Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
On 26 November 2025, ANAC, Italy’s National Anti-Corruption Authority, approved its first guidelines dedicated to internal reporting channels (Linee Guida n. 1/2025, Delibera n. 478). They explain how ANAC expects entities covered by Legislative Decree 24/2023 to run their internal channels. The main points: ordinary email and certified email (PEC) are not adequate on their own, encrypted platforms are preferred, the person who handles reports must be autonomous and trained, and training must reach all staff. Companies with an existing channel do not have to start again, but they should check it against the new guidelines.
This article covers who must have a channel, what the guidelines say, what changed and a checklist for your review. For background on how Italy implemented the EU Directive, read our interview on the Whistleblowing Directive in Italy.
ANAC's checks
An internal channel that is not built on email. Trusty Whistleblowing supports Legislative Decree 24/2023 with encrypted connections, an anonymous two-way inbox and automatic tracking of the 7-day and 3-month deadlines.
Who must have an internal channel in Italy
Legislative Decree 24/2023 of 10 March 2023 implements the EU Whistleblowing Directive. In the private sector, an internal reporting channel is required for:
- entities that employed an average of at least 50 workers in the last year;
- entities in the sectors covered by the EU acts listed in Parts I.B and II of the Annex, such as financial services and anti-money laundering, even with fewer than 50 workers;
- entities that have adopted an organisation and management model under Legislative Decree 231/2001 (a “231 model”), even with fewer than 50 workers.
The rules took effect on 15 July 2023. Private entities with an average of up to 249 employees had until 17 December 2023 to set up their internal channel, and they may share a channel and its management. The consolidated text in force from 24 January 2026 also covers reports of breaches of EU restrictive measures (sanctions).
What ANAC's guidelines say about internal channels
The decree sets the framework. Reports can be made in writing, including through IT tools, or orally, by phone line or voice messaging, and in a face-to-face meeting at the reporter’s request. Management must be given to an autonomous, dedicated internal person or office with specifically trained staff, or to an external party. Workers’ representatives must be consulted before the channel is activated. The reporter receives an acknowledgement within seven days and feedback within three months of the acknowledgement.
ANAC’s Linee Guida n. 1/2025 add practical detail:
- Email is not enough on its own. Ordinary email and PEC are considered in themselves not adequate to protect confidentiality, because mail systems generate logs. They can only be used with specific, justified countermeasures identified in the data protection impact assessment (DPIA).
- Platforms with encryption. ANAC prefers IT platforms that encrypt data at rest and give the reporter a unique code to follow up the report.
- Oral reports. Calls and voice messages may be recorded only with the reporter’s consent. Otherwise, a detailed note is made. Minutes of an unrecorded meeting must also be signed by the reporter.
- The report handler (gestore). Internal or external, the handler must be autonomous, impartial, independent and specifically trained. A substitute must be named in advance for conflicts of interest. The data protection officer should generally not be the handler, although entities with fewer than 50 employees may combine the roles with justification.
- Anonymous reports. Even anonymous reports must be registered and their documentation kept.
- Training. The handler needs specific training with periodic updates, and staff training must involve all personnel.
- Union consultation. Consulting workers’ representatives is informative only, and the deadline given to them is not binding.
- Shared channels. Private entities with up to 249 employees that share a channel need a contract and become joint controllers of the data.
What changed and when
Until late 2025, ANAC’s main guidance was Delibera n. 311 of 12 July 2023, which focused on the external channel. Two decisions of 26 November 2025, published in the Official Journal on 29 December 2025, changed the picture:
- Delibera n. 478 approved the guidelines on internal channels, after a public consultation launched on 7 November 2024, taking account of the opinion of the Garante, Italy’s data protection authority.
- Delibera n. 479 amended the 2023 guidelines, including the sections on internal channels, ANAC’s external channel and reporter confidentiality.
We found no separate compliance deadline in the new guidelines. For existing channels, ANAC says it is enough to check that they are adequate against the new guidelines. Its supervision plan for 2026 states that it will check how public and private entities have adapted, and names missing channels and procedures and breaches of confidentiality as common problems.
If your channel still relies on email, our comparison of whistleblowing software, email and hotlines sets out the options.
by design
Keep the reporter’s identity with the people who need it. Reporters can stay anonymous and follow up through a secure inbox, with no IP addresses stored and a full audit log of every action.
ANAC's role: the external channel and sanctions
ANAC runs the external reporting channel and can impose administrative fines under Article 21 of the decree:
Breach | Fine |
|---|---|
Retaliation, obstructing or attempting to obstruct a report, or breaching confidentiality | €10,000 to €50,000 |
No reporting channels, no procedures, procedures that do not comply with Articles 4 and 5, or reports not verified and analysed | €10,000 to €50,000 |
Reporter held liable for defamation or slander through wilful misconduct or gross negligence | €500 to €2,500 |
Under ANAC’s sanctions regulation, fines for missing or non-compliant channels are imposed on the governing body, jointly with its members, and fines for failing to verify reports on the handler. ANAC uses these powers: in a decision of 9 September 2026 it fined each member of a private company’s report-handling body €15,000 for breaching the reporter’s confidentiality. It stated that the breach exists whether or not third parties actually identified the reporter.
Checklist: what to review in your channel now
- Confirm whether you are in scope: headcount, sector and whether you have a 231 model.
- Replace email or PEC channels, or record justified countermeasures in your DPIA.
- Check that your platform encrypts data at rest and gives reporters a follow-up code.
- Offer written and oral reporting and a meeting on request, with consent-based recording.
- Appoint an autonomous, trained handler and a substitute for conflicts of interest, and check whether your DPO also holds the role.
- Track the 7-day acknowledgement and 3-month feedback deadlines.
- Register anonymous reports and keep their documentation.
- Keep records for no more than five years from the final outcome.
- Update your whistleblowing DPIA, which Article 13(6) of the decree requires.
- Train the handler and all staff, and refresh the training periodically.
- If you run channels in several countries, align them: see whistleblowing for multi-country employers.
How Trusty Whistleblowing helps
Trusty Whistleblowing gives Italian companies an internal channel that does not depend on email. Reporters can stay anonymous and follow up through a secure two-way inbox. Written reporting is included on every plan, the Advanced plan adds browser-based voice reporting with voice distortion, and reporters can request a meeting through the inbox. Acknowledgements are automatic and the 7-day and 3-month deadlines are tracked.
Data is hosted in an ISO 27001 certified data centre in Germany, connections are encrypted and a data processing agreement is available for every customer. Every plan also includes 30 days of the Compliance App, with online whistleblowing training for employees.
Looking for whistleblowing software for Italy? Trusty sets up an internal reporting channel from €49 a month.
This article is general information, not legal advice. Sources: Legislative Decree 24/2023; Legislative Decree 24/2023, consolidated text (Normattiva); ANAC, Delibera n. 478/2025 and Linee Guida n. 1/2025; ANAC, Delibera n. 479/2025; ANAC, Delibera n. 311/2023; ANAC, whistleblowing; ANAC news, 6 October 2026.
Frequently asked questions
They are guidance from Italy's National Anti-Corruption Authority on applying Legislative Decree 24/2023. Delibera n. 311/2023, amended in November 2025, covers the external channel. Linee Guida n. 1/2025, approved by Delibera n. 478 of 26 November 2025, cover internal channels.
Private entities with an average of 50 or more workers in the last year, entities in the sectors listed in Parts I.B and II of the Annex regardless of size, and entities that have adopted a 231 model regardless of size.
Not on its own. ANAC considers ordinary email and PEC in themselves not adequate to protect confidentiality, unless specific, justified countermeasures are identified in the DPIA.
€10,000 to €50,000 for retaliation, obstruction, breaches of confidentiality, missing or non-compliant channels and failure to verify reports. A reporter held liable for defamation or slander can be fined €500 to €2,500.
The duty comes from the decree: Article 13(6) requires entities to define their reporting model on the basis of a DPIA. ANAC's guidelines refer to the DPIA document and say the controller can rely on the provider's support.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.