The Short Answer

If your charity fundraises, two routes are required: a fundraising complaints procedure the public can find, and a way for staff and volunteers to raise concerns about your fundraising. Both come from the Code of Fundraising Practice, not statute. Two more depend on who you are: CQC-registered providers need a complaints system for service users, and FCDO expects funded partners to have a whistleblowing route. No statute requires a charity to publish a whistleblowing policy.

The usual failure is not a missing page. It is four pages that disagree.

The practical answer is one section with one owner, rather than four pages written by four teams. It routes four audiences (donors, service users, partners, staff and volunteers), every route states the same things and every form has a named reader. The section checklist gives each of these routes its own row.

What the Fundraising Code Requires

The Code of Fundraising Practice has been in force since 1 November 2025. It is a regulatory code, not statute. Rule 2.3.1 reads, in full: "You must have a clear and publicly available fundraising complaints procedure which fundraisers can explain to existing or potential donors" (Fundraising Regulator). The Regulator's Code FAQs allow the written procedure to be "available on request and/or" set out on your website. I would put it on the website: it is what a fundraiser can point a donor to on the doorstep, and it is the version anyone can check without asking you. It sits beside the other publishing duties in Charity Commission website requirements.

Read rule 2.3.3 closely: it is narrower than a whistleblowing policy. It covers concerns about fundraising practice, raised by staff and volunteers, and part of what the procedure must explain is how to take a concern to the Fundraising Regulator or the Scottish Fundraising Adjudication Panel when it cannot be dealt with inside the charity (table of changes).

The escalation routes for donors need to be stated correctly. The Fundraising Regulator looks into concerns "when the organisation involved cannot resolve the complaint through its own processes", so your procedure is the first stage, not an optional one. The Scottish Fundraising Adjudication Panel handles charities registered in Scotland, and its process has three stages: the charity, then the charity's trustees, then the Panel. A Scottish charity's page therefore needs a way to reach the trustees, not only the fundraising team. For a charity registered in both jurisdictions, the Panel applies the lead regulator: Charity Commission lead means the Fundraising Regulator, OSCR lead means the Panel.

A supporter promise is best practice, not a duty. It sets out how you will treat supporters on contact, data, pressure and people in vulnerable circumstances. Link it from the fundraising complaints route and link the route from it. The promise says what you commit to; the complaints route says what happens when you fall short.

What Is Conditional

Service users. Regulation 16 requires a CQC-registered provider to run "an accessible system for identifying, receiving, recording, handling and responding to complaints" (legislation.gov.uk), and the CQC's guidance says information about how to complain "must be available and accessible to everyone who uses the service". Neither names a website, but the website is where most people will look first. I have not checked the equivalents in Scotland and Wales.

FCDO-funded partners. The SEAH guidance uses "should", not "must". It says the policy "may not be referred to as whistleblowing, but might be a complaints and/or concerns policy", that it "should be explicit that there can be no reprisals for whistleblowers", and that "beneficiaries and other stakeholders outside of the organisation should also be able to complain and raise concerns" (FCDO). FCDO's own wording already treats complaints and whistleblowing as one policy. Your website can do the same.

Humanitarian organisations that work to the Core Humanitarian Standard (2024 edition), a voluntary standard, take on Commitment 5: people and communities can safely report concerns and complaints and get them addressed. Requirement 5.6 asks for "a coherent organisational approach", and requirement 8.5 extends safe routes to staff, volunteers, partners and other stakeholders.

What the Whistleblowing Law Does Not Do

The Public Interest Disclosure Act 1998 protects people who blow the whistle. It does not require a policy, a page or a form, and GOV.UK's guidance for employers says so directly: "You are not legally required to have a whistleblowing policy or to respond to whistleblowing disclosures."

Two consequences for the page. First, the protection belongs to workers. The Fundraising Regulator's whistleblowers page lists "be a worker, not a volunteer" among its conditions, so a speak-up page that promises volunteers legal protection is promising something the statute does not give. Say what the charity itself commits to. Second, the external routes are worth naming. The Charity Commission and OSCR are both on the government's list of prescribed people and bodies, and so is the CQC. Whether a particular disclosure is protected is a question for the person's own adviser, and the page should not try to answer it.

Beyond those duties, the voluntary Charity Governance Code (2025) lists "published guidance on how stakeholders can raise concerns" under its ethics and culture principle. A published speak-up route is therefore conditional for the two triggers above and best practice for everyone else.

Four Audiences, One Structure

Donors complain about fundraising. Service users complain about the service. Partners need a route that works in their languages and covers complaints about you, and the CHS guidance notes say organisations working with partners "should agree on how they will raise and handle complaints (including against each other)" (CHS guidance notes, 2018). Staff and volunteers need the speak-up route.

Picture the usual history: four pages, written by four teams at four different times. The fundraising page promises a reply in one timescale, the service page in another, the partner route exists only in a PDF, and nobody can say which inbox the speak-up form reaches. A reader who compares two of them learns that nobody owns the whole.

One structure fixes this. A single complaints and concerns section, reachable from the footer and from every donation, service and partner page, with one route per audience and the same fields on each:

Field What each route states
Who it is for The audience, and what belongs on a different route (safeguarding, for one)
How Form, email, phone and post, so no one is forced online
Languages Which languages the route accepts and who reads them; multilingual governance covers who keeps translated routes current
Anonymity Whether it is possible, stated truthfully
What happens next The stages and the timescales the handling team actually keeps
Escalation The external body for that route, named and linked
Who reads it The role that receives submissions, and that it is not the person complained about

Christian Aid's accountability page shows the shape: UK complaints, complaints from outside the UK, the feedback and complaints policy, whistleblowing guidance and safeguarding gathered in one place. Its international form routes by country and states plainly that "complaints cannot be submitted anonymously", which is the kind of true statement the anonymity field asks for. I loaded both on 30 September 2026.

The Form Is a Data Problem

A complaints form decides where a sensitive message lands and who can read it. Three questions have to be answered before it goes live.

Who reads it? A speak-up report about a manager must not arrive in an inbox that manager can open, and a complaint about a named fundraiser should not go only to the fundraising team. Route by audience, and give each route a recipient outside the line of the likely subject.

What is in it? A service user's complaint can reveal health, religion or ethnicity, which are special category data under Article 9 of the UK GDPR. The submission then carries the stricter rules from the moment it arrives, including in the notification email the form processor sends.

Where is it kept, and for how long? Article 5 requires personal data to be kept no longer than necessary and with appropriate security. A shared inbox holding years of complaints, readable by former staff, meets neither. The wider version of this problem is in nonprofit data protection beyond the checklist, and the form-level fixes in form design for nonprofit websites. Your data protection lead decides the retention period; the website has to enforce it.

Who Owns It

Each route needs a named owner, a review date and a test submission after any change to the form, the platform or the people who answer it. The timescales on the page must be ones the handling team has agreed, because a published response time is a promise a complainant will quote back. The Charity Governance Code suggests boards see reporting on complaints, fraud, whistleblowing and safeguarding, and the content governance post covers how to put a page like this on a review cycle. The routes are only as good as the person who answers them, so name that person on every one.

Further Reading

What This Post Does Not Cover

This is about the website: what it publishes, where and who keeps it true. It is not advice on how to investigate a complaint or handle a disclosure, which belongs with your own legal and HR advisers.