Mumbai – Every listed Indian company has a whistleblower mechanism. IL&FS had one. DHFL had one. So did Gensol, BYJU and GoMechanic. In each case, internal concerns existed well before the failure became public.
The obligation comes from Regulation 22 of the SEBI Listing Obligations and Disclosure Requirements Regulations, which requires a vigil mechanism allowing stakeholders to report illegal or unethical conduct, with safeguards against victimisation.
The mechanism is not the control
A policy document, an email address and an audit committee reference satisfy the regulation. None of that determines whether an employee believes a complaint will be investigated rather than traced back to them.
The diagnostic questions are unglamorous. How many complaints were received last year? If the answer is zero at a company of twenty thousand people, that is not an absence of problems. It is an absence of trust. Who receives the complaint, and do they report to the person most likely to be its subject? Is there a channel that bypasses management entirely to the audit committee chair?
Enforcement does respond when information arrives
In January 2026 SEBI issued a show-cause notice to a Bank of America unit over alleged insider trading violations in a March 2024 share sale, acting on a whistleblower complaint made in 2024.
The case demonstrates the regulator will act. It also illustrates the lag between a complaint and a consequence, which is exactly the interval a potential whistleblower weighs against their own job security.
Scope has widened
In January 2026 SEBI revised the threshold for high value debt listed entities from 1,000 crore to 5,000 crore rupees, changing which entities must operate a formal vigil mechanism with anti-victimisation safeguards.
What boards should actually review
Complaint volume, time to resolution, the proportion substantiated, and whether any complainant left the company within a year of reporting. That last figure is rarely tracked and tells you more than the policy ever will.
Source: SEBI Listing Obligations and Disclosure Requirements Regulations, Regulation 22, and SEBI enforcement actions reported in January 2026.
