Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
The EU Whistleblowing Directive, Directive (EU) 2019/1937, makes an internal reporting channel mandatory for many organizations. Private companies with 50 or more workers must have one, and some regulated firms need one regardless of size. This guide explains who must comply, since when, and what national laws add.
What does the EU Whistleblowing Directive require?
The directive requires Member States to make legal entities set up channels and procedures for internal reporting and follow-up (Article 8(1)). Member States must also create external channels at competent authorities and protect reporting persons against retaliation. The full text is available on EUR-Lex.
As a directive, it applies through national law. Each Member State had to transpose it by 17 December 2021 (Article 26). Your company therefore follows the national law of each country where it has employees.
Which companies must set up a whistleblowing channel?
The general rule is simple: private-sector legal entities with 50 or more workers must comply (Article 8(3)). Some entities have no threshold at all. Entities covered by the EU acts in Parts I.B and II of the Annex, such as rules on financial services or on money laundering, need a channel regardless of their size (Article 8(4)).
Member States may go further. After a risk assessment, they may oblige companies with fewer than 50 workers, for example where their activities pose a risk to the environment or public health (Article 8(7)). Smaller companies that are not obliged can still set up a channel. Our guide to the voluntary whistleblowing channel explains how.
How is the 50-worker threshold counted?
The directive sets the figure of 50 workers. How the headcount is measured follows national law, and the wording differs between countries:
- Germany: employers with, as a rule, at least 50 employees (Section 12 of the HinSchG).
- Italy: the average number of employees on permanent or fixed-term contracts in the last year (Article 2 of Legislative Decree No. 24/2023).
- Spain: private employers that have 50 or more workers (Article 10 of Law 2/2023).
- Portugal: legal entities that employ 50 or more workers (Article 8 of Law No. 93/2021).
Check the rule in each country, especially if your headcount is close to 50 or changes during the year.
Since when does the obligation apply?
The directive set two deadlines (Article 26). The general transposition date was 17 December 2021. For private companies with 50 to 249 workers, Member States had until 17 December 2023.
National dates vary. Some examples:
- Germany: employers with 50 to 249 employees had to set up their internal reporting office from 17 December 2023 (Section 42 HinSchG).
- Italy: the decree has applied since 15 July 2023, and since 17 December 2023 for private entities with up to 249 workers (Article 24).
- Spain: obliged entities had three months from the entry into force of the law. Entities with up to 249 workers had until 1 December 2023 (second transitional provision).
- Portugal: the law entered into force 180 days after its publication (Article 31).
Can companies share a channel or outsource it?
Yes, within limits. Private companies with 50 to 249 workers may share resources for receiving reports and carrying out investigations (Article 8(6)). Each company still keeps its own duties to maintain confidentiality, give feedback and address the breach.
Any company may also let a third party operate the channel (Article 8(5)). The same safeguards then apply to that provider. A specialized provider can help your company meet the deadlines, keep reports confidential and document every case.
Does the obligation also apply to the public sector?
Yes. The obligation covers all legal entities in the public sector, including entities they own or control (Article 8(9)). Member States may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers. They may also exempt other public entities with fewer than 50 workers.
What happens if a company has no channel?
The directive requires effective, proportionate and dissuasive penalties (Article 23). They apply to hindering reports, retaliation, vexatious proceedings and breaches of confidentiality. National laws also sanction companies that fail to set up a channel, for example:
- Germany: fines of up to EUR 20,000 for failing to set up and operate an internal reporting office, applicable since 1 December 2023 (Sections 40 and 42 HinSchG).
- Italy: fines of EUR 10,000 to 50,000, imposed by the National Anti-Corruption Authority (ANAC), where no reporting channels were set up or the procedures do not comply (Article 21).
Fines for retaliation are often higher. In Germany, failing to set up an internal reporting office can be fined up to EUR 20,000. Obstructing reports, retaliation and breaches of confidentiality can be fined up to EUR 50,000. For companies, Section 40(6) HinSchG refers to Section 30 of the Administrative Offences Act (OWiG), which raises this maximum tenfold to EUR 500,000.
What must a mandatory channel offer?
The channel must meet the minimum requirements of Article 9. These include secure and confidential reporting, written and oral reports, acknowledgment within seven days, an impartial case handler and feedback within three months. Our whistleblowing channel guide covers each requirement and the setup steps.
Conclusion
The EU Whistleblowing Directive makes a channel mandatory for private companies with 50 or more workers and for regulated firms of any size. National laws set the counting rules, deadlines and fines. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: Types of whistleblowing: what can be reported and Whistleblowing procedure step by step.
Frequently asked questions
Private companies with 50 or more workers, entities covered by the EU acts listed in Parts I.B and II of the Annex regardless of size, and public-sector entities. National laws may extend the obligation to smaller companies.
The directive set 17 December 2023 as the latest date. National dates differ: Germany and Italy applied it from 17 December 2023, while Spain set 1 December 2023.
Private companies with 50 to 249 workers may share resources for receiving and investigating reports (Article 8(6)). Each company keeps its own duties to maintain confidentiality, give feedback and address the breach.
Penalties are set nationally. In Germany, failing to set up an internal reporting office can cost up to EUR 20,000. In Italy, ANAC can impose fines of EUR 10,000 to 50,000.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.