On January 7, 2019, the New York State Department of Financial Services (the "DFS") issued new guidance on whistleblowing programs ("WP") to all entities regulated by the DFS regardless of industry, size or number of employees—hello representative offices, bit licensees and money services companies.
The DFS defines whistleblowing as:
reporting of information reasonably believed to constitute illegality, fraud, unfair or unethical conduct, mismanagement, abuse of power, unsafe or dangerous activity or other wrongful conduct including conduct that might affect safety, soundness or reputation
Anybody can be a whistleblower including employees (and ex-employees), vendors, outside counsel (!) and customers.
While the DFS recognized that a whistleblower program has to be tailored to the characteristics of the regulated entity; nevertheless, all regulated entities should design and have a WP as an "essential" part of a compliance program.