Whistleblower Complaints & PIDPI

Confidentiality is a central feature of protected-disclosure mechanisms. Its purpose is to allow a person to report suspected wrongdoing without unnecessarily exposing their identity to the individuals or institution concerned.

However, confidentiality does not mean anonymity, and it should not be understood as an absolute guarantee that the complainant can never be identified.

10.1 How Is the Complainant’s Identity Protected?

Under CVC–PIDPI

The Central Vigilance Commission is required to protect the identity of a complainant making a disclosure under the PIDPI mechanism.

The complainant provides their name and address to the Commission for verification. When the allegations are referred to an appropriate authority for examination, identifying particulars are removed from the material forwarded.

This is why the complaint should be drafted so that its main text does not itself reveal who submitted it.

Under RBI Protected Disclosures

The RBI’s protected-disclosure framework also provides for keeping the complainant’s identity confidential.

Under the RBI’s 2007 Protected Disclosures Scheme for private-sector and foreign banks, the RBI acts as the nodal agency and is required to observe secrecy of the complainant’s identity in accordance with the scheme.

For Small Finance Banks and Payments Banks, the corresponding framework is addressed through the RBI’s applicable category-specific supervisory directions, including the 2026 directions discussed earlier in this guide. The precise confidentiality requirements should be read alongside the relevant directions and the bank’s internal whistleblower policy.

Important exception: Under paragraphs 2.5 and 2.6 of the RBI’s 2007 Protected Disclosures Scheme, confidentiality of the complainant’s identity is not absolute. Where a complaint is found to be vexatious or frivolous and action against the complainant is warranted, the scheme permits an exception to identity secrecy. The concerned bank may take action after being advised by RBI, but must first give the complainant an opportunity of hearing.

10.2 Can the Bank Identify the Complainant During an Investigation?

Even when a complainant’s name and contact details are withheld, the circumstances described in a complaint may reveal their likely identity.

For example, a complaint may refer to:

• A meeting attended by only three officers.
• A confidential instruction received by one particular employee.
• An internal document accessible to a very small group.
• An incident in which the complainant was personally involved.

In such situations, the bank may be able to infer the source of the information without being formally told the complainant’s name.

The distinction is important: a mechanism may protect against disclosure of identity by the receiving authority, but it cannot necessarily prevent others from drawing conclusions from the facts.

For related precautions when preparing supporting material, see Section 13 — Evidence & Documentation .

10.3 Practical Precautions to Preserve Confidentiality

A bank employee preparing a protected disclosure should:

1. Use the prescribed reporting channel. Follow the applicable CVC, RBI or internal bank procedure rather than sending the complaint through unrelated offices or general complaint portals.
2. Keep identifying details separate where prescribed. For CVC–PIDPI complaints, provide the required personal particulars without unnecessarily repeating them throughout the allegations.
3. Avoid unnecessary personal references. Describe transactions, dates, decisions and records rather than how the information came to your personal knowledge, unless that detail is essential.
4. Be careful with supporting documents. Names, annotations, email trails and other details may indirectly identify the person supplying them.
5. Limit circulation. Do not routinely copy the complaint to multiple authorities, colleagues or other recipients. In particular, CVC–PIDPI complaints should follow the Commission’s prescribed confidential submission procedure.

These precautions should not come at the expense of accuracy. A complaint must still contain enough specific, verifiable information for the allegations to be examined.

10.4 Does Confidentiality Guarantee Protection Against Retaliation?

No. Confidentiality and protection against victimisation are related but distinct safeguards.

Confidentiality seeks to prevent unnecessary disclosure of the complainant’s identity. Protection against victimisation concerns what happens if a person faces threats, harassment, discriminatory treatment or other adverse consequences because of a protected disclosure.

A complainant should therefore understand both the confidentiality provisions and the available remedies if victimisation occurs.

The next section explains the safeguards available against victimisation and the steps an employee may take if retaliation is suspected.

Reporting suspected wrongdoing can be difficult when the complainant fears adverse consequences at work. A bank employee may be concerned about transfers, harassment, disciplinary proceedings, career prospects or pressure to withdraw a complaint.

Protected-disclosure mechanisms therefore provide safeguards against victimisation. However, these safeguards do not automatically prevent legitimate transfers, performance assessments, disciplinary proceedings or other administrative decisions.

11.1 What Constitutes Victimisation?

Victimisation occurs when a person is subjected to adverse treatment because they made a protected disclosure or assisted in examining one.

Depending on the circumstances, examples may include:

• Punitive transfers or postings intended to penalise an employee for reporting wrongdoing.
• Harassment or intimidation, including threats or pressure to withdraw a complaint.
• Unjustified adverse performance assessments or deliberate obstruction of career progression.
• Retaliatory disciplinary proceedings initiated because an employee reported suspected wrongdoing.
• Workplace isolation or discriminatory treatment intended to discourage the employee or others from raising concerns.

The important consideration is whether the adverse action is connected to the protected disclosure.

A transfer, adverse appraisal or disciplinary proceeding does not become victimisation merely because it occurs after a complaint. The surrounding facts and reasons for the action must be examined.

11.2 Protection Under CVC–PIDPI

Under Clause 6 of the PIDPI Resolution, 2004, a complainant who believes they are being victimised because of a protected disclosure may apply to the designated authority seeking redressal.

The designated authority may consider the application and issue suitable directions to the concerned public servant or public authority. The PIDPI framework also provides for appropriate protective measures where a complainant or witness is considered to be at risk.

CVC procedures have specifically addressed harassment, punitive or frequent transfers and threats to a whistleblower’s personal safety. Where necessary, protection against threats may involve the appropriate government and law-enforcement authorities.

Filing a PIDPI complaint does not automatically stay a transfer order, disciplinary proceeding or other administrative action. An employee alleging victimisation should separately explain the circumstances to the appropriate authority and seek specific relief.

The handling of PIDPI complaints and related representations is discussed further in Section 14 — Complaint Processing .

11.3 Protection Under RBI Protected Disclosures

The RBI’s 2007 Protected Disclosures Scheme for private-sector and foreign banks expressly addresses victimisation.

Under paragraphs 3.9 and 3.10 of that scheme:

• A person who believes they have been victimised because of a protected disclosure may apply to the RBI seeking redressal.
• The RBI may issue suitable directions to the concerned bank to prevent adverse personnel action against an employee complainant.
• Where the RBI considers that a complainant or witness requires protection, it may issue appropriate directions to the concerned bank.

For Small Finance Banks and Payments Banks, the applicable protected-disclosure arrangements are addressed through the relevant category-specific RBI supervisory directions and the bank’s approved policy. The paragraph numbers cited above refer specifically to the 2007 scheme.

Submitting a protected disclosure does not automatically suspend a transfer, charge sheet or other employment-related action. An employee alleging victimisation should make a specific request for redressal through the applicable procedure.

11.4 What Should an Employee Do if Victimisation Is Suspected?

An employee who believes they are facing retaliation should take a careful, evidence-based approach.

1. Record the sequence of events. Maintain a chronology of the protected disclosure and subsequent developments, including relevant dates, orders, communications and incidents.
2. Preserve relevant records lawfully. Retain documents and communications that the employee is entitled to access or keep. Do not obtain confidential customer records or restricted bank information through unauthorised means.
3. Explain why the action appears retaliatory. Relevant circumstances may include an adverse action shortly after management became aware of the disclosure, a sudden unexplained deterioration in performance ratings, or treatment inconsistent with comparable employees. For example, an unexpected adverse APAR assessment following several years of consistently strong ratings may warrant examination. Such circumstances are indicators, not conclusive proof.
4. Seek protection through the appropriate channel. Where the original disclosure was made under CVC–PIDPI or the RBI’s protected-disclosure framework, submit a specific application describing the alleged victimisation and the relief sought. Refer to the original disclosure and any available acknowledgement or reference details. For an internal disclosure, follow the bank’s approved whistleblower policy.
5. Consider other available remedies. Depending on the circumstances, applicable service-rule, grievance or legal remedies may also be relevant.

Where there is an immediate threat to personal safety, the employee should seek assistance from the appropriate law-enforcement or emergency authorities without waiting for the whistleblower complaint to be processed.

11.5 Important Limitations of Protection

Employees should understand the following distinctions:

• Protection is not immunity. A protected disclosure does not excuse unrelated misconduct or prevent legitimate action under applicable service rules.
• Good faith matters. Knowingly false, motivated or vexatious complaints may attract consequences under the applicable framework.
• An unsubstantiated complaint is not necessarily a false complaint. Allegations made on reasonable grounds may remain unproved after examination.
• The reporting channel matters. Safeguards under a particular scheme depend on its eligibility requirements and prescribed procedures.
• Protection may require a separate request. If victimisation occurs, the complainant may need to bring the adverse action specifically to the attention of the appropriate authority.

A bank employee may hesitate to disclose their identity while reporting suspected corruption, fraud or misconduct. However, submitting a complaint without a name is not the same as making a protected disclosure through a confidential reporting mechanism.

Under the CVC–PIDPI mechanism and the applicable RBI protected-disclosure frameworks, anonymous and pseudonymous complaints are not entertained.

Understanding the distinction is important because an otherwise serious complaint may not be examined if it does not satisfy the applicable identification and verification requirements.

12.1 Anonymous, Pseudonymous and Confidential Complaints

These three terms have different meanings.

Anonymous complaint

A complaint that does not disclose the complainant’s name and address.

For example, an unsigned letter alleging irregularities in a branch, without identifying the person submitting it.

Pseudonymous complaint

A complaint in which the complainant’s identity is incomplete, doubtful or cannot be verified. It may also include a complaint that the person named subsequently denies having submitted.

For example, a letter bearing an employee’s name that the employee does not acknowledge when verification is sought.

Confidential protected disclosure

A complaint in which the complainant provides the identity details required by the applicable scheme, but the receiving authority is expected to protect those details in accordance with its confidentiality provisions.

For example, an employee submitting a properly identified PIDPI complaint to the CVC through the prescribed confidential procedure.

The essential distinction: confidentiality protects an identified complainant’s information; anonymity means the complainant has not identified themselves.

12.2 What Is the Position Under CVC–PIDPI?

The CVC–PIDPI mechanism does not entertain anonymous or pseudonymous complaints.

A complainant must provide their name and address and follow the prescribed confidential submission procedure. The complaint should contain specific, verifiable allegations while avoiding unnecessary identifying details in its main text.

The Commission’s procedures provide for protecting the complainant’s identity rather than permitting the complainant to remain unidentified.

A bank employee who wishes to preserve confidentiality should therefore use the prescribed PIDPI mechanism instead of sending an anonymous letter.

12.3 What Is the Position Under RBI Protected Disclosures?

Paragraph 2.4 of the RBI’s 2007 Protected Disclosures Scheme for private-sector and foreign banks expressly excludes anonymous and pseudonymous complaints.

The corresponding provisions of the RBI’s 2026 supervisory directions also exclude such complaints:

• Small Finance Banks: Paragraph 53 of the Reserve Bank of India (Small Finance Banks – Miscellaneous) Supervisory Directions, 2026.
• Payments Banks: Paragraph 41 of the Reserve Bank of India (Payments Banks – Miscellaneous) Supervisory Directions, 2026.

Accordingly, complainants must provide the identifying particulars required by the applicable scheme and follow its prescribed procedure. The bank’s approved protected-disclosure policy should also be consulted where relevant.

Employees should not assume that an anonymous complaint will receive protected-disclosure treatment merely because it contains serious allegations or supporting documents.

12.4 Why Do Older CVC Instructions Refer to Investigation of Anonymous Complaints?

The CVC’s approach to anonymous and pseudonymous complaints has changed over time.

1999 and January 2002 — General prohibition

The Commission directed that anonymous and pseudonymous complaints should not be acted upon and should be filed.

October 2002 — Limited relaxation

The CVC permitted departments and organisations to examine verifiable allegations contained in such complaints, provided they first obtained the Commission’s concurrence.

This was a limited procedural exception. It did not mean that every anonymous complaint had to be investigated.

2004 — PIDPI Resolution

The Government of India introduced the Public Interest Disclosure and Protection of Informers Resolution, 2004, establishing a mechanism for confidential disclosures to the designated authority. This mechanism requires identification of the complainant and should not be confused with anonymous complaint handling.

November 2014 — Relaxation withdrawn

Through Circular No. 07/11/2014 dated 25 November 2014, the Commission withdrew the October 2002 relaxation and restored the instruction that anonymous and pseudonymous complaints should be filed without action.

Subsequent clarifications addressed certain proceedings initiated under the earlier rules, including cases commenced between October 2002 and November 2014 with the required CVC concurrence.

The practical position today: the historical relaxation should not be treated as permission to initiate a fresh vigilance investigation on an anonymous or pseudonymous complaint.

12.5 Can Information From an Anonymous Complaint Ever Be Relevant?

A distinction must be maintained between acting upon an anonymous complaint and dealing with irregularities established through an independently authorised examination.

Anonymous complaint

Under current CVC complaint-handling instructions, an anonymous or pseudonymous complaint is not to be registered and investigated as a vigilance complaint merely because its allegations appear specific or serious.

Independent administrative inspection or audit

A bank’s management may order a routine administrative inspection, special audit or other supervisory examination under its established powers and procedures, where there is a proper, independently supportable basis for doing so.

If such an examination establishes irregularities, subsequent action may be initiated on the basis of the documented audit or inspection findings.

However, an anonymous or pseudonymous complaint cannot simply be converted into an audit investigation to circumvent the CVC’s instructions requiring such complaints to be filed without action.

The distinction is between an independently authorised supervisory examination and an investigation initiated on an anonymous complaint.

12.6 What About False or Malicious Complaints?

An anonymous complaint, an unsubstantiated complaint and a deliberately false complaint are not the same thing.

• Anonymous: The complainant’s identity has not been provided.
• Unsubstantiated: The allegations could not be established on the available evidence.
• Knowingly false or malicious: The complainant deliberately makes false allegations or uses the complaint process to harass or improperly target another person.

A complaint made in good faith may remain unsubstantiated after investigation. That outcome alone does not establish that the complainant acted dishonestly.

Conversely, the applicable protected-disclosure framework may provide consequences for motivated, vexatious or frivolous complaints. Under the RBI’s 2007 scheme, paragraphs 2.5 and 2.6 prescribe specific conditions for action against a complainant, including an opportunity of hearing.

The important distinction is between a genuine allegation that could not be proved and a complaint deliberately made to misuse the reporting mechanism.

A whistleblower complaint is more useful when it identifies specific events, transactions, persons or records that the receiving authority can independently verify.

However, bank employees may face a difficult situation: the relevant evidence could be contained in confidential customer files, internal audit reports, transaction records or restricted banking systems.

The objective is to provide sufficient factual information for an authorised examination—not to conduct an unauthorised investigation or collect confidential documents at personal risk.

13.1 What Makes a Complaint Specific and Verifiable?

A useful complaint should explain what happened, where and when it happened, who was involved, and why the circumstances suggest wrongdoing.

Where known, the employee should identify:

• Nature of the irregularity: What conduct, transaction or decision is being questioned?
• Relevant period: When did the suspected wrongdoing occur?
• Branch or department: Which office, business unit or function was involved?
• Persons or roles involved: Who authorised, processed, recommended or approved the relevant action?
• Relevant records: Which files, registers, system records or other documents could help establish the facts?
• Basis of suspicion: What specific circumstances suggest corruption, fraud, misuse of authority or another reportable irregularity?

The employee should distinguish between facts personally observed, information received from others and conclusions drawn from the available circumstances.

A complaint should not present suspicion as an established finding.

13.2 What Types of Evidence May Be Relevant in Banking?

Depending on the allegations, relevant evidence may include:

• Loan and credit records: Sanction terms, appraisal notes, valuation reports, disbursement records, inspection reports or evidence of deviations from approved conditions.
• Transaction records: Dates, amounts, transaction references, unusual entries or patterns requiring examination.
• Approval and authorisation records: Delegated authority, approval trails and maker-checker records.
• Electronic banking records: Core Banking Solution (CBS) audit trails, maker-checker authorisation logs, transaction IDs from systems such as Finacle or BaNCS, and relevant user-login, IP address or access logs, where maintained.
• Audit and compliance findings: Recorded irregularities, outstanding observations, compliance reports or repeated exceptions.
• Official communications: Relevant instructions, correspondence, minutes or recorded decisions.
• Personnel and administrative records: Transfer orders, performance assessments, disciplinary communications or other records relevant to alleged victimisation.

These are examples of records that an authorised investigator may need to examine. Their relevance does not, by itself, authorise an employee to copy, download or disclose them.

For example, an employee who suspects that a loan was disbursed before compliance with a material sanction condition may identify the loan, relevant dates, the particular condition and the relevant CBS transaction references, if already known through legitimate official duties.

The competent authority can then obtain the underlying records and, where necessary, arrange for relevant electronic logs to be preserved and examined through authorised channels.

13.3 How Should Confidential Bank Records Be Handled?

Bank employees must remain mindful of their obligations concerning customer confidentiality, information security and authorised access to bank records.

As a practical precaution:

• Do not access customer accounts, loan files or internal systems beyond the authority available for legitimate official duties.
• Do not download bulk customer data, CBS audit trails, system logs or restricted reports merely to prepare a complaint.
• Do not send confidential bank documents to personal email accounts, personal cloud storage, messaging applications or unauthorised third parties.
• Do not remove original documents from bank custody or alter, delete or conceal records.
• Do not use another employee’s credentials or attempt to obtain information through unauthorised access.

Legal and regulatory implications

Sections 43 and 66 of the Information Technology Act, 2000 are relevant to unauthorised activities involving computer systems and data.

Section 43 covers specified acts performed without permission, including unauthorised access and downloading, copying or extracting data. Section 66 provides for criminal punishment where an act covered by Section 43 is committed dishonestly or fraudulently.

The RBI’s Cyber Security Framework in Banks, issued on 2 June 2016, also emphasises protection of customer information, prevention of unauthorised access and appropriate information-security controls.

Unauthorised extraction or transmission of bank information may therefore result in disciplinary action and, depending on the circumstances and applicable law, civil or criminal consequences.

Making a whistleblower complaint does not provide blanket immunity from information-security, confidentiality or other legal obligations.

Where supporting material is already lawfully available to the complainant, its submission should still comply with the applicable protected-disclosure procedure and legal requirements.

Where a document or electronic log cannot lawfully be copied or retained, the employee should identify the record and explain where the authorised authority can obtain it.

13.4 How Should the Complaint Be Organised?

A clear, chronological complaint is generally more useful than a lengthy narrative containing repeated allegations.

The following structure can help:

1. Brief description of the concern: State the suspected wrongdoing in a few sentences.
2. Chronology: Present the important events in date order.
3. Specific allegations: Explain each material irregularity separately.
4. Supporting facts: Identify relevant transactions, decisions, communications and records.
5. Persons and responsibilities: Describe the involvement of relevant officials, distinguishing known facts from assumptions.
6. Records requiring examination: Identify documents or electronic records that the receiving authority may need to obtain.
7. Request for examination: Ask the competent authority to examine the allegations under the applicable procedure.

Avoid speculation about motives where the available facts do not support it.

For PIDPI-specific drafting and identity-protection precautions, see Filing a PIDPI Complaint.

13.5 Preserving Accuracy and the Integrity of Evidence

Employees should take care not to compromise the reliability of information connected with a complaint.

Maintain an accurate personal chronology. Record relevant dates, events and communications as precisely as possible. Where a date is uncertain, identify it as an estimate rather than a confirmed fact.

Preserve records lawfully. Retain only material that the employee is authorised to possess or keep. Do not modify documents, selectively edit communications or create misleading extracts.

Distinguish original records from recollections. A contemporaneous official record, a later personal note and information received from another person have different evidentiary value.

Identify possible witnesses carefully. Mention individuals who may have relevant knowledge, where necessary, without pressuring them or unnecessarily circulating the allegations.

Keep personal notes factual and limited. A chronology can record what the employee observed, when it occurred and which official records may confirm it. It should not become an unauthorised personal collection of customer information or restricted bank documents.

If victimisation is subsequently suspected, the employee may maintain a separate chronology of relevant administrative actions, including transfers, performance assessments and disciplinary communications.

For the procedure to report suspected retaliation, see Protection Against Victimisation.

13.6 What if the Employee Does Not Have Documentary Proof?

An employee may become aware of suspected wrongdoing without possessing copies of the relevant documents.

For example, the employee may know that a particular sanction condition was not complied with, but the complete loan file may be held by another department.

The absence of personal possession of documents does not necessarily prevent a protected disclosure.

The employee should provide the specific facts genuinely known to them and identify the records that the competent authority could examine.

The PIDPI Resolution, 2004, calls for the fullest possible particulars and supporting documents or other material. The CVC procedure also emphasises specific and verifiable allegations.

Similarly, paragraph 3.6 of the RBI’s 2007 Protected Disclosures Scheme for private-sector and foreign banks requires complaints to be specific and verifiable. This paragraph reference belongs to the 2007 scheme and should not be assumed to apply unchanged to the separate 2026 directions for Small Finance Banks and Payments Banks.

These requirements do not mean that a complainant must independently investigate the entire matter or obtain documents through unauthorised means.

However, vague suspicion, unsupported accusations or allegations that cannot be linked to identifiable events or records may be difficult for the competent authority to examine.

Submitting a whistleblower complaint is the beginning of a process, not a guarantee that a formal investigation will follow.

The receiving authority must first determine whether the complaint falls within the applicable framework, contains sufficient information and warrants further examination.

A complaint may be received, scrutinised, verified or closed without necessarily progressing to a formal investigation.

The procedure differs depending on whether the complaint was submitted under CVC–PIDPI, an RBI protected-disclosure framework or the bank’s internal whistleblower policy.

14.1 What Happens Immediately After Submission?

The first stage ordinarily involves receiving the complaint and examining whether it satisfies the requirements of the applicable mechanism.

The authority may consider:

• Jurisdiction: Does the complaint concern an institution or employee covered by the mechanism?
• Nature of allegations: Does it involve corruption, fraud, misuse of office or another matter covered by the framework?
• Identification: Has the complainant provided the particulars required for a protected disclosure?
• Specificity: Are the allegations sufficiently clear and verifiable?
• Correct reporting channel: Was the complaint submitted through the prescribed procedure?
• Existing proceedings or earlier complaints: Is the matter already being examined, or has it been reported elsewhere in circumstances relevant to the applicable rules?

A complaint that does not satisfy these requirements may be closed, filed or otherwise dealt with under the applicable procedure.

Receipt of a complaint should not be confused with its acceptance for investigation.

14.2 How Are CVC–PIDPI Complaints Processed?

The CVC–PIDPI mechanism involves special procedures intended to preserve the complainant’s identity.

The broad stages include:

Initial confidential scrutiny

The complaint is examined to determine whether it falls within the PIDPI framework and contains specific, verifiable allegations.

Confirmation of the complainant’s identity

The prescribed procedures provide for contacting the complainant, where applicable, to confirm that they actually submitted the disclosure.

The CVC-published verification-letter format asks the complainant to confirm submission within 30 days of receiving the verification letter.

This is not the same as a routine acknowledgement. Failure to provide the required confirmation may prevent further processing of the complaint.

Decision on further examination

Where the complaint is suitable for examination, the designated authority may seek an appropriate report or examination of the allegations through the prescribed confidential procedure.

The complainant’s identity should be protected in accordance with the applicable safeguards.

Consideration of findings

The designated authority considers the information and findings received and determines what further action, if any, is warranted under the applicable framework.

Current procedural framework

The CVC issued Master Circular No. 04/MC/2026 dated 27 July 2026, consolidating and updating its PIDPI complaint-processing instructions.

A separate CVC Public Notice, No. 11/MC/2026 of the same date, addresses the procedure for lodging PIDPI complaints, including complainant confirmation.

The detailed processing requirements, including the consequences of non-confirmation, must be read in accordance with these current instructions.

14.3 How Does the RBI Process Protected Disclosures?

Paragraph 3.8 of the RBI’s 2007 Protected Disclosures Scheme for private-sector and foreign banks describes the steps that the RBI may take after receiving a complaint containing the complainant’s particulars.

These include:

1. Verification of the complainant: Where necessary, the RBI may ascertain whether the identified person actually submitted the complaint.
2. Discreet inquiries: The RBI may make confidential preliminary inquiries to determine whether there is a basis for proceeding further.
3. Seeking the bank’s response: If further examination appears warranted, the RBI may call for comments or a response from the concerned bank’s Chairman or Chief Executive Officer.
4. Independent scrutiny: The RBI may conduct or order further scrutiny, depending on the circumstances.
5. Recommendation of action: If the allegations are substantiated, the RBI may recommend appropriate action to the concerned bank.

Small Finance Banks and Payments Banks

The corresponding RBI supervisory directions issued in 2026 also provide for protected-disclosure processing, including discreet inquiries, obtaining the concerned bank’s response, independent scrutiny and recommendations for appropriate action.

However, the 2026 directions are separate regulatory instruments. Their operative provisions and paragraph numbering should be referred to independently rather than assuming that paragraph 3.8 of the 2007 scheme applies unchanged.

Banks must also comply with the requirements of their applicable Board-approved protected-disclosure policies.

14.4 What Outcomes Are Possible?

A protected disclosure does not necessarily result in a finding of misconduct.

Depending on the allegations, evidence and applicable procedure, possible outcomes include:

• Closure without further examination: The complaint does not meet the applicable requirements or lacks sufficient verifiable particulars.
• Allegations not substantiated: Examination does not establish the reported wrongdoing.
• Further inquiry or investigation: Additional records, explanations or independent examination are considered necessary.
• Administrative or corrective measures: Weaknesses in controls, procedures or supervision are identified and addressed.
• Disciplinary or other appropriate action: Established misconduct may warrant action under applicable service rules or other procedures.
• Referral for criminal investigation or proceedings: Where the facts warrant it, the matter may be referred to the appropriate law-enforcement or other competent authority.

Under paragraph 3.8(e) of the RBI’s 2007 scheme for private-sector and foreign banks, recommendations may include action against concerned officials, recovery of losses, criminal proceedings where warranted and corrective measures to prevent recurrence.

First Stage Advice and Second Stage Advice in public-sector banks

Where allegations lead to a vigilance case involving officials within the CVC’s advisory jurisdiction, the subsequent disciplinary process may involve consultation with the Commission.

• First Stage Advice (FSA): The Commission’s advice at the stage when the preliminary investigation or examination has been considered. Depending on the findings, this may concern closure or the initiation of appropriate disciplinary proceedings, including major or minor penalty proceedings.
• Second Stage Advice (SSA): Where required under the applicable vigilance procedure, the Commission’s advice after consideration of the departmental inquiry findings and before the disciplinary authority makes its final decision.

These are stages of the vigilance and disciplinary process, not mandatory stages through which every PIDPI complaint must pass.

The disciplinary authority remains responsible for taking decisions in accordance with the applicable service regulations and prescribed consultation requirements.

A finding that allegations are substantiated does not, by itself, determine the penalty to be imposed.

14.5 Will the Complainant Receive an Acknowledgement or Status Update?

This is an important distinction between ordinary grievance handling and confidential protected-disclosure mechanisms.

Under CVC–PIDPI

The prescribed CVC public guidance states that an acknowledgement of receipt is not issued in order to protect the complainant’s identity.

However, the authority may contact the complainant for confirmation or additional information under the applicable procedure.

Employees should therefore distinguish between an acknowledgement, a verification communication and a request for further particulars.

Under the RBI’s 2007 scheme

Paragraph 3.7 expressly states that the RBI will not issue an acknowledgement of receipt in order to protect the complainant’s identity. It also advises complainants against unnecessary further correspondence.

At the same time, paragraph 2.7 provides that the final action taken by the RBI on the complaint will be intimated to the complainant.

These provisions are not contradictory: the scheme distinguishes an initial acknowledgement from communication of the final action.

The cited paragraph numbers belong to the 2007 scheme for private-sector and foreign banks. They should not be assumed to apply unchanged to the separate 2026 supervisory directions for Small Finance Banks and Payments Banks.

Under internal bank mechanisms

Acknowledgements, complaint references, status communications and closure information depend on the bank’s approved whistleblower policy.

Employees should not assume that every protected-disclosure mechanism offers online tracking, regular status updates or access to the investigation report.

14.6 How Long Does Processing Take?

The time required to examine a whistleblower complaint can vary considerably.

It may depend on the complexity of the allegations, availability of records, number of persons involved, need for independent examination and whether additional proceedings become necessary.

A preliminary assessment may be relatively straightforward, while an allegation involving multiple transactions, branches or officials may require extensive scrutiny.

Employees should not assume that the absence of a response within a particular number of days means that the complaint has been rejected or that no action has been taken.

Equally, a pending complaint does not automatically suspend transfers, disciplinary proceedings or other administrative decisions.

For the procedure to seek relief against suspected retaliatory administrative action, see Protection Against Victimisation .

14.7 Should the Employee Follow Up?

The appropriate approach depends on the reporting channel.

CVC–PIDPI and RBI protected disclosures

Employees should follow the communication instructions of the applicable scheme. In particular, unnecessary repeated correspondence may be discouraged because it can increase the risk of identifying the complainant.

Where the authority seeks confirmation or clarification, the employee should respond through the prescribed confidential procedure.

Internal bank whistleblower mechanism

Follow-up should be governed by the bank’s approved policy, including any designated contact, complaint reference or escalation procedure.

New evidence or suspected victimisation

If significant new information emerges or the complainant faces alleged retaliation, the employee should consider the applicable procedure for submitting additional information or seeking protection, rather than assuming that an ordinary status enquiry will address the issue.

The employee should avoid disclosing the complaint unnecessarily to colleagues, persons named in the allegations or unauthorised third parties.

Whistleblower complaints often arise from situations that initially appear to be ordinary operational irregularities, procedural deviations or disagreements within a bank.

The important question is whether the available facts suggest deliberate wrongdoing, corruption, fraud, misuse of authority or another matter covered by the applicable whistleblower mechanism.

The following examples are hypothetical. They illustrate the distinction between potentially reportable misconduct, routine banking irregularities and service grievances.

These examples are intended for understanding, not as findings of misconduct or instructions to act in a particular case. Actual situations must be assessed against the facts, applicable bank policies and relevant reporting procedures.

15.1 Loan Sanction Influenced by Improper Considerations

Situation

A credit officer observes that a substantial loan proposal has been approved despite serious adverse findings in the appraisal. The officer also becomes aware of indications that the Branch Manager or a senior official may have received an improper benefit from the borrower.

What makes this potentially reportable?

Approval of a weak loan proposal, by itself, does not necessarily establish corruption. Credit decisions involve commercial judgment, and different officials may legitimately assess risks differently.

However, evidence suggesting an improper benefit, deliberate concealment of material information or abuse of sanctioning authority may indicate reportable wrongdoing.

The distinction lies between a questionable credit decision and a decision allegedly influenced by corruption or deliberate misconduct.

15.2 Manipulation of CBS Transactions or Customer Accounts

Situation

Unusual debit and credit entries are noticed in customer accounts or internal Office Accounts (GL/SL). Certain transactions appear to have been repeatedly reversed, adjusted or temporarily parked in other accounts.

There are also indications that Temporary Overdraft (TOD) facilities or transaction-authorisation controls may have been improperly bypassed to conceal unauthorised withdrawals or irregular adjustments.

What makes this potentially reportable?

A mistaken entry, legitimate reversal, temporary accounting adjustment or properly authorised TOD is not necessarily misconduct.

However, deliberate manipulation of customer or Office Accounts, misuse of parking accounts, unauthorised TODs, concealment of transactions or circumvention of maker-checker controls may indicate fraud or abuse of system access.

Such allegations ordinarily require examination of transaction records, authorisation trails and other relevant system information by authorised personnel.

15.3 Improper Benefits in Vendor Selection or Procurement

Situation

A bank official repeatedly recommends contracts to a particular vendor despite apparently better competing offers. Circumstances emerge suggesting that the official may have an undisclosed financial interest in the selected vendor.

What makes this potentially reportable?

Choosing a higher-priced vendor does not automatically establish wrongdoing. Technical specifications, service quality, delivery capability and other legitimate considerations may justify the decision.

However, undisclosed conflicts of interest, manipulated evaluations, fabricated quotations or improper benefits may indicate corruption or abuse of authority.

The relevant distinction is between a procurement decision supported by legitimate commercial considerations and one allegedly influenced by undisclosed personal interests or deliberate manipulation.

15.4 Deliberate Suppression of KYC or Suspicious Transaction Concerns

Situation

An employee identifies unusual transaction patterns or serious deficiencies in customer due diligence. A superior allegedly instructs the employee to disregard the concerns and avoid recording them, without a legitimate explanation.

What makes this potentially reportable?

An unusual transaction does not automatically establish money laundering or wrongdoing.

However, deliberate suppression of material compliance concerns, falsification of KYC records or intentional circumvention of prescribed controls may indicate serious misconduct.

Confidentiality of suspicious transaction information

Section 12(2) of the Prevention of Money-Laundering Act, 2002, and Rule 8(6) of the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005, establish confidentiality obligations concerning prescribed records and information furnished to FIU-IND.

The RBI’s KYC directions and applicable FIU-IND guidance also address confidentiality and prevention of tipping off.

Improper disclosure of the existence or contents of a Suspicious Transaction Report (STR) to a customer or unauthorised person may breach these obligations and attract consequences under applicable law and regulatory requirements.

Suspicious transaction reporting through the designated Principal Officer or authorised AML channel is distinct from reporting allegations of deliberate misconduct through an applicable vigilance or whistleblower mechanism.

For broader information-security and confidentiality considerations, see Evidence & Documentation.

15.5 Concealment of Audit Findings or Inspection Irregularities

Situation

An internal auditor records significant irregularities in a branch. Before the report is finalised, a senior official allegedly directs that certain findings be deleted or materially altered to prevent further examination.

What makes this potentially reportable?

Audit observations may legitimately be revised after factual verification, receipt of supporting documents or correction of errors.

However, knowingly suppressing established irregularities, falsifying compliance reports or concealing material deficiencies may indicate misconduct.

The important distinction is between a justified revision of an audit observation and deliberate manipulation intended to prevent scrutiny.

15.6 Unauthorised Access to Customer Information

Situation

An employee becomes aware that a colleague may be accessing customer accounts without an official reason and sharing confidential information with an outside person.

What makes this potentially reportable?

Accessing customer information as part of legitimate official duties is a normal banking activity.

However, accessing accounts without authorisation or a legitimate business purpose, or deliberately disclosing confidential customer information to unauthorised persons, may involve serious information-security and disciplinary concerns.

Section 43 of the Information Technology Act, 2000, addresses specified acts involving computer resources without permission, including unauthorised access and copying or extraction of data. Section 66 provides for criminal punishment where acts covered by Section 43 are committed dishonestly or fraudulently.

The applicability of these provisions depends on the nature of the conduct and the circumstances involved.

An allegation of unauthorised access must therefore be distinguished from access legitimately required for banking operations, supervision, audit, compliance or other authorised functions.

15.7 Transfer or Disciplinary Action Following a Whistleblower Complaint

Situation

An employee submits a protected disclosure alleging corruption. Shortly afterwards, the employee receives an unexpected transfer order or faces adverse administrative action.

The employee believes the action was taken because of the complaint.

What makes this potentially reportable?

The timing may raise a concern, but it does not, by itself, establish retaliation.

Transfers, performance assessments and disciplinary proceedings may have legitimate administrative grounds.

The issue becomes one of possible victimisation where specific facts suggest that adverse action was taken because of a protected disclosure.

For the applicable safeguards and procedures, see Protection Against Victimisation.

15.8 Ordinary Service Grievance or Reportable Misconduct?

Situation

An employee considers a transfer, promotion decision or performance assessment unfair but has no specific information suggesting corruption, deliberate abuse of authority or retaliation for a protected disclosure.

Is this a whistleblower matter?

Ordinarily, dissatisfaction with such decisions is a service grievance rather than a protected disclosure.

However, specific and verifiable allegations of corruption, deliberate abuse of authority or whistleblower victimisation may change the nature of the concern.

For the distinction between these mechanisms, see Service Grievances and Choosing the Correct Channel.

15.9 Manipulation of Staff Accountability Proceedings for Improper Benefits

Situation

A bank conducts a staff accountability examination following irregularities identified in a loan account, an NPA, an inspection report or other operational matters.

During the examination, concerns arise that certain findings or recommendations may have been influenced by improper personal considerations, undisclosed conflicts of interest or benefits received from persons whose accountability is under examination.

As a result, material evidence may be disregarded, serious irregularities may be downplayed or recommendations may be influenced to protect particular officials from accountability.

What makes this potentially reportable?

A Staff Accountability Committee may legitimately conclude that an officer is not responsible for an irregularity or that the available evidence does not justify disciplinary action.

Different assessments of an officer’s role or responsibility do not, by themselves, establish corruption.

However, deliberate manipulation of accountability findings in exchange for monetary or other improper benefits may indicate corruption, abuse of authority and an attempt to protect an officer from justified scrutiny.

Staff accountability examinations are governed by the bank’s applicable Staff Accountability Policy, vigilance procedures and relevant regulatory requirements.

Records such as investigation or scrutiny reports, inspection observations, Staff Accountability Committee minutes, recommendations and recorded notes of dissent, where applicable, may be relevant to an authorised examination.

The essential distinction is between a legitimate assessment of accountability and a deliberately manipulated decision influenced by improper personal benefits.

15.10 Improper Influence over Loan Appraisal and Sanction Decisions

Situation

A bank receives loan proposals sourced through external intermediaries or business channels.

Concerns arise that certain officials may be exerting improper influence over the appraisal or sanction process, including pressure to give preferential treatment to particular proposals, overlook material deficiencies or proceed despite adverse observations.

There are also indications of possible undisclosed financial interests, conflicts of interest or improper benefits connected with the promotion or approval of such proposals.

What makes this potentially reportable?

Business development instructions, credit recommendations and legitimate supervisory guidance are normal banking activities.

Banks may engage authorised Direct Selling Agents (DSAs) or other sourcing partners under approved arrangements and applicable regulatory requirements.

The RBI’s Guidelines on Managing Risks and Code of Conduct in Outsourcing of Financial Services by Banks address the responsibilities of banks in relation to outsourced service providers, including DSAs. They also refer to the Indian Banks’ Association’s Code of Conduct for DSAs.

Applicable Fair Practices Code requirements and the bank’s own credit and sourcing policies provide additional safeguards in relevant lending activities.

However, the involvement of unauthorised intermediaries, payment of improper commissions, interference with independent credit appraisal or pressure to disregard material sanction conditions may indicate serious misconduct.

Where such actions are connected with personal financial benefits to bank officials, the circumstances may suggest corruption and abuse of authority.

The sourcing of a loan proposal does not transfer responsibility for credit appraisal, approval or sanction away from the bank’s authorised officials.

The relevant distinction is between legitimate business sourcing or supervisory involvement and the alleged use of official authority to influence loan decisions for improper personal benefit.

This section explains important terms used in the article and identifies the principal regulatory sources and judicial developments relevant to whistleblower complaints in Indian banking.