by the FCA or PRA that Mr Staley acted with a lack of integrity, nor any findings that he lacked the fitness and propriety to continue to perform his current role' and reiterated that Mr Staley continues to have the support of the board, and of shareholders based on the outcomes of the recent AGM. Mr Staley said: I have consistently acknowledged that my personal involvement in this matter was inappropriate, and I have apologised for mistakes which I made.'

Are the sanctions sufficient?

• Commenting on the finding, and acknowledging that Mr Staley (and Barclays) were sanctioned, The FT argues that the scale of the penalty is not in alignment with the importance of protecting whistleblower's anonymity (especially in the absence of incentives for whistleblowers to come forward): 'his [Mr Staley's] intervention served no purpose other than to root out and potentially intimidate a witness. In any system built on the principle of whistleblower protection, that cannot be a minor or technical offence' the FT writes.
• Forbes goes further arguing that the fact that Mr Staley was allowed to remain in his role 'sets an alarming precedent'.
• The WSJ quotes various commentators as suggesting that the penalty is insufficient to act as a deterrent to others. The article adds that the New York State Department of Financial Services is also still investigating the matter.