Whistleblowing

Whistleblower policy provisions will affect how a company can investigate the concern. The company's whistleblower policy must include information about how it will investigate concerns.

However, generally speaking, a company or organisation may report information to external authorities, such as ASIC, APRA, the Australian Federal Police or to a lawyer to seek advice about whistleblower protections.

HSchG does not impose such an obligation. However, reporting may be required based on other regulations, for example, in cases of suspected money laundering or terrorist financing.

If the investigation of a report leads to the uncovering of severe legal breaches or crimes, there could be a duty for the employer or company to inform the authorities, but this will depend on each case.

No, there is no obligation for the employer to inform external authorities about the reports.

Yes, under the WBP Act it is the duty of WBP officer and deputy to:

• forward the report to competent authorities for further processing if the irregularity has not been resolved in cooperation with the company; and
• notify in writing the authority competent for external reporting on the report and the outcome of the actions undertaken within 30 days after a decision on the report is made.

There is no statutory requirement to inform the external authorities. This also applies if the Whistleblowing Act does not cover the matter reported by the whistleblower.

French law does not require an employer to inform external authorities about the reports.

However, this obligation does exist in certain situations. For example:

• in the public sector, a constituted authority, public official or civil servant who, in the performance of his or her duties, becomes aware of a crime or misdemeanour must report it without delay to the General Prosecutor and must provide all relevant information, minutes and documents relating to the offence (article 40, paragraph 2 of the Criminal Procedure Code); and
• regarding money laundering, insurers, mutual health insurance companies or credit institutions are required under certain conditions to report to the Tracfin Agency the amounts entered in their books or transactions involving money that they know, suspect or have good reason to suspect come from an offence or are linked with terrorist financing (article L. 561-15 of the Monetary and Financial Code).

In any case, it is highly recommended for the employer, when appropriate, to inform competent authorities if they about punishable facts through the whistleblowing channel. Indeed, silence from the employer would increase the risk of collusion or damages to the image and reputation of the Company.

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG).

There is no blanket requirement for an employer to inform external authorities upon receipt of disclosure from a whistleblower. However, depending on the nature of the disclosure, its gravity and impact, employers may be required to report the same to certain authorities, including but not limited to the Securities Exchange Board of India, RBI or relevant stock exchanges (in the case of listed companies) or even the Serious Fraud Investigation Office.

Section 19 of the Criminal Justice Act 2011 establishes that a person/corporate entity will be guilty of an offence:

• if they have information; and
• they know or believe that information will or might be of material assistance in preventing the commission of a relevant offence or securing the apprehension, prosecution or conviction of any other person for a relevant offence; and
• they fail without a reasonable excuse to disclose that information as soon as it is practicable to do so to An Garda Síochána (the Irish police force).

The “relevant offences” are set out in the schedule to the 2011 Act and are wide-ranging. These are arrestable offences and include: breaches of company law, competition law, banking, investment funds and other financial activities, theft and fraud, bribery and corruption, criminal damage to property and consumer protection. The range of offences covered can be amended by ministerial order.

The obligation to make a notification under section 19 applies to any person, including corporate entities as well as natural persons. If an offence is committed by a corporate entity and it can be proven that this was done with the consent or connivance of any officer (such a director) or was as a result of the officers wilful neglect, that person will also be guilty of an offence and will be prosecuted and penalised as if they had committed the offence themselves.

The maximum penalty for failing to report an offence is an unlimited fine and imprisonment for up to 5 years, or both.

A person is under a mandatory statutory obligation to make a report under the 2011 Act as soon as it is practicable to do so.

Persons/corporate entities will be guilty of an offence under the 2011 Act if they fail to report a relevant offence without ‘reasonable excuse’.

A reasonable excuse is also not defined under the 2011 Act, and would likely be dependent on the circumstances of the case. For example, when a person may themselves be involved or implicated in the offence and reporting might compel them to incriminate themselves, this would be a reasonable excuse. The Courts have held that a reasonable excuse may exist when there is some “physical or practical” difficulty in reporting the crime or if the information has already been disclosed.

Legislative Decree No. 24/2023 does not impose any particular obligation on the employer to send reports to other competent bodies.

If necessary, the business operator must report to the relevant administrative agencies when its investigation reveals that there is a violation of laws and regulations but there is no specific provision prescribing the cases in which reports should be made to the relevant administrative agencies[1].

No. The only exception is if during the investigation of a whistleblower’s report it was discovered that a crime had been committed, then the company must inform the respective state authorities about this fact.

Yes, if the institution that received the information on the breach is not competent to assess this information and if the person who provided the information through the internal channel wishes to be recognised as a whistleblower.

The Bill does not specify this point.

The investigation of whistleblowing cases is handled internally but if an internal disclosure leads to the detection of improper practices that constitute a crime or contravention under any applicable law, the WRO may refer the report to the police for investigation. However, the WRO is not legally obliged to do so if the subject of the report received has been rectified.

There are only specific crimes (namely, crimes against the safety of the government) that, under Maltese law, an individual must report to the authorities if he or she becomes aware that they are about to be committed.

Whether an employer should inform external authorities about whistleblowing depends on the nature of the illegality or unethical conduct disclosed. Where the disclosure is not a crime, the employer need not disclose it to external authorities. However, where whistleblowing is about the commission of a crime, the employer is required to disclose the same to external authorities such as law enforcement agencies.

The internal investigation bodies can carry out a variety of follow-up actions after the reporting procedure has been completed. The Bill does not specify any particular circumstances in which companies must notify authorities about whistleblowing. Nevertheless, if the reported act or omission is a criminal offence, the employer should notify the public prosecutor. In addition, if the disclosed act or omission could be recognised as an administrative infraction, the appropriate state authority should be notified.

External complaints will be submitted to those authorities that, under their duties and powers, should know the matter covered by the complaint, including:

• the Public Prosecutor’s office (Ministério Público);
• the criminal police bodies;
• the Bank of Portugal;
• independent administrative authorities;
• public institutes;
• the Inspectorates-General, similar entities and other central services of the direct administration of the state with administrative autonomy;
• local authorities; and
• public associations.

As a general rule, the person or department designated to check reports is bound to keep information confidential regarding the whistleblower and the reports. However, exceptions apply when the law provides an obligation to inform public authorities (ie, in the context of investigations by national authorities or judicial proceedings).

There is no legal obligation under Singapore law to disclose that a whistleblowing report has been made. However, a company may have disclosure obligations under the following (non-exhaustive) circumstances:

• an obligation to file a Suspicious Transaction Report if there are reasonable grounds to suspect that any property is connected to criminal activity (see, for example, section 45 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992);
• an obligation to file a police report where the organisation becomes aware of the commission of, or the intention of any other person, to commit certain offences (see section 424 of the Criminal Procedure Code 2010); and
• an obligation to lodge a report with the relevant authority once they become aware of misconduct committed by their representatives (eg, financial advisers are required to lodge a report to the MAS upon discovery of misconduct committed by their representatives)(see, for example, Notice FAA-N14 Reporting of Misconduct of Representatives by Financial Advisers).

The Law does not establish specific situations in which employers need to inform external authorities about the whistleblowing. However, if the reported act or omission could be considered a criminal offence, the employer should inform the public prosecutor. If the reported act or omission could be considered an administrative infraction, the competent authority should also be informed.

There is no such legal requirement.

A protected disclosure may trigger a requirement to inform an external authority. This will ultimately depend on the nature of the company, the protected disclosure and the relevant failure disclosed. For example, if the disclosure relates to a regulatory breach, a regulated employer may need to inform the Financial Conduct Authority, or a disclosure that indicates money laundering would need to be disclosed to the National Crime Agency.

An employer may have an obligation to inform external authorities about misconduct discovered as a result of whistleblowing in some instances. For example, the discovery of potential shareholder fraud may in certain circumstances need to be disclosed to the SEC.