Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Document the events, separate what you know from what you suspect, preserve supporting records, and send a clear account to the regulator with authority over the suspected conduct. The route depends on your location and the issue: the U.S. Securities and Exchange Commission (SEC) accepts reports about possible violations of U.S. federal securities laws, but it is not the right channel for every concern about a financial firm. A weak board process or internal control is not automatically a legal violation.

How do I document suspected governance failures?

Build a dated account that lets a regulator understand what happened and where your information came from. The SEC asks people submitting a tip to describe the events, who was involved, and how, why, and when the conduct occurred, along with relevant documentation. It says, “We can best address your submission if we receive accurate, truthful, and complete information.” SEC filing guidance

Create a chronology

For each relevant event, record the date or best-known date range, location, people or organizations involved, and what was said or done. Note how you learned about it—for example, whether you witnessed it, read it in a company record, or heard it from someone else. If a date or detail is uncertain, label it as such rather than filling the gap with a guess.

Separate observation, records, and inference

Make clear which facts you personally observed, which are supported by records, and which are your interpretation. Attribute information to its source and describe uncertainty plainly. You can explain why a pattern concerns you without presenting suspected misconduct as a proven finding or deciding whether a law was violated.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Connect the governance concern to a possible regulatory issue

Describe the governance failure you believe occurred—such as ignored warnings, misleading oversight, or inadequate controls—and explain any possible connection to conduct within a regulator’s remit. SEC examples include false or misleading company statements, failure to file required reports, theft or misappropriation, insider trading, and market manipulation. These examples concern possible securities-law violations; they do not make every governance weakness an SEC matter. SEC examples of reportable suspected wrongdoing

What evidence should I include?

Identify records that help substantiate the chronology and explain what each record shows. The SEC requests relevant documentation; the UK Competition and Markets Authority (CMA) gives emails, screenshots, and documents as examples for competition or consumer-protection disclosures. These are examples, not an exhaustive list of evidence types. SEC filing guidance and CMA whistleblowing guidance

  • Make an inventory with a short description of each item, its date, its source, and the event it supports.
  • Refer to records precisely in your narrative so a reviewer can connect a claim to its supporting material.
  • Keep uncertainty and context attached to the evidence; do not imply that a record proves more than it actually shows.
  • Prepare a concise narrative that answers who, what, when, how, and why, then attach or identify the relevant records.

Where do I report suspected misconduct?

First identify the country, regulator, and type of conduct. A regulator’s jurisdiction depends on the issue and the entity involved; the SEC’s TCR process is specifically for information about possible U.S. federal securities-law violations. It is not a universal reporting route for complaints about banks, insurers, investment firms, or poor governance.

Possible U.S. federal securities-law violations: SEC

The SEC recommends submitting a tip through its online Tips, Complaints and Referrals (TCR) portal. It also accepts Form TCR by mail or fax using the current instructions and contact details on its submission page. The online portal provides a notice confirming successful receipt and a submission number. SEC whistleblower FAQs

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
SEC submission route What to expect and retain
Online TCR portal The SEC recommends this route. Save the receipt notice and submission number.
Form TCR by mail or fax Use the current details on the SEC submission page and retain a copy of the form and proof of transmission, such as mailing or fax confirmation.

If you later send supplemental information, refer to the original TCR number. The SEC FAQ advises sending a submission through one method, rather than duplicating it through multiple channels. Keep a copy of everything you send and the confirmation or transmission proof.

Other jurisdictions or types of conduct

Do not treat the SEC process as a substitute for checking the rules where the conduct occurred. For example, the CMA’s whistleblowing guidance concerns competition and consumer-protection matters; it is not an FCA reporting route for suspected failures at a financial firm. For a non-U.S. financial-regulatory concern, identify the relevant authority and check its current reporting channel, confidentiality terms, and protections before submitting.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Should I report internally before contacting the regulator?

For possible securities-law violations, SEC guidance says an individual may report to the SEC before, at the same time as, or after raising the matter internally. Internal reporting is not a prerequisite to making a direct SEC report. The rules for anti-retaliation protection and eligibility for a whistleblower award are distinct, so do not assume that one follows automatically from the other. SEC whistleblower protections

If you are weighing internal and external reporting, consider the risks of sharing sensitive information and get legal advice for questions about how protections apply to your situation, including circumstances involving work or conduct outside the United States.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Can I report anonymously?

For an SEC whistleblower award claim, an anonymous submission requires representation by an attorney and compliance with the SEC’s declaration and filing procedures. The SEC describes confidentiality protections for TCRs, but also explains that disclosure can be required in some circumstances authorized by law. Anonymity or confidentiality should not be treated as a guarantee that your identity can never be disclosed. SEC whistleblower FAQs

Before choosing an anonymous route, consult an attorney familiar with the relevant jurisdiction and process. Confidentiality rules and legal protections may differ across regulators and countries.

What happens after I send a report?

Keep your submitted narrative, attachments, and proof of transmission together, including the SEC confirmation and TCR number when you use the online portal. A regulator may not respond individually to every disclosure: the CMA, for example, says submission volume means it cannot reply directly to every whistleblowing report. Do not interpret silence by itself as confirmation that a report was accepted for investigation or that no action will be taken. CMA whistleblowing guidance

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.