Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Yes. Under Law 2/2023, every private employer with 50 or more workers must have an internal reporting system, and so must every public sector entity. Some private entities must have one regardless of size, including those within the scope of EU rules on financial services, money laundering, transport safety and the environment, and political parties, trade unions and employers’ organisations that receive public funds. The system must accept written or oral reports, allow anonymous reports and have a designated system manager, the Responsable del Sistema. Failing to have one when required can be a very serious infringement, with fines of up to €1 million for companies.
This guide covers who must comply, what the channel must do and who enforces the law. For an overview of the law itself, see our article on Law 2/2023: Protection of Whistleblowers.
Ley 2/2023
A compliant internal channel without building one yourself. Trusty Whistleblowing supports Law 2/2023 with anonymous reporting, a two-way inbox and automatic tracking of the 7-day and 3-month deadlines.
Short answer: who must have a channel
- Private sector: individuals and companies with 50 or more workers (Article 10.1.a).
- Specific sectors and organisations: regardless of headcount (Articles 10.1.b and 10.1.c).
- Public sector: all entities that make up the public sector (Article 13).
The deadlines have passed. Most obliged entities had until 13 June 2023. Private entities with up to 249 workers and municipalities with fewer than 10,000 inhabitants had until 1 December 2023. Entities that are not obliged may set up a system voluntarily.
Companies that must comply regardless of headcount
Article 10.1.b covers private entities within the scope of the EU acts listed in Parts I.B and II of the Annex to the Whistleblowing Directive, Directive (EU) 2019/1937. These cover:
- financial services, products and markets;
- prevention of money laundering and terrorist financing;
- transport safety;
- protection of the environment.
Article 10.1.c adds political parties, trade unions, employers’ organisations and the foundations they create, where they receive or manage public funds.
If you are unsure whether your activity falls under one of these EU acts, take advice. In a group, each company must assess whether it is itself obliged, as the AAI’s Recommendation 1/2026 points out.
What the channel must do
- Written, oral or both. Reports can be made in writing, verbally or both. At the reporter’s request, a face-to-face meeting must be held within seven days (Article 7.2).
- Anonymous reports. Internal channels must allow anonymous reports to be submitted and followed up (Article 7.3).
- Confidentiality. The system must protect the identity of the reporter and of any third party mentioned in a report.
- Responsable del Sistema. The governing body appoints the person responsible for the system, who in the private sector should be a senior executive. The appointment and any dismissal must be notified to the AAI, or the competent regional authority, within ten working days (Article 8.3).
- Deadlines. Acknowledge receipt within seven calendar days (Article 9.2.c). Reply within a maximum of three months from receipt, extendable by up to three more months in especially complex cases (Article 9.2.d).
- Rights of the person concerned. They have the right to be informed of the acts or omissions attributed to them (Article 9.2.f).
- Record-keeping. Keep a register (libro-registro) of the reports received. Data may never be kept for more than ten years (Article 26). Data must be deleted from the system three months after receipt if no investigation has started, unless it is kept to show how the system works (Article 32.4).
- Consultation. The governing body implements the system after consulting the workers’ legal representatives (Article 5).
Our whistleblower channel protocol and our guide to what types of complaints can be filed cover the procedure in more detail.
tracked for you
Keep the 7-day and 3-month deadlines in view. Trusty sends automatic acknowledgements, tracks every deadline and keeps tamper-proof case records, with configurable retention periods and deletion reminders.
Groups of companies and shared channels
- Groups. The parent company approves a general policy on the internal reporting system, and the group may have a single system and one Responsable del Sistema (Article 11).
- Shared resources. Companies with 50 to 249 workers may share the system and its resources if they choose (Article 12).
- Outsourcing. Management of the system, including receiving reports, may be entrusted to an external third party. Responsibility stays with the obliged entity (Article 6).
- Public sector. Municipalities with fewer than 10,000 inhabitants may share resources (Article 14). Public entities may outsource management only where they show that their own resources are insufficient (Article 15).
Fines
Law 2/2023 classifies infringements as very serious, serious or minor. Failing to have an internal reporting system as the law requires can be a very serious infringement. For very serious infringements, fines range from €600,001 to €1,000,000 for legal entities and from €30,001 to €300,000 for individuals. Serious and minor infringements carry lower fines.
Very serious infringements can also lead to accessory measures: a public reprimand, a ban on receiving public subsidies or entering into public contracts, and, for legal entities, publication of the sanction in the Official State Gazette (BOE).
Who enforces: the AAI and regional authorities
The Independent Authority for Whistleblower Protection (Autoridad Independiente de Protección del Informante, A.A.I.) is the national authority. Its statute was approved by Royal Decree 1101/2024 of 29 October. Manuel Villoria Mendieta was appointed its president in April 2025, and the authority started operating on 1 September 2025.
As of October 2026, the AAI runs an external channel that accepts reports, including anonymous ones. It opened its electronic office for Responsable del Sistema notifications in February 2026 and has issued recommendations, including Recommendation 1/2026 on internal reporting systems. The private sector falls under its remit. Its news page lists no sanctions so far.
Several autonomous communities have their own authorities, such as Catalonia’s Oficina Antifrau, the Agència Valenciana Antifrau, whose remit is limited to the public sector, and the Andalusian Office against Fraud and Corruption. In September 2026 the AAI met regional authorities from nine communities to coordinate their work. Read more about the Independent Whistleblower Protection Authority.
How Trusty Whistleblowing helps
Trusty Whistleblowing supports Law 2/2023 with a reporting channel that accepts anonymous or identified reports, as the organisation chooses, and lets anonymous reporters continue the dialogue through a secure inbox. Reporters can request a meeting through the inbox, and the Advanced plan adds browser-based voice reporting. Acknowledgements are automatic, the 7-day and 3-month deadlines are tracked, and case records are tamper-proof.
Retention periods are configurable with deletion reminders, data is hosted in an ISO 27001 certified data centre in Germany, and a data processing agreement is available for every customer.
Looking for a canal de denuncias for your company? Trusty sets up an internal reporting channel from €49 a month.
This article is general information, not legal advice. Sources: Ley 2/2023, de 20 de febrero (BOE); AEPD, Informe 0060/2023; Agència Valenciana Antifrau, 88 preguntas y respuestas; Real Decreto 1101/2024; Real Decreto 328/2025; Orden PJC/908/2025; Autoridad Independiente de Protección del Informante; AAI news, 22 September 2026.
Frequently asked questions
Yes, for private employers with 50 or more workers, for all public sector entities and for certain entities regardless of size, such as those within the scope of EU rules on financial services, money laundering, transport safety and the environment.
Not in general. It does if it falls under the sector rule in Article 10.1.b, or if it is a political party, trade union, employers' organisation or related foundation that receives or manages public funds. Smaller companies may also set up a channel voluntarily.
Yes. Article 6 allows management of the system, including receiving reports, to be entrusted to an external third party. The company remains responsible for compliance.
Yes. Article 7.3 requires internal channels to allow anonymous reports to be submitted and followed up.
Failing to have a required internal reporting system can be a very serious infringement, with fines of €600,001 to €1,000,000 for legal entities and €30,001 to €300,000 for individuals, plus possible accessory measures.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.