Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
External whistleblowing means reporting a breach to a competent national authority rather than, or after, using the internal channel of an organization. Directive (EU) 2019/1937 obliges every Member State to designate such authorities and sets rules for how they work. This guide explains those rules and gives examples from several countries.
What is external whistleblowing?
Under the EU Whistleblowing Directive, reporting persons may report breaches to a competent authority after an internal report or directly (Article 10). They do not have to use the internal channel first. Member States must still encourage internal reporting where the breach can be addressed effectively inside the organization and there is no risk of retaliation (Article 7(2)).
What must national reporting authorities do?
Each Member State designates the authorities competent to receive reports, give feedback and follow up, and must give them adequate resources (Article 11(1)). These authorities must:
- establish independent and autonomous external reporting channels;
- acknowledge receipt within seven days, unless the reporting person asked otherwise or this would endanger their identity;
- follow up diligently on the reports;
- give feedback within a reasonable timeframe of no more than three months, or six months in duly justified cases;
- communicate the final outcome of investigations to the reporting person;
- pass information on to EU institutions, bodies or agencies where provided for (Article 11(2)).
An authority that receives a report outside its competence must forward it securely to the competent authority and inform the reporting person (Article 11(6)).
Can an authority close a report?
Yes, in limited cases. Member States may allow authorities to close a procedure where the breach is clearly minor (Article 11(3)). They may also close repetitive reports without meaningful new information (Article 11(4)). In both cases, the reporting person must be told the decision and the reasons. In the event of high inflows, authorities may prioritize serious breaches (Article 11(5)).
How must external reporting channels be designed?
An external channel counts as independent and autonomous only if it ensures the completeness, integrity and confidentiality of the information and blocks access by unauthorized staff (Article 12(1)). It must also allow durable storage of information for further investigations.
Reports must be possible in writing and orally (Article 12(2)). Oral reporting works by telephone or voice messaging and, on request, in a physical meeting within a reasonable timeframe.
What information must authorities publish?
Each authority must publish a separate, easily identifiable section on its website (Article 13). It includes at least the conditions for protection, the contact details of the external channels and the procedures for reporting. It also explains the confidentiality regime and how personal data is processed. Authorities must review their procedures at least once every three years (Article 14).
External reporting authorities: examples by country
Member States organize external whistleblowing differently. Some use one central authority, others several sector authorities:
- Germany: the federal external reporting office is part of the Federal Office of Justice (Bundesamt für Justiz, Section 19 HinSchG). The Federal Financial Supervisory Authority (BaFin) and the Federal Cartel Office are competent for their areas (Sections 21 and 22). Each federal state may set up its own office for reports concerning its administration (Section 20).
- France: reporting persons can contact the competent authorities designated by decree, the judicial authority or the Défenseur des droits, who directs them to the authority best placed to deal with the case (Article 8 of Loi Sapin II).
- Italy: the National Anti-Corruption Authority (ANAC) runs the external channel and confirms receipt within seven days (Articles 7 and 8 of Legislative Decree No. 24/2023).
- Spain: the Independent Authority for Whistleblower Protection (A.A.I.) or the competent regional authorities receive external reports (Article 16 of Law 2/2023). The A.A.I. manages the external channel, adopts protection measures and handles sanction procedures (Article 43).
- Portugal: reports go to the authority competent for the matter, such as the Public Prosecutor’s Office, criminal police bodies or Banco de Portugal (Article 12 of Law No. 93/2021). If no authority is competent, the National Anti-Corruption Mechanism (MENAC) receives the report.
- Ireland: the Protected Disclosures (Amendment) Act 2022 established the Office of the Protected Disclosures Commissioner, held by the Ombudsman (section 10A). The Commissioner operates external reporting channels (section 10B).
What does external whistleblowing mean for your company?
Your company must give clear, easily accessible information on external reporting to the competent authorities (Article 9(1)(g)). At the same time, a fast and trusted internal channel makes it more likely that employees report internally first. Our whistleblowing channel guide explains the requirements, and our practical guide on how to report whistleblowing to an authority describes the process step by step.
Why companies should know the external authorities
Knowing the external reporting authorities helps your company in two ways. First, your policy must point employees to them (Article 9(1)(g)). Second, understanding their deadlines and procedures shows what your internal channel must match. If the internal route is slower or less secure than external whistleblowing, employees are more likely to choose the authority instead.
For multinational groups, the picture is more complex. Each subsidiary must inform its employees about the authorities of its own country. A central policy with a country annex is a practical way to keep this information current.
Conclusion
External whistleblowing gives reporting persons a direct route to national authorities. Each Member State has designated its own authorities, with common EU rules on deadlines, confidentiality and transparency. With whistleblowing software from Trusty, your organization runs a secure, confidential channel without an IT project, from 49 EUR per month.
Related reading: How to report whistleblowing to an authority and Whistleblower protection under EU law.
Frequently asked questions
Reporting a breach to a competent national authority instead of, or after, the internal channel of an organization (Article 10 of Directive (EU) 2019/1937).
No. Reporting persons may report externally directly. Member States must, however, encourage internal reporting where the breach can be handled effectively inside the organization (Article 7(2)).
It must acknowledge receipt within seven days and give feedback within three months, or six months in duly justified cases (Article 11(2)).
It depends on the country and the subject. Examples are the Federal Office of Justice in Germany, ANAC in Italy, the A.A.I. in Spain and the Protected Disclosures Commissioner in Ireland.
FROM 49 EUR PER MONTH
Trusty Whistleblowing: a reporting channel compliant with the EU Whistleblower Directive, live in minutes with no IT project. From 49 EUR per month, 7-day free trial.