In short
A vigil mechanism (whistleblower policy) is a channel for directors and employees to report fraud, unethical behaviour or policy violations without fear of retaliation. Under Section 177 of the Companies Act, 2013 and Rule 7, it is mandatory for listed companies, companies that accept public deposits and companies that have borrowed more than ₹50 crore from banks or public financial institutions. It must protect whistleblowers from victimisation and give direct access to the Audit Committee chair in appropriate cases.
What is a vigil mechanism?
A vigil mechanism, usually set out in a whistleblower policy, is a formal, confidential way for people inside an organisation to report genuine concerns, such as fraud, bribery, financial misstatement, misuse of assets, data leaks or breaches of the code of conduct, so they can be investigated.
It differs from a grievance process. A grievance is about something that affects the person complaining, such as their pay or treatment. A whistleblower report is about wrongdoing that harms the organisation, its investors or the public.
Which companies must have a vigil mechanism?
Section 177(9) of the Companies Act, 2013, read with Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014, requires these companies to establish a vigil mechanism for directors and employees:
| Company type | Vigil mechanism required? |
|---|---|
| Every listed company | Yes |
| Companies that accept deposits from the public | Yes |
| Companies that have borrowed more than ₹50 crore from banks and public financial institutions | Yes |
| Other private companies | Not by law, but often required by investors, lenders, global parents or customers |
Listed companies must also comply with Regulation 22 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, which requires a vigil mechanism for directors and employees, and disclose it in the corporate governance report.
Even where it isn't mandatory, a whistleblower channel is increasingly expected. Investors ask for it in due diligence, global customers require it from suppliers, and it is one of the strongest ways to show 'adequate procedures' against bribery.
What the law requires of a vigil mechanism
- Oversight by the Audit Committee. Where a company must have an Audit Committee, the vigil mechanism operates through it. Otherwise the Board nominates a director to play this role.
- Adequate safeguards against victimisation of anyone who uses the mechanism (Section 177(10)).
- Direct access to the Audit Committee chair (or the nominated director) in appropriate or exceptional cases.
- Disclosure of the mechanism on the company's website, if it has one, and in the Board's report.
- Action against misuse. The rules allow the Audit Committee or director to act against people who repeatedly make frivolous complaints.
Should whistleblower reports be anonymous?
The law doesn't require anonymity, but in practice a whistleblower channel without an anonymous option gets very few reports. People reporting senior managers or financial misconduct fear for their careers, and email inboxes or HR systems tie every message to a name.
The challenge with anonymity is follow-up: investigators often need more detail. The best mechanisms solve this with two-way anonymous communication, where the reporter can answer questions and receive updates without ever revealing who they are.
Be careful about routing reports by location. If a report is tagged to a branch with five people, the reporter is effectively identified. Whistleblower reports should usually be handled centrally.
How to investigate a whistleblower complaint
- Receive and acknowledge the report, and give the reporter a way to track it.
- Triage: decide whether it falls under the whistleblower policy, needs urgent action (for example to preserve evidence), or belongs in another process such as POSH or grievance.
- Assign investigators who have no conflict of interest with the people involved. Escalate to the Audit Committee chair when senior management is implicated.
- Investigate: collect documents and evidence, interview witnesses, and ask the reporter follow-up questions through the confidential channel.
- Report findings to the Audit Committee or designated director, with recommendations.
- Act and close: take disciplinary or corrective action, inform the reporter that the matter is closed, and retain records securely.
Protecting the whistleblower doesn't end at closure. Watch for retaliation, such as sudden poor reviews, transfers or exclusion, in the months that follow, and treat it as a serious breach.
What should a whistleblower policy include?
- who can report (directors, employees, and optionally vendors, customers and ex-employees)
- what can be reported, with examples
- how to report, including an anonymous option
- how reports are investigated, by whom and in what timeframe
- protection from retaliation, and what happens if it occurs
- how to escalate directly to the Audit Committee chair
- how confidentiality and records are handled
- consequences of deliberately false reports
How TrustToSpeak runs your vigil mechanism
A whistleblower channel people actually use
- Anonymity enforced by the platform. No setting, admin or vendor can switch it off.
- Two-way anonymous chat, so investigators can ask follow-up questions without learning who reported.
- Handled centrally by default, so no branch narrows down the reporter's identity.
- An ethics committee with strict conflict-of-interest checks, and no access for HR or IT administrators.
- A tamper-evident record of every step for the Audit Committee and auditors.
- Protected retention of 8 years under legal hold.
Frequently asked questions
Is a whistleblower policy mandatory for private limited companies?
Only if the company accepts deposits from the public or has borrowed more than ₹50 crore from banks and public financial institutions. Otherwise it is not mandatory, though investors, lenders and customers often require one.
What is the difference between a vigil mechanism and a whistleblower policy?
They are usually the same thing. 'Vigil mechanism' is the term used in the Companies Act and SEBI regulations; the whistleblower policy is the document that sets out how the mechanism works.
Who oversees the vigil mechanism?
The Audit Committee. If the company is not required to have an Audit Committee, the Board nominates a director to oversee the mechanism. Whistleblowers must have direct access to the Audit Committee chair in appropriate or exceptional cases.
Can an employee report anonymously under a vigil mechanism?
Yes. The law doesn't require anonymity, but most good whistleblower policies allow it because people are far more likely to report misconduct when they cannot be identified.
Can vendors or customers use the whistleblower channel?
The legal requirement covers directors and employees, but many companies open the channel to vendors, customers, contractors and former employees, since they often see misconduct first.
Where must the vigil mechanism be disclosed?
On the company's website, if it has one, and in the Board's report. Listed companies also report on it in their corporate governance report.
What protection does a whistleblower get?
Section 177(10) requires adequate safeguards against victimisation. In practice that means confidentiality, an anonymous option, a ban on retaliation backed by disciplinary action, and direct access to the Audit Committee chair.
This guide explains the law in general terms and is not legal advice. Laws, rules and state notifications change; check the current text and take advice from a qualified professional for your situation.