What the FCA's Q2 2026 whistleblowing data tells regulated firms about culture risk

The FCA published its whistleblowing data for Q2 2026, covering the reports it received between April and June. The regulator logged 333 new reports in the quarter, containing 886 separate allegations. That's a lot of people deciding that something in their organisation was serious enough to raise with the regulator directly, rather than internally.

‍

I read this data every quarter because it tells us something the FCA doesn't say outright: most of what gets reported isn’t always to do with balance sheets.

‍

Look at the top ten allegation categories the FCA published. Consumer Duty leads at 197 reports, which is expected given how central that framework has become. But sitting immediately behind it are categories that describe how people are led, treated and managed:

• Leadership & senior managers: behaviour, conduct & integrity — 153 reports
• Individual(s): conduct, honesty, integrity & reputation — 73 reports
• Firm(s) – values & integrity — 65 reports
• Non-financial misconduct — 27 reports
• Whistleblowing systems & control — 21 reports

‍

Add those five together and you get 339 allegations, more than the Consumer Duty figure on its own. Whistleblowers are not just flagging technical breaches. They are flagging how leaders behave, whether a firm's stated values match its actual conduct, and whether the systems built to let people raise concerns are working as intended.

‍

‍

Non-financial misconduct sits lowest of the five at 27 reports, but I would not read that as a small number. This is the category that most directly captures bullying, harassment and discriminatory behaviour. The FCA has been explicit for several years that this kind of conduct is a regulatory concern in its own right, not a side issue to file under HR. Twenty-seven whistleblower reports reaching the regulator in a single quarter means a meaningful number of people felt existing internal routes weren't enough.

‍

This data also lands at a significant regulatory change. From September 2026, a new FCA rule extends the Conduct Rules to serious non-financial misconduct at a much wider range of firms, not just banks. Under the FCA's finalised guidance in PS25/23, bullying, harassment, sexual misconduct and violence can now count as a Conduct Rule breach where there is a sufficient connection to someone's work, and can feed into fitness and propriety assessments, certification decisions and regulatory references. For many non-bank SMCR firms, this is the first time non-financial misconduct has been written into their conduct risk framework at all. That makes the quality of the evidence trail behind any NFM allegation, and the process a firm can point to when a report comes in, a live regulatory question rather than a background HR concern.

‍

The whistleblowing systems and control figure is the one I keep coming back to. Twenty-one reports were specifically about how a firm's own whistleblowing arrangements work, or don't. This is a signal that the reporting channel itself is failing the people who try to use it, whether through poor case handling, lack of follow-up, or a lack of trust that raising a concern will lead anywhere.

‍

This data is a reminder that leadership conduct, organisational values and internal reporting infrastructure are generating a comparable volume of regulatory attention. A firm can be fully compliant on the product side and still have a workforce that doesn't trust its internal channels enough to use them before going to the regulator.

‍

If your organisation's whistleblowing route is a form or phoneline nobody trusts, a policy nobody reads, or a process with no visible follow-through, this data suggests you're not alone, and you're not immune to the consequences. The FCA is watching the same categories your own people are quietly worried about.

‍

If you want to talk through what a functioning internal reporting and case management process looks like in practice, get in touch.