A financial institution shall observe the following:

1. It shall prepare a policy on whistle blowing to be approved by its board of directors. If the financial institution does not have a board of directors, this policy shall be approved by a chief executive officer or a general director and reviewed annually.
2. It shall submit a periodic report to its board of directors and audit committee on the cases received and actions taken.
3. . It shall encourage its employees and stakeholders to report any violation committed inside or outside the financial institution within the scope of their work.
4. . It shall raise awareness among, and reassure, its employees and stakeholders about the confidentiality of the whistle blowers’ identity and the information contained in reports for all stages of the processing of each report.
5. It shall protect whistle blowers against any retaliation.
6. It shall encourage its employees and stakeholders not to hesitate to report any violation due to being uncertain of the authenticity of the report and whether or not it can be supported with facts. The financial institution shall also stress that all employees and stakeholders are expected to refrain from rumors, irresponsible behavior and false allegations, and that, if a claim is made in good faith but has not been established as valid during investigation, no action will be taken against the whistle blower.
7. It shall provide its employees and stakeholders with information on all channels for whistle blowing, which should include as a minimum: a direct telephone number, website, postal service, and e-mail address.
8. It shall prepare awareness programs that urge its employees and stakeholders to report violations and clarify their responsibilities.

Financial institutions shall establish an independent administrative unit to receive and process violation reports and to report to the compliance department.

Financial institutions must encourage their employees and stakeholders to report incidents that might lead to correcting errors or actions, detecting violations or promoting values. Such reports may include any of the following cases:

1.  Financial and administrative corruption, which is any illegal exploitation of financial resources or administrative organization in a financial institution; 
2.  Breach of the laws, regulations, instructions and policies which must be followed as required by the financial institution's scope of work; 
3.  Violations related to the environment, health and safety in the workspace, including any negative behavior that might harm the environment or workplace or threaten the safety of any individual; 
4. Indecent conduct contrary to public order, Islamic ethics, customs and traditions; 
5.  Misuse of the financial institution's property or assets; 
6.  Abuse of power or decision making by employees of the financial institution, which may go against the financial institution's interest; 
7.  Passing of illegal operations of the financial institution, circumvention of laws, or concealment of regulatory errors; 
8.  Conflict of interest in any business arrangement or contract carried out by the financial institution; 
9.  Misuse of the powers granted by the financial institution to its employees, such as exchanging passwords, etc.;
10.  Obtaining undeserved benefits or rewards; 
11. Unlawful disclosure of confidential information; 
12. Acts of concealment involving bad faith or intentional negligence, destruction of official documents, or concealment of fraudulent financial reports; 
13. Serious negligence which may result in damage to the financial institution; and 
14. Concealment of any of the acts mentioned above.

A whistle blower shall:

1. ensure credibility in reporting by avoiding rumors and allegations that are not based on facts, and report whenever real and reasonable information indicating a suspicion of violations is found; 
2.  avoid malicious reports aimed at defaming others, taking reprisal or retaliation against them, or undermining confidence in the financial institution, its employees or stakeholders; 
3.  exercise due diligence by ensuring accuracy in reporting, providing all necessary details relating to the case reported, and attaching all documents containing details and evidence as required by the nature of the violation; 
4.  report violations as soon as possible; 
5.  maintain full confidentiality of the report for the good of the financial institution; and 
6.  bear the responsibility for malicious allegations that defame or damage the financial institution or any of its employees or stakeholders.

Upon receiving a violation report, a financial institution shall:

1.  treat such report with the necessary seriousness, regardless of the nature, language, adequacy of information, impact or importance of the report; 
2.  take all necessary measures to protect the whistle blower; 
3.  notify the whistle blower of receipt of the report and, if possible, the decision made; 
4.  take corrective actions for the violation if proved; 
5.  take into account the interest of its employees and stakeholders; 
6.  refer reports to the department responsible for control and investigation, either inside or outside of the financial institution; 
7.  keep violation reports and relevant documents, including recordings, for the durations specified by the laws and instructions; and 
8.  prepare reports on whistle blowing instances and the procedures followed.

1.  Financial institutions shall protect whistle blowers providing unmalicious reports from any potential retaliatory action taken by their employees. 
2.  A whistle blower, whose identity was not revealed and could not be discovered by the financial institution, may not claim protection as prescribed by Clause (e/ 2) under Part (III). 
3.  Financial institutions shall not disclose any information about any whistle blower except to competent authorities, such as investigation and judicial authorities.

There should be an indicator for each stage of the working procedures aimed to determine the performance level by measuring the extent of meeting all the requirements of each procedure established by the financial institution.