How BPCE structured a global whistleblowing system within a decentralised banking group

Managing a whistleblowing system across an international, decentralised group is a major challenge. As the second-largest banking group in France, BPCE brings together the Banques Populaires, the Caisses d'Épargne and numerous subsidiaries, including Natixis. Its decentralised, multi-entity organisation operates internationally, in a sector where regulatory requirements leave no room for error.

Within this context, the whistleblowing system is a central pillar of the Ethics and Compliance programme, sitting at the intersection of regulatory, operational and human concerns. At BPCE SA, the corporate entity and central body of the BPCE group, the compliance teams oversee the whistleblowing systems and consolidate reports at the global level, against a backdrop of steadily growing alert volumes.

To meet these challenges, the group structured and strengthened its whistleblowing system by choosing the Whispli platform.

‍

What are the challenges of a whistleblowing system at the scale of the BPCE group?

In a group this large, the whistleblowing system has to meet multiple requirements:

• guarantee confidentiality for every stakeholder (employees, clients, partners);
• cover a wide range of risks, from fraud to harassment to GDPR breaches;
• leave each entity responsible for handling its own reports;
• maintain a consolidated view at group level.

On top of this comes a key requirement: directing each alert according to its nature, the entity concerned and the country, without ever compromising the smooth running of processes or compliance with regulatory requirements.

‍

What were the main limitations of your system before Whispli?

Before the Whispli platform was put in place, the entities were working with a patchwork of tools, sometimes nothing more than secure mailboxes. Traceability was limited, consolidating the data was difficult, and the experience offered to whistleblowers was not particularly reassuring.

As alert volumes and regulatory requirements grew, these limitations became increasingly difficult to manage.