Vigil Mechanism and Whistleblower Policy Requirements

Not every Indian company needs a formal vigil mechanism - the Companies Act only makes it mandatory for specific categories, based on listing status, public deposits, or the scale of borrowing.

Key facts at a glance

• A vigil mechanism is mandatory under Section 177(9) of the Companies Act, 2013 for listed companies, companies that accept public deposits, and companies with borrowings from banks or public financial institutions exceeding Rs 50 crore.
• The mechanism must include safeguards against victimisation for anyone who raises a genuine concern in good faith.
• It must allow direct access to the chairperson of the Audit Committee in appropriate or exceptional cases.
• Where an Audit Committee exists, it oversees the vigil mechanism; otherwise the Board nominates a director for this role.
• Listed companies face additional whistleblower-related disclosure obligations under SEBI's LODR Regulations.
• Details of the vigil mechanism must be disclosed on the company's website (if it has one) and in the Board's report.

Who must have a vigil mechanism

The legal trigger for a mandatory vigil mechanism is narrower than many founders assume - it is not simply about company size or number of employees.

A private company that is not listed, has not accepted public deposits, and has borrowings below the Rs 50 crore mark falls outside this specific statutory requirement. That said, many privately held companies adopt a vigil mechanism voluntarily as part of good governance practice, particularly once they have institutional investors, a sizeable workforce, or plans to raise external capital.

What the mechanism must actually include

A compliant vigil mechanism is more than a suggestion box. At minimum, the law requires that it:

• Give directors and employees a genuine channel to report concerns about fraud, unethical behaviour, or violation of the company's code of conduct.
• Build in adequate safeguards against victimisation of anyone who reports a concern in good faith.
• Provide for direct access to the chairperson of the Audit Committee in appropriate or exceptional cases - meaning the reporting channel cannot be structured so that every complaint is filtered exclusively through management first.
• Be overseen either by the Audit Committee (in companies required to have one) or by a director nominated by the Board (in other companies covered by the requirement).

Disclosure obligations

Companies with a mandatory vigil mechanism must disclose details of the mechanism on their website, if they have one, and must also refer to it in the Board's report. This is meant to make the existence of the reporting channel visible not just internally, but to shareholders and other outside stakeholders reviewing the company's governance disclosures.

Extra requirements for listed companies

Listed companies carry an additional layer of obligation under SEBI's Listing Obligations and Disclosure Requirements (LODR) Regulations, which require a documented whistleblower policy with specific protections - including protection against unfair termination or adverse action, and direct access to the chairperson of the Audit Committee for genuine whistleblowers. For listed companies, the Companies Act vigil mechanism and the SEBI whistleblower policy obligations effectively work together, and the company's disclosures need to satisfy both sets of requirements rather than treating them as duplicate paperwork.

Not the same as the POSH internal committee

It is worth being explicit that a vigil mechanism is a distinct requirement from the Internal Committee mandated under the POSH Act for workplaces with 10 or more employees. The vigil mechanism is a general-purpose ethics and fraud reporting channel under company law; the POSH Internal Committee exists specifically to receive and inquire into complaints of sexual harassment. A company that needs both should keep the two channels and their governing policies clearly separate, even if they are administered by overlapping teams.

Sources

• Ministry of Corporate Affairs - mca.gov.in
• Securities and Exchange Board of India - sebi.gov.in

If you are not sure whether your company is required to have a vigil mechanism or whether your current policy meets the statutory requirements, ComplianceCheck's state-wise compliance assessment gives you a clear picture in a few minutes.

This guide is general information, not legal advice. Requirements vary by state, sector and headcount — confirm specifics with a compliance professional or the relevant authority.