Legal obligationWhistleblowing Channel for Companies

Who is obliged

Law 2/2023 on the protection of whistleblowers requires an Internal Reporting System for companies with 50 or more employees, for political parties, trade unions and foundations receiving public funds, and for certain entities regardless of their headcount, such as those subject to anti-money laundering regulations.

It is not a best-practice recommendation. It is an obligation whose breach is penalised, and the fines for legal entities reach one million euros for very serious infringements.

What almost nobody gets right

Many companies believe they comply because they have contracted a web form. They do not. The law requires considerably more:

• A system manager formally appointed, with autonomy and independence.
• A management procedure in writing and approved by the governing body.
• Acknowledgement of receipt within 7 days and a response within a maximum of 3 months.
• The possibility of submitting the report anonymously, and a guarantee of confidentiality of the whistleblower’s identity.
• A register of the reports received.
• And above all: an absolute prohibition of retaliation against the person reporting, which extends to those around them.

The real risk lies in the management, not in the channel

The danger for the company is not having no channel. It is having one and managing it badly.

A poorly handled internal report, or a whistleblower against whom any unfavourable decision is later taken, turns a small problem into two big ones: the original infringement and the retaliation, which is presumed when the harm occurs within the following two years.

And there is something many executives do not see coming: every internal report is also a warning. It is the last opportunity to learn of a problem and correct it before it reaches the Public Prosecutor or the Inspectorate. Wasting it is the most expensive mistake.

What we do

We design and implement the complete system, not just the form: policy, procedure, appointment of the manager, register and training. And, if you wish, we take on the external management of the channel and the handling of the reports received, which provides the independence the law requires and which someone on the company’s own staff can hardly have.

When the report has substance, we launch an internal investigation with full safeguards.

Related: criminal compliance and criminal liability of legal entities.

The penalties, and who pays them

Non-compliance is not theoretical. The law classifies infringements as minor, serious and very serious, and the fines for legal entities reach one million euros for very serious ones. And it is not only the company that is liable: the responsible individuals may also be penalised.

Among the most serious conducts are taking retaliation against the whistleblower, breaching the duty of confidentiality of their identity, and not having an internal system when obliged to.

Added to this is an effect that worries boards more: the absence or ineffectiveness of the channel weakens the compliance programme, and with it the possibility of the company being exempted from criminal liability in future proceedings. The channel is not an administrative formality: it is a piece of the defence.

Retaliation: the concept that must be properly understood

This is where most companies err in good faith. Retaliation is not only dismissal. It is any act or omission that involves unfavourable treatment and places the whistleblower at a disadvantage: not renewing their contract, changing their duties, excluding them from a promotion, changing their working hours, withdrawing a bonus, isolating them, giving them a worse appraisal.

And there is a rule that changes the game: if the harm occurs within two years of the report, it is presumed to be retaliation, and it is the company that must prove the decision was based on legitimate grounds unrelated to the report.

That does not make the whistleblower untouchable. It means that every decision affecting them must be documented and justified in writing on objective criteria, and that the company must be able to prove it. Without that documentation, the presumption wins.

The protection also extends to those around them: colleagues who helped them, workers’ representatives, and legal entities linked to them.

What we do when a report comes in

The critical moment is not installing the channel: it is the day the first substantive report arrives. That is when it is decided whether the company manages the problem or the problem manages the company.

• Admissibility analysis and acknowledgement of receipt within the deadline.
• Immediate containment measures if the risk is still live, and effective protection of the whistleblower from day one.
• Internal investigation with full safeguards, entrusted to an independent third party so that its outcome is credible before the authorities.
• Informed decision: correct, sanction, report or defend. With the facts in front of you, not suspicions.
• Documented closure and a response to the whistleblower within the legal deadline.

Managing an internal report well is almost always far cheaper than managing its consequences badly.

Frequently asked questions

We have 60 employees but have never had any problems. Is it really mandatory? Yes, from 50 employees. It does not depend on whether there have been incidents, and its absence is penalised in itself.

We have put a form on the intranet. Do we comply? No. The law requires an appointed manager with autonomy, a procedure approved by the governing body, acknowledgement of receipt within 7 days, a response within 3 months, the possibility of anonymity and a register. The form is the small part.

Can I find out who made the report? No. The confidentiality of the whistleblower’s identity is an essential obligation, and breaching it is a very serious infringement.

The whistleblower is underperforming and I want to dismiss them. Be careful: any harm within the following two years is presumed to be retaliation, and the burden of proving otherwise falls on the company. It does not mean they are untouchable, but it does mean every decision must be documented and justified on grounds unrelated to the report.

Can an external law firm manage it? Yes, and it provides the independence that someone on the company’s own staff can hardly have.