Malum is committed to operating with integrity. This policy encourages workers, contractors, suppliers, customers and merchants to speak up about wrongdoing without fear of retaliation, in line with the UK Public Interest Disclosure Act 1998, the FCA whistleblowing rules (SYSC 18), and the EU Whistleblower Protection Directive.
Table of Contents
This policy is open to everyone with a working or commercial relationship with Malum: employees and former employees, contractors and freelancers, agency workers, interns, applicants, board members, suppliers and their staff, merchants, customers, end-users, and members of the public.
You can raise a concern about any matter you reasonably believe is in the public interest, including:
Personal grievances and HR disputes should normally be raised through the grievance procedure rather than this policy, but they are not excluded where there is a clear public-interest element.
Anyone making a disclosure under this policy is protected from retaliation, including dismissal, demotion, harassment, blacklisting, contract termination, withdrawal of services, and any other detriment. Retaliation against a whistleblower is a serious disciplinary offence and, where it amounts to a breach of statutory rights, may give rise to personal liability.
We treat the identity of a whistleblower as confidential and will not disclose it without consent except where disclosure is required by law or by a competent authority. You may submit a disclosure anonymously; doing so may limit our ability to investigate or to provide feedback, but anonymous reports are still taken seriously.
Disclosures are assessed within five (5) business days by the Whistleblowers' Champion. Investigations are conducted by independent personnel who have no conflict of interest. Where appropriate, external advisers (legal, forensic) are appointed. Investigations are completed as quickly as possible consistent with thoroughness, and findings are reported to the Audit Committee or Board.
You will receive acknowledgement of your disclosure within seven (7) days and an update on outcome within three (3) months, subject to legal and confidentiality constraints. Substantiated wrongdoing leads to corrective action, which may include disciplinary measures, contract termination, regulatory notification, restitution, and control changes.
You can report concerns directly to a prescribed regulator at any time without first raising the matter internally. Prescribed regulators include:
Whistleblowing disclosures and the results of investigations are recorded and retained securely for at least six (6) years. The Board reviews the whistleblowing programme at least annually.
[email protected] — reviewed only by the Whistleblowers' Champion and the MLRO.
Last modified 05/12/2026