A vigil mechanism — a whistleblower policy — gives directors and employees a safe, protected route to flag fraud, unethical conduct or code violations. For listed, deposit-taking, and heavily-borrowed companies, it's a legal requirement, not a nice-to-have.
Required for: listed companies, deposit-accepting companies, and companies with bank/PFI borrowings over ₹50 crore.
A mid-sized company with ₹60 crore of bank borrowings assumes whistleblower policies are something only big listed firms need. But the moment its borrowings crossed ₹50 crore, Section 177(9) made a vigil mechanism mandatory — and not having one is a live compliance default. More importantly, the mechanism is what gives an employee who spots procurement fraud a protected way to raise it, with direct access to the audit committee chair and a genuine safeguard against retaliation. It's a governance tool that protects both the company and the people brave enough to speak up.
BOTTOM LINE
- Who must establish it: every listed company; companies accepting public deposits; and companies with borrowings from banks/PFIs over ₹50 crore (private companies included).
- Oversight: the audit committee runs it (or, where there's no audit committee, a Board-nominated director).
- Core safeguards: protection against victimisation, and direct access to the audit committee chairperson in exceptional cases.
What is a vigil mechanism?
Governs this section: Section 177(9), Companies Act, 2013
A vigil mechanism (commonly, a whistleblower policy) is a formal channel through which directors and employees can report genuine concerns — actual or suspected fraud, unethical behaviour, or violations of the company's code of conduct. The point is to surface wrongdoing internally and early, rather than have it fester or leak. It must be backed by real protection for the person who reports.
Who must establish one?
Governs this section: Section 177(9) & Rule 7, Companies (Meetings of Board and its Powers) Rules, 2014
Three classes of company must establish a vigil mechanism:
- every listed company;
- companies that accept deposits from the public; and
- companies that have borrowed money from banks or public financial institutions in excess of ₹50 crore.
PRACTITIONER'S NOTE
The borrowings limb catches private companies too. A private company with no public shareholders and no deposits still needs a vigil mechanism the moment its bank/PFI borrowings cross ₹50 crore — a threshold many growing companies pass without realising it triggers this obligation.
Who oversees it?
Governs this section: Section 177(9) & Rule 7(2)–(3)
Oversight depends on whether the company has an audit committee. Companies required to have an audit committee must route the vigil mechanism through that committee (a member with a conflict of interest in a given case recuses, and the others handle it). Other companies must have the Board nominate a director to play the audit committee's role for vigil-mechanism purposes — so that there's always a responsible, identified person to receive disclosures.
The safeguards that make it work
Governs this section: Section 177(10) & Rule 7(4)
A vigil mechanism is only as good as its protections. The Act requires:
- adequate safeguards against victimisation of anyone who uses the mechanism; and
- direct access to the chairperson of the audit committee (or the nominated director) in appropriate or exceptional cases — so a complaint about senior management can bypass the people it concerns.
Without genuine anti-retaliation protection and an escalation route, a policy is just paper; the statute deliberately builds both in.
Disclosure and frivolous complaints
Governs this section: Section 177(10) & Rule 7(5)
The details of the mechanism must be disclosed on the company's website (if any) and in the Board's Report — visibility is part of the safeguard. The law also balances protection with discipline: where a director or employee files repeated frivolous complaints, the audit committee (or nominated director) may take suitable action, including reprimand, against them.
What does non-compliance cost?
Governs this section: Section 178(8)
PENALTY — Section 178(8)
Contravention of the Section 177/178 provisions makes the company liable to ₹5 lakh and every officer in default ₹1 lakh. But the bigger risk of having no (or a hollow) vigil mechanism is that wrongdoing surfaces externally — through a regulator, the press, or litigation — instead of being caught and fixed internally.
Common mistakes
- Assuming only listed companies need it. Deposit-takers and companies with ₹50 crore+ borrowings (including private ones) do too.
- A policy with no anti-victimisation protection. The safeguard against retaliation is mandatory, not optional.
- No escalation route to the audit committee chair. Direct access in exceptional cases is required.
- Not disclosing it. The mechanism must be on the website and in the Board's Report.
- No oversight owner. Either the audit committee or a Board-nominated director must own it.
Checklist
- Test applicability (listed / public deposits / bank-PFI borrowings > ₹50 crore).
- Adopt a board-approved vigil-mechanism (whistleblower) policy.
- Assign oversight to the audit committee, or nominate a director where there's no committee.
- Build in anti-victimisation safeguards and direct access to the audit committee chair.
- Disclose the mechanism on the website and in the Board's Report.
- Track complaints, report outcomes to the Board, and guard against frivolous misuse.
FAQ
Which companies must have a vigil mechanism? Listed companies, companies accepting public deposits, and companies with bank/PFI borrowings exceeding ₹50 crore — including private companies.
Who oversees the vigil mechanism? The audit committee where one exists; otherwise a Board-nominated director.
What protections must it provide? Adequate safeguards against victimisation and direct access to the audit committee chairperson in exceptional cases.
Does it have to be disclosed? Yes — on the company's website (if any) and in the Board's Report.
What's the penalty for not having one? Under Section 178(8), ₹5 lakh on the company and ₹1 lakh on every officer in default.
Primary sources
- Section 177(9) & 177(10), Companies Act, 2013; Rule 7, Companies (Meetings of Board and its Powers) Rules, 2014
- Section 178(8) — penalty; SEBI (LODR) Regulation 22 — for listed companies
Disclaimer: This article is general information on a fast-changing area of company law, current at the time of writing. It is not legal or professional advice for any specific company. Verify the position against the live MCA rules and consult your company secretary.