Mandatory Whistleblower Channel in Spain (Law 2/2023): Company Guide
In this article
Key Takeaways
- Mandatory since 2023
- Fines of up to 1,000,000 euros
- A requirement of criminal compliance
- Allows anonymous reports
Law 2/2023 on the protection of whistleblowers, which transposes EU Directive 2019/1937, obliges every company with 50 or more employees to have a confidential internal whistleblower channel that allows anonymous reports, with acknowledgement of receipt within 7 days, an investigation deadline of 3 months and retention of the information for at least 10 years. Non-compliance can carry fines of up to 1,000,000 euros for legal persons. The channel is also an essential requirement of criminal compliance (Art. 31 bis CP) for the legal person to be exempt from criminal liability.
Need help with your case? Talk to a criminal defense lawyer at Alonso Sala.
Law 2/2023 on the protection of whistleblowers has radically changed the compliance obligations of Spanish companies. If your company has 50 or more employees, it is obliged to have an operative internal whistleblower channel compliant with the regulations. Non-compliance can carry fines of up to 1,000,000 euros. As criminal lawyers, we explain the obligations.
What Is an Internal Whistleblower Channel?
A whistleblower channel is a secure, confidential system that allows employees, executives, suppliers and others connected with the company to report possible legal or regulatory breaches without fear of retaliation. Law 2/2023 transposes EU Directive 2019/1937. It is not a mere formality: it is a fundamental instrument of the criminal compliance programme that can determine whether your company is exempt from criminal liability.
Who Is Obliged?
Private companies: all with 50 or more employees, regardless of sector. Public sector: all public entities, political parties, trade unions and foundations receiving public funds. Anti-money-laundering obliged parties: companies subject to AML rules (Law 10/2010) regardless of size — lawyers, auditors, estate agents, car dealers, jewellers.
Legal Requirements of the Channel
- Confidentiality: the identity of the whistleblower and the person investigated must be confidential.
- Anonymity: the channel must allow anonymous communications and process them like the rest.
- System officer: an independent officer responsible for management must be designated.
- Acknowledgement of receipt: within a maximum of 7 calendar days.
- Investigation deadline: a maximum of 3 months from acknowledgement.
- Record: retention of the information for a minimum of 10 years.
- Prohibition of retaliation: any retaliation against the whistleblower is null and sanctionable.
⚠️ Penalties for non-compliance
Very serious infringement: a fine of up to 1,000,000 euros (legal persons) or 300,000 euros (individuals). Retaliation against whistleblowers is also a very serious infringement.
Connection With Criminal Compliance (Art. 31 bis CP)
Criminal compliance is the crime-prevention programme that allows the legal person to be exempt from criminal liability (Art. 31 bis.2 CP). One of the essential requirements of compliance is, precisely, having a whistleblower channel. Without it, the compliance programme does not meet the minimum standards of Art. 31 bis CP.
How to Implement the Channel: Step by Step
- Compliance audit: analysing the company's current situation and risks.
- Platform selection: choosing a technology platform meeting the confidentiality and anonymity requirements.
- Designation of the officer: appointing the person or body responsible.
- Investigation protocol: developing the receipt, investigation and resolution procedures.
- Training and communication: informing the whole organisation about the channel.
Need to implement the whistleblower channel?
We help you comply with Law 2/2023, from the initial audit to the full implementation of the channel.
📞 Call us: +34 91 078 65 74
Frequently asked questions
Which companies are required to have a whistleblower channel?
All private companies with 50 or more employees, the entire public sector, political parties, trade unions and organisations receiving public funds, and the parties obliged under anti-money-laundering rules (Law 10/2010) regardless of size, such as lawyers, auditors or estate agents.
What legal requirements must the whistleblower channel meet?
Confidentiality of the whistleblower's and the investigated person's identity, the possibility of anonymous reports, an independent system officer, acknowledgement of receipt within a maximum of 7 calendar days, an investigation deadline of 3 months, retention of the information for at least 10 years, and a prohibition on retaliation.
What penalties apply for failing to implement the channel?
Very serious infringements can carry fines of up to 1,000,000 euros for legal persons or 300,000 euros for individuals. Retaliation against whistleblowers is also a very serious infringement.
How does the channel relate to criminal compliance?
It is an essential requirement. Criminal compliance (Art. 31 bis CP) allows the legal person to be exempt from criminal liability, and one of its minimum elements is having a whistleblower channel. Without it, the compliance programme does not meet the standards of Art. 31 bis CP.
Can the management of the channel be outsourced?
Yes. Companies with 50 to 249 employees can share the channel with other companies in their group or sector and outsource its management to an independent third party. Companies with 250 or more employees must have their own channel, although they may outsource the technical management.
Do you need criminal defense in this area?
We are criminal defense lawyers specializing in defense against internal channel complaints. We act urgently to protect your rights.