By S&S Co. Advocates & Solicitors · Published 28 September 2026 · Informational content, not legal advice: see our disclaimer
Overview
A compliance guide for a company determining whether it must establish a vigil mechanism under Section 177 of the Companies Act, and what that mechanism must actually provide for, distinct from this site's existing POSH internal committee and Section 447 director-fraud-liability guides.
What You Need to Know
- Section 177 of the Companies Act, 2013 requires every listed company, every company that accepts deposits from the public, and every company that has borrowed money from banks and public financial institutions in excess of Rs. 50 crore to establish a vigil mechanism for directors and employees to report genuine concerns
- The vigil mechanism must be established in the manner prescribed by rules made under the Act, and must provide adequate safeguards against victimisation of any director or employee who uses it to raise a protected disclosure
- The mechanism must also provide for direct access to the Chairperson of the Audit Committee in appropriate or exceptional cases: a safeguard against a whistleblower's concern being suppressed at a lower level of the organisation, particularly where the concern touches senior management
- For listed companies, SEBI's LODR Regulations impose their own, generally more detailed, vigil-mechanism and whistleblower-policy requirements that operate alongside the Companies Act obligation: a listed company must satisfy both frameworks, not just the Companies Act minimum
- A company's Audit Committee is responsible for overseeing the functioning of the vigil mechanism, and details of the mechanism are required to be disclosed on the company's website and in its Board's report
- Companies that fall within the Section 177 thresholds but have not yet formalised a vigil mechanism should treat this as a governance gap to close promptly: the obligation is not discretionary once a company crosses the listed, public-deposit, or Rs. 50 crore borrowing threshold
Frequently Asked Questions
Which companies must set up a vigil mechanism under Section 177?
Every listed company, every company that accepts public deposits, and every company that has borrowed more than Rs. 50 crore from banks and public financial institutions.
What safeguard must the mechanism specifically provide?
Direct access to the Chairperson of the Audit Committee in appropriate or exceptional cases, so a concern touching senior management isn't suppressed lower down the organisation.
Does Section 177 compliance mean a listed company has fully met its whistleblower obligations?
No: SEBI's LODR Regulations impose their own, generally more detailed, vigil-mechanism requirements that a listed company must satisfy in addition to the Companies Act minimum.
References & Further Reading
This guide references the following statutes, rules and sources, cross-checked at the time of writing.
- Section 177 applicability thresholds (listed companies, deposit-accepting companies, companies with borrowings exceeding Rs. 50 crore from banks/PFIs): well-settled, confirmed via CAclubindia's Section 177 explainer and multiple compliance guides at research time
- Direct access to the Audit Committee Chairperson in exceptional cases as a mandatory safeguard: confirmed via Section 177(10) and standard vigil mechanism policy templates at research time
- SEBI LODR's additional, listed-company-specific whistleblower requirements operating alongside Section 177: confirmed at research time: verify the current LODR provision numbers and any amendment effective from April 2025 referenced in some sources, against the current SEBI LODR Regulations at drafting time
- See also our Corporate Law & M&A Notable Judgments and Legal Updates: Corporate Law & M&A archive.