Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Yes, one whistleblowing system can cover several EU countries, as long as each legal entity with 50 or more workers has its own reporting channel inside it and the process follows each country’s national law. One platform is allowed. One undifferentiated inbox for the whole group is not.
The catch is that the EU only set a minimum standard. Each member state wrote its own law on top, so the same group can face different rules on anonymity, external authorities, record retention and fines in every country where it employs people. This guide explains the per-entity rule, compares the national laws in Germany, Spain, France and Italy, and sets out a seven-step plan for rolling out one system across borders.
every entity
One platform, a separate reporting channel for each legal entity. Trusty keeps every subsidiary’s reports, case handlers and access rights apart, offers the reporting form in several languages and hosts all data in ISO/IEC 27001 certified data centres in Germany. Your first channel is ready in less than five minutes.
Companies with 50 or more employees can set up whistleblower software from Trusty in minutes, from €49 a month.
Why is whistleblowing harder for multi-country employers?
Whistleblowing is harder for multi-country employers because the EU set a minimum standard and each of the 27 member states built its own law on top. Directive (EU) 2019/1937 fixes the core duties: a secure internal channel in every legal entity with 50 or more workers, an acknowledgement of each report within seven days, feedback within three months and protection against retaliation.
Almost everything else is left to national law. Each country decides whether protection extends to breaches of national law as well as EU law, whether anonymous reports must be accepted, which authority receives external reports, how long records are kept and how high the fines go. Several countries transposed the directive late, so many of these rules only took effect in 2023.
A group with entities in three countries therefore has three sets of rules, three external authorities and usually three languages to handle. Whistleblowers can also go straight to a national authority instead of using your channel, so a channel that is hard to find or does not feel safe sends reports outside the company.
Can a corporate group use one central whistleblowing channel?
A group can run a central channel, but it cannot rely on that channel alone. In two statements dated 2 and 29 June 2021, the European Commission said that each subsidiary must have its own distinct channel, and that whistleblowers may choose between the local and the central route.
The Commission’s reasoning is that the duty in Article 8(3) of the directive applies to each legal entity, not to the group as a whole, and that a parent company cannot count as an outsourced third party for its own subsidiaries. The rule then depends on the size of each legal entity:
Entity size | What the Commission's position means |
|---|---|
Fewer than 50 workers | No general duty to have a channel, unless sector rules or national law say otherwise |
50 to 249 workers | Must have a channel, but may share resources with other entities to receive and investigate reports, as long as the local channel stays available |
250 or more workers | Must have its own reporting system that works independently of any central system |
For entities with 50 to 249 workers, the Commission attached three conditions to using the parent company’s resources:
• The local channel stays open. The subsidiary’s own reporting channel must remain in place and available.
• The reporter is told and agrees. The whistleblower must be informed and consent before anyone at group level gets access to the report. A reporter who refuses can withdraw the report and go to the competent authority instead.
• Key duties stay local. Confidentiality, feedback to the whistleblower and any remedy or sanction remain the subsidiary’s responsibility.
How have national laws applied the Commission's position?
The Commission’s statements are not legally binding, and national laws took different lines:
• Spain lets the parent company approve a general policy for the whole group, and the internal reporting system can be a single system for all group companies (Article 11 of Ley 2/2023).
• Germany allows another group company to act as an independent third party that receives reports for its subsidiaries, according to the explanatory notes to the HinSchG. Each subsidiary remains responsible for fixing the breach.
• France allows companies in the same group to share a reporting procedure, but only after a matching decision by the competent body of each company. Some practitioners read the decree as limiting this to companies with fewer than 250 employees.
• Italy lets entities with up to 249 workers share an internal channel, including affiliated group companies, but gives no specific rules for multinational groups.
• Ireland is generally read as following the Commission, so a central group channel on its own is not enough.
What does that mean in practice?
In practice, use one platform and give each legal entity its own reporting page, case handlers and access rights. That design satisfies the strict reading and the flexible one, so you do not have to re-engineer it when a national rule changes or a regulator adopts the Commission’s view.
Group compliance still has a role. It can own the policy, train case handlers and support complex investigations, as long as a report reaches group level only with the reporter’s consent and the subsidiary keeps responsibility for feedback and follow-up.
How do EU whistleblowing laws differ by country?
EU whistleblowing laws differ mainly on five points: what can be reported, whether anonymous reports must be accepted, which authority takes external reports, how long records are kept and how high the fines go. Rules on group-wide channels and on involving employee representatives vary too.
Point | Germany | Spain | France | Italy |
|---|---|---|---|---|
Law | Hinweisgeberschutzgesetz (HinSchG) | Ley 2/2023 | Sapin II, amended by the Waserman Law | Legislative Decree 24/2023 |
Applies since | 2 July 2023 (17 December 2023 for 50 to 249 workers) | 13 March 2023 (channels due by 13 June 2023, or 1 December 2023 for 50 to 249 workers) | 1 September 2022 | 15 July 2023 (17 December 2023 for 50 to 249 workers) |
Scope beyond EU law | Criminal offences and certain administrative offences | Serious and very serious criminal and administrative offences | Crimes, offences and threats or harm to the general interest | For companies with a Model 231, relevant offences under Decree 231/2001 |
Anonymous reports | Should be processed; no duty to offer an anonymous channel | Must be accepted | Can be accepted; no general duty | Can be handled; protection applies if the reporter is later identified |
External authority | Federal Office of Justice, plus BaFin and the Federal Cartel Office in their areas | Independent Authority for Whistleblower Protection (AIPI) and regional authorities | Sector authorities listed by decree, or the Défenseur des droits | ANAC |
Record retention | 3 years after the case closes | No more than 10 years | Only as long as strictly necessary | No more than 5 years after the final outcome |
Group-wide channel | Another group company can act as a third party | One system for the group is allowed | Shared procedure with each company's agreement | Sharing allowed for entities up to 249 workers |
Employee representatives | Works council co-determination rights may apply | Consultation of workers' representatives | Consultation of the CSE | Consultation of trade unions |
Maximum fines | €50,000, or up to €500,000 for companies | €1,000,000 for companies | €15,000 and 1 year in prison for obstructing a report | €50,000 (ANAC administrative fines) |
Germany’s company fines reach €500,000 because the HinSchG applies the tenfold multiplier in section 30 of the Administrative Offences Act. In Italy, failures can also expose a company to liability under Decree 231/2001.
Check the current text of each law, or ask local counsel, before you finalise the setup. National rules are still being amended.
timestamped, logged
Apply the strictest national rule across the whole group. Trusty accepts anonymous written reports and disguised voice messages, with a two-way inbox for follow-up. Every report gets a qualified eIDAS timestamp and a tamper-proof audit log, and ready-made policies and employee training are included. Or book a demo.
What must a multi-country whistleblowing system do?
A multi-country whistleblowing system must keep entities separate, speak each local language and apply the strictest rule you face. Seven capabilities matter:
• Entity separation. Each legal entity has its own reporting page and case team, and handlers in one entity cannot see another entity’s cases.
• Local languages. The form, the policy and the feedback are available in the language of each workforce, with reviewed translations for legal terms.
• Written and oral reporting. The directive allows reports in writing or orally and requires an in-person meeting on request. Germany requires both written and oral options, so offer both everywhere.
• Anonymous reporting with follow-up. Spain requires you to accept anonymous reports, so support them everywhere and keep a way to reply without revealing the reporter.
• Deadline tracking. Every report needs an acknowledgement within seven days and feedback within three months, in every entity.
• Local information. Each reporting page names the right national authority for external reports.
• One audit trail. Group compliance can see that deadlines are met in every entity without opening individual cases.
Retention needs planning too, because the limits range from three years in Germany to up to ten in Spain. Set a deletion schedule per entity in your policy.
Data location matters as well. Reports often contain sensitive personal data, so hosting them inside the EU or EEA avoids international data transfer questions under the GDPR for every entity.
How do you roll out one whistleblowing system across several countries?
You roll out one whistleblowing system across several countries in seven steps, starting with a map of your legal entities and ending with a yearly review.
1. Map your entities. List every EU legal entity, its country and its headcount, and mark those with 50 or more workers. Count per legal entity, not per group, and check sector rules, because entities in areas such as financial services are covered whatever their size.
2. Set the baseline. Take the strictest requirement on each point and apply it group-wide. For example, accept anonymous reports everywhere because Spain requires it, and offer oral reporting because Germany requires it.
3. Write one core policy with country annexes. Keep the process identical and put the local scope, authority and retention period in a short annex for each country.
4. Appoint case handlers per entity. Name an impartial person or team for each entity, free of conflicts of interest and with time to meet the deadlines. Decide which entities with 50 to 249 workers will share resources.
5. Consult employee representatives. Involve works councils, the CSE or trade unions where national law requires it, before go-live.
6. Configure and translate the channel. Create a reporting page for each entity in its local language, with the right authority details.
7. Train, launch and review. Tell every workforce how to report, train case handlers, then check deadlines and case volumes each year.
Most of the time goes into steps 4 and 5. With the right software, the technical setup in step 6 takes minutes.
Which whistleblowing system works for multi-country employers?
Trusty is whistleblowing software built around the EU Whistleblowing Directive, and it handles several entities and languages on one platform. An internal channel is ready in less than five minutes.
Multi-country need | How Trusty covers it |
|---|---|
A distinct channel for each legal entity | Entity separation and role-based access are built into the platform |
Local languages | Reporting form and interface in several languages |
Anonymous reports with follow-up | Two-way anonymous inbox opened with an access code |
Oral reporting without a call centre | In-browser voice messages with voice disguising; a phone hotline can be added |
Evidence for every authority | Qualified eIDAS timestamp on each report and a tamper-proof audit log |
EU data residency | Hosting in ISO/IEC 27001 certified data centres in Germany |
Faster rollout | Ready-made compliance policies and employee training included |
Try Trusty free for 7 days at trusty.report, or book a short demo to see a multi-entity setup.
Frequently asked questions about multi-country whistleblowing
Yes. One platform can serve a whole group, provided each legal entity with 50 or more workers has its own reporting channel within it and the process meets each country's national law.
Yes, if it has 50 or more workers. The European Commission's position is that each such subsidiary needs a distinct channel. Subsidiaries with 50 to 249 workers may share resources to receive and investigate reports, but their own channel must stay available.
It is counted per legal entity. A group with 300 workers spread across entities of fewer than 50 each may have no general duty, while a single entity with 50 workers does. Sector rules can apply below that threshold, for example in financial services.
Yes. An EU legal entity with 50 or more workers must comply with the law of its country, wherever the parent company is headquartered.
Under the directive, each entity must acknowledge a report within seven days and give the whistleblower feedback within three months of the acknowledgement. These deadlines apply in every country, whatever the group structure.
It depends on the point. Spain is strictest on anonymity and fines, with mandatory acceptance of anonymous reports and fines of up to €1,000,000 for companies. France has one of the widest scopes, and Germany requires both written and oral reporting options.
The directive requires clear and easily accessible information, so offer the channel and policy in a language each workforce understands. In practice that means the local language of every country where you have an entity.
It can help, but the subsidiary's own channel must stay available. According to the Commission, the reporter should be told and agree before the report is passed to group level. If they refuse, they can withdraw the report and go to the competent authority.
Sources
• Directive (EU) 2019/1937, EUR-Lex
• Hinweisgeberschutzgesetz (HinSchG), German Federal Ministry of Justice
• Ley 2/2023, Boletín Oficial del Estado
• What the Whistleblowing Directive means for reporting channels in corporate groups, Osborne Clarke
• Group-wide whistleblowing system: not enough for the EU Commission, Oppenhoff
• Pas de lanceur d’alerte dans les groupes, KPMG Avocats
• Whistleblower protection and reporting channels in Italy, CMS
• Key provisions of the new whistleblowing regime, Matheson
• Trusty, product information
This article is general information, not legal advice.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.