Financial Services Superintendent Maria T. Vullo today announced that the Department of Financial Services (DFS) has fined Barclays Bank PLC and its New York branch $15 million for violations of New York Banking Law stemming from a DFS investigation into attempts by the bank’s CEO to identify the author(s) of two whistleblowing letters in contravention of Barclays’ established whistleblowing policies and procedures.  The DFS investigation found that shortcomings in governance, controls and corporate culture relating to Barclays’ whistleblowing function permitted a sequence of events that potentially could have had a detrimental impact on the efficacy of Barclays’ whistleblowing program.  Several members of senior management failed to follow or apply whistleblowing policies and procedures in a manner that protected the CEO and the bank itself.  Limited gaps in the bank’s whistleblowing policies and procedures became apparent during the investigation, and it appears that the cultural transformation that Barclay’s Group Compliance had been working hard to instill in the more than one hundred thousand Barclays employees worldwide, was not nearly complete.

“Whistleblowers are vital to uncovering and addressing intentional wrongdoing. DFS’s thorough investigation uncovered actions at the top that exposed the bank to risk and created an atmosphere in which employees might doubt that it was safe to escalate issues of concern to the bank,” said Superintendent Vullo. “The Department recognizes and appreciates Mr. Staley’s commendable and constructive steps to accept responsibility for his actions, apologize to employees of the bank, and recommit to DFS that he will oversee an independent and effective whistleblowing function.”

DFS’s investigation found that in June 2016, and again in July 2016, Mr. Staley personally directed the head of Barclays’ Group Security to attempt to identify the author(s) of two whistleblowing letters.  Mr. Staley’s primary motivations in seeking to learn the identity of the author(s) were to protect the New Executive (who was a friend and colleague) from a personal attack that Mr. Staley believed was false and malicious; and to defend his own ability as CEO to continue recruiting high-level hires to the Bank. However, Mr. Staley was conflicted, because the letters criticized Mr. Staley’s own role, and the role of the bank’s management, in recruiting and employing the recently hired senior executive with whom Mr. Staley had worked at another bank.

Barclays’ Cooperation

The Department recognizes and credits the substantial cooperation that Barclays provided with DFS’s investigation of this matter. In May 2017, Barclays engaged an outside consultant to perform an independent review of the bank’s whistleblowing policies, processes and controls.  Following this review, Barclays has now implemented certain additional controls to address the deficiencies that are identified in the Department’s Consent Order, including, but not limited to, (a) procedures to recognize that concerns raised outside certain whistleblowing channels may nevertheless constitute whistleblows, (b) procedures to avoid escalating a whistleblow to the subject of the concern, and (c) preserving whistleblower anonymity.

Additionally, Barclays has created a “Whistleblowing Oversight Forum,” which is intended to advise on legal issues related to whistleblower claims and ensure consistency of approach and implementation of best practices.

Previous DFS Consent Orders

The conduct uncovered was a step backwards for Barclays, which had been implementing important changes following several enforcement actions by government agencies, including a Cease and Desist Order brought jointly in August 2010 by DFS’s predecessor, the former Banking Department, and the Board of Governors of the Federal Reserve. Following that action, Barclays commissioned a broad and independent review of its business practices and culture.  Out of that review, known as the Salz Review, Barclays began to implement constructive changes across its multiple business lines.

In connection with two written consent orders between DFS and Barclays on May 20, 2015 and November 17, 2015 concerning deficiencies in its foreign exchange business, Barclays made specific representations to DFS concerning remediation that it had implemented or would implement concerning its whistleblowing program.

These representations, contained in a December 15, 2015 plan submitted to DFS, six months before the conduct at issue here, included that (a) Barclays “has continued to enhance its reporting, escalation, and investigation framework through . . . the enhancement of Barclays’ firm-wide Global Whistleblowing Framework.”; (b) “Barclays has created and implemented globally two anonymous reporting channels that allow an employee to report a suspected violation via the phone or e-mail to an internal or external service;” and (c) “[t]he Front Office will continue to increase employee awareness of Barclays’ whistleblowing infrastructure, including training on how to raise concerns about the actions of staff members, without the fear of retaliation.”

DFS Investigation

The first anonymous whistleblower letter questioned the new executive’s fitness to work at Barclays and criticized Mr. Staley’s role in soliciting this executive to join Barclays.

Under Barclays’ then-applicable policies, the letter should have been forwarded directly to the bank’s Investigations & Whistleblowing (I&W) Team immediately and not otherwise distributed. Yet despite the nature of the allegations, board members and senior management failed to treat the letter as a whistleblower complaint and the first anonymous letter was circulated over the next few days among the bank’s most senior executives, including Mr. Staley.

On June 24, 2016, a member of Barclays’ U.S. senior management received a second anonymous letter stating that it was from a group of “concerned” Barclays employees in the Financial Institutions Group or “FIG,” which was the Barclays division joined by the new executive.  The second anonymous letter raised nearly identical concerns about the qualifications and fitness of the new executive, including with respect to the executive’s personal issues.

Mr. Staley was advised several times not to try to identify the author or authors of the letters.  Both the Group Chief Compliance Officer (GCCO) and the General Counsel both firmly advised Mr. Staley against trying to identify the author(s).  The GCCO stated that Group Compliance would be looking into the matters raised in the letters, that Barclays needed to treat the letters as a whistleblowing matter, and that the whistleblowing function needed to conduct that evaluation before anyone took any additional steps regarding the letter. 

The DFS investigation also found:

• Senior Barclays management involved with counseling Mr. Staley in this matter failed, more than once, to appropriately document with Mr. Staley and for internal records the counsel provided to Mr. Staley in this matter.
• Several members of senior management failed to follow or apply the whistleblowing policies and procedures in a manner that protected Mr. Staley and the bank itself.  Additionally, limited gaps in whistleblowing policies and procedures became apparent during this episode.

The DFS investigation found the following violations of New York Banking Law:

• Barclays conducted its banking business in an unsafe and unsound manner by failing to devise and implement effective governance and controls with respect to its whistleblowing program;
• Barclays failed to submit a report to the Superintendent immediately upon discovering misconduct, whether or not a criminal offense, in that Barclays failed to report on the use of federal law enforcement resources secured through incomplete or inaccurate information provided to a federal agency, in order to investigate a non-threatening and non-exigent whistleblower complaint.

Remediation and Reporting

In the consent order entered into today, Barclays shall submit to DFS the following information:

• An enhanced written plan for internal controls and a compliance program,  acceptable to the Department, to ensure implementation of and compliance with best practices for whistleblowing programs, including, but not limited to, (i) protections for all whistleblowers, whether or not anonymous, (ii) appropriate independence of the Bank’s whistleblowing, investigative and security functions, (iii) adequate training for all employees (including senior management) and board members; and
• A written plan, acceptable to the Department, to improve the Board’s and senior management’s oversight of Barclays’ implementation of and compliance with best practices for whistleblowing programs, including, but not limited to, (i) protections for all whistleblowers, whether or not anonymous, (ii) appropriate independence of the Bank’s whistleblowing, investigative and security functions in connection with whistleblowing matters, and (iii) adequate training for all employees (including senior management) and Board members.

In the consent order entered into today, Barclays also shall submit to the Department a report by March 31, 2019 that provides an update on the following information:

• All instances since January 1, 2017 where Barclays received a whistleblowing complaint or concern that included allegations against one or more members of the Group Executive Committee or Board of Directors of Barclays Bank PLC, and, for each instance so identified, details about the complaint, handling and investigation of the complaint, oversight of the investigation, and any conclusions reached;
• All instances since January 1, 2017 where a Barclays current or former employee or agent attempted to learn the identity of an anonymous whistleblower, and, for each instance identified, details about the decision to undertake the effort, the steps taken, and the outcome;
• All instances since January 1, 2017 where a Barclays current or former employee, agent or contractor alleged that he or she was the subject of retaliation or other negative consequences as a result of the employee, agent or contractor having raised a whistleblowing complaint or concern, and, for each instance identified, details about Barclays’ investigation of the retaliation allegation and any conclusions reached; and
• Any identified (1) substantiated allegations of retaliation or (2) instance of someone other than the Investigations and Whistleblowing Team, Whistleblowers’ Champion and Group Chief Compliance Officer (collectively) making a determination of whether a whistleblowing concern is false and/or malicious, occurring since January 1, 2017, along with adequate details about both the incident and Barclays’ response to any such incident.

A copy of the consent order can be found here.