Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 18 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

01. Which body of rules govern the status of whistleblowers?

01. Which body of rules govern the status of whistleblowers?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

To date, the status of whistleblowers is governed by the following rules in Luxembourg:

  • Circular CSSF 12/552 on central administration, internal governance and risk management, as amended by Circulars CSSF13/563, CSSFv14/597, CSSF16/642, CSSF16/647, CSSF17/655, CSSF20/750, CSSF20/759 and CSSF 21/785, applicable until 29 June 2022;
  • Circular CSSF 12/552 on central administration, internal governance and risk management, as amended by Circulars CSSF13/563, CSSFv14/597, CSSF16/642, CSSF16/647, CSSF17/655, CSSF20/750, CSSF20/759, CSSF 21/785 and CSSF 22/807, applicable from 30 June 2022;
  • Law of 7 December 2015 on the insurance sector;
  • Law of 5 April 1993 on the financial sector, as amended;
  • Article 8 of the Law of 23 December 2016 on market abuse, as amended;
  • Criminal Code: article 140;
  • Code of Criminal Procedure: article 23;
  • Law of 12 November 2004 on the fight against money laundering and terrorist financing (articles 5 and 9), as amended;
  • Labour Code: articles L.313-1(4), L.241-8, L.245-5 and L.253-1, L.271-1 and L.271-2;
  • Law of 16 April 1979 establishing the general status of state officials;
  • Law of 24 December 1985 establishing the general status of municipal civil servants; and
  • Law of 26 June 2019 on the protection of know-how and undisclosed commercial information against unlawful obtaining, use and disclosure.

Bill 7945 (the Bill) transposing Directive (EU) 2019/1937 of the European Parliament and of the council of 23 October 2019 on the protection of persons who report violations of Union law. The bill is expected to come into force in the last quarter of 2022.

The information in this submission will therefore be based on the provisions of this Bill.

Last updated on 29/07/2022

02. Which companies must implement a whistleblowing procedure?

02. Which companies must implement a whistleblowing procedure?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

To date, only companies in the financial and insurance industries are required to implement a whistleblowing procedure. According to the Bill, all legal entities in the private or public sector will be subject to the obligation to set up channels and procedures for internal reporting and monitoring:

  • public legal entities include any entity owned or controlled by the public sector, including municipalities with more than 10,000 residents;
  • private legal entities will only be subject to this obligation if they have at least 50 employees.
Last updated on 29/07/2022

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Private legal entities with 50 to 249 employees may share resources at the group level for receiving reports and following up on them. However, each Luxembourg entity will have to comply with the obligations set out under the Bill, namely to maintain confidentiality, provide feedback and fix the reported violation.

Last updated on 29/07/2022

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

04. Is there a specific sanction if whistleblowing procedures are absent within the Company?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Yes. If the obligations to set up internal reporting channels are not met, private legal entities will be liable for an administrative fine of between EUR 1,500 and EUR 250,000.

Nothing is specified for public entities.

Last updated on 29/07/2022

05. Are the employee representative bodies involved in the implementation of this system? 

05. Are the employee representative bodies involved in the implementation of this system? 

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Yes.

When establishing the internal reporting procedure, a company's staff delegation must be involved in different ways, depending on the size of the company:

  • In companies with less than 150 employees, the information and consultation procedure with the staff delegation will commence. The staff delegation will have to be informed about the intention to set up or modify the whistleblowing channel and will be entitled to give opinions and propose changes.
  • In companies with 150 employees and more, the decision to set up or modify the whistleblowing channel will have to be made jointly by the employer and the staff delegation (co-decision).

Under the current regime, whistleblowing channels are mostly implemented unilaterally by employers in the financial and insurance sectors, but the previous consultation process with the staff delegation or, in larger companies, co-decision, should be respected.

Last updated on 29/07/2022

06. What are the publicity measures of the whistleblowing procedure within the company?

06. What are the publicity measures of the whistleblowing procedure within the company?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The legal entity is required to provide information on the reporting procedures in place:

  • to the competent authorities;
  • to workers; and
  • to all persons who come into contact with the entity in the course of their professional activities (eg, service providers, distributors, suppliers, business partners).

Communication of the procedure can be done through posters in a visible place accessible to all these persons, on the website of the legal entity, through the company's internal regulations if they exist, by a reference in the employment contract to an internal document, etc.

Last updated on 29/07/2022

07. Should employers manage the reporting channel itself or can it be outsourced?

07. Should employers manage the reporting channel itself or can it be outsourced?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The legal entity may subcontract the monitoring of reports (articles 6 and 7 of Bill 7945).

Last updated on 29/07/2022

09. What precautions should be taken when setting up a whistleblowing procedure?

09. What precautions should be taken when setting up a whistleblowing procedure?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

As follows:

  • The establishment of channels for the receipt of reports that are conceived, set up and managed securely and guarantee the confidentiality of the identity of the author of the report and any third party mentioned, and protect these channels from unauthorised persons;
  • an acknowledgement of receipt sent to the author of the report within seven days of receipt of the report;
  • designation of an impartial person or service competent to follow up on reports;
  • diligent follow-up by the designated person or service;
  • a reasonable time to provide feedback, not exceeding three months from the acknowledgement of receipt of the report or, failing that, three months from the end of the seven-day period following the report; and
  • provision of clear and easily accessible information on the report procedures and their use to the competent authorities.
Last updated on 29/07/2022

10. What types of breaches/violations are subject to whistleblowing?

10. What types of breaches/violations are subject to whistleblowing?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

While the directive only covers certain acts and policy areas of the European Union, the government has decided, in line with its coalition programme [2018-2023], to extend the scope of Bill 7945 to all national laws.

The scope of whistleblowing in the current regime in the financial sector, the insurance sector, the public sector and the Labour Code, includes:

  • Insurance sector: potential or actual infringements of the laws and regulations listed in articles 303 paragraph 1, and 304 or other conduct referred to in articles 303 paragraph 1, and 304 (article 4, a) of the law of December 7, 2015, on the insurance sector (ie, any infringement of the law of 7 December 2015 on the insurance sector and its implementing regulations; any infringement of the law of 27 July 1997 on insurance contracts, as amended, and its implementing regulations; any failure to comply with the instructions of the Commissariat Aux Assurances);
  • Financial sector: any suspicion or reasonable grounds to suspect that money laundering, a related predicate offence or terrorist financing is taking place, has taken place or has been attempted; any potential or proven violations of the law of 5 April 1993 on the financial sector or the law of 30 May 2018 on markets in financial instruments; and any significant and legitimate concerns related to the internal governance of the institution or to internal and regulatory requirements in general;
    • Labour Code: bribery, influence peddling and unlawful taking of interest regarding their colleagues, their employer or anyone senior in rank, as well as an external person; any work situation which can reasonably be suspected to present a serious and immediate danger to health and safety and any flaw in protective systems; and any discrimination or sexual harassment;
    • Public sector: equal treatment, direct or indirect discrimination, sexual harassment, unlawful taking of interest, bribery, influence peddling, bribery of judges and acts of intimidation committed against persons holding public office.
Last updated on 29/07/2022

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

11. Are there special whistleblowing procedures applicable to specific economic sectors or professional areas?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

There are special procedures currently in place in the financial sector or for state and municipal employees.

In such cases, the provisions of the Bill will supplement the less favourable provisions of these existing procedures.

Last updated on 29/07/2022

13. Who can be a whistleblower?

13. Who can be a whistleblower?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro
  • Workers:
    • private-sector employees;
    • public-sector employees and civil servants,
    • trainees and volunteers;
    • former employees; and
    • persons involved in recruitment processes.
  • Business partners:
    • self-employed workers,
    • employees of subcontractors and suppliers;
    • former co-contractors; and
    • persons in pre-contractual negotiations;
  • Members of corporate governance:
    • shareholders;
    • members of the administrative body; and
    • members of the supervisory body.
Last updated on 29/07/2022

14. Are there requirements to fulfil to be considered as a whistleblower?

14. Are there requirements to fulfil to be considered as a whistleblower?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The following requirements must be met:

  • compliance with the form of reporting required by law (use of correct reporting channels);
  • respect for the hierarchy of the reporting channels; and
  • good faith.
Last updated on 29/07/2022

15. Are anonymous alerts admissible?

15. Are anonymous alerts admissible?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Yes.

Last updated on 29/07/2022

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

16. Does the whistleblower have to be a direct witness of the violation that they are whistleblowing on?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The Bill does not specify this point.

Last updated on 29/07/2022

17. What are the terms and conditions of the whistleblowing procedure?

17. What are the terms and conditions of the whistleblowing procedure?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Please refer to our answer to question 9.

Last updated on 29/07/2022

18. Is there a hierarchy between the different reporting channels?

18. Is there a hierarchy between the different reporting channels?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Yes.

1. Internal reporting to be preferred in the first instance by those wishing to report when:

  • It is possible to effectively remedy the violation internally – this implies that a formal internal reporting procedure is in place.

2. External reporting to the competent authorities[1]:

  • following an unsuccessful internal report;

  • in the absence of an internal reporting procedure (failure to comply with the law or a company with less than 50 employees not having set up a procedure voluntarily); and

  • direct reporting if it is not possible to effectively remedy the violation internally or when the individual believes there is a risk of retaliation (this is a subjective assessment depending on the seriousness of the reported facts and the people involved).

3. Public Disclosure

  • Subsidiary remedy:
    • prior recourse to internal and then external reporting or direct reporting and,
    • no appropriate action was taken in response to the report; 
  • Direct remedy: if there is reasonable cause to believe that:
    • the violation may represent an imminent or obvious danger to the public interest;
    • in the case of external reporting, the risk of retaliation or it is unlikely to be remedied due to the particular circumstances; 
 

[1] The competent authorities are: The Commission for the supervision of the financial sector; The Commissariat for insurance; The Competition Council; The Administration of Registration and Domains; The Labour and Mining Inspectorate; The National Commission for Data Protection; The Centre for equal treatment; The Ombudsman/External control of places of deprivation of liberty; The Ombudscomité fir d'Rechter vum Kand; The Luxembourg Regulatory Institute; The Luxembourg Independent Audiovisual Authority; The Bar Association; The Chamber of Notaries of the GDL; The Medical College; The Administration of Nature and Forests; The Administration of Water Management; The Administration of Air Navigation; The National Service of the Consumer Ombudsman; The Order of Architects and Consulting Engineers; The Order of Chartered Accountants; The Institute of Company Auditors; and The Administration of Direct Taxes.

 

Last updated on 29/07/2022

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The Bill does not specify this point.

Last updated on 29/07/2022

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

20. Can the whistleblower be sanctioned if the facts, once verified, are not confirmed or are not constitutive of an infringement?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

No. The whistleblower can only be sanctioned if:

  • he or she knowingly reported false information;
  • he or she reported facts in bad faith when he or she had no reason to believe that the facts were true.

Good faith is presumed and it will be up to the legal entity to prove that the conditions for protection are not met and that the concerned individual should not be granted whistleblower status.

Last updated on 29/07/2022

21. What are the sanctions if there is obstruction of the whistleblower?

21. What are the sanctions if there is obstruction of the whistleblower?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

There are no sanctions as such but there are means of redress available to the whistleblower:

  • an invalidity action for certain retaliatory measures;
  • action for damages; and
  • actions under common law: unfair dismissal, contractual liability, tort, etc.
Last updated on 29/07/2022

22. What procedure must the whistleblower follow to receive protection?

22. What procedure must the whistleblower follow to receive protection?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The authors of a report will enjoy the protection provided for by this law if:

  • they had reasonable grounds to believe that the information reported on was true at the time of reporting and that this information falls within the scope of this law; and
  • they have made an internal report under article 7 or an external report under article 19, or have made a public disclosure under article 24.

By extension, the following are also protected:

  • facilitators[1];
  • third parties who are connected to the whistleblowers and who are at risk of retaliation in a professional context, such as colleagues or relatives of the whistleblowers;
  • legal entities owned by or employing the authors of the report, or with which they are connected in a professional context.
 

[1] a physical person who assists a reporter during the reporting process in a professional context and whose assistance should be confidential.

Last updated on 29/07/2022

23. What is the scope of the protection? 

23. What is the scope of the protection? 

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The scope of the protection is as follows:

  • prohibition of retaliation: any act or omission, direct or indirect, in a professional capacity, which is prompted by a report and causes or may cause unjustified harm to the whistleblower; and
  • exclusion of liability: the absence or limitation of civil or criminal liability for reporting violations even if by doing so the author violates legal or contractual obligations.

However, the protection does not apply to certain types of information:

  • classified information or documents or information relating to national security;
  • information or documents covered by medical secrecy, lawyer secrecy, official secrecy and the rules of criminal procedure (investigative secrecy).

The whistleblower may not be held criminally liable in the event of a breach of a company secret, if the report is proportionate, made under the conditions of the law and is necessary to safeguard the public interest.

Last updated on 29/07/2022

24. What are the support measures attached to the status of whistleblower?

24. What are the support measures attached to the status of whistleblower?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The Bill does not specify this point.

Last updated on 29/07/2022

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

25. What are the risks for the whistleblower if there is abusive reporting or non-compliance with the procedure?

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The risks are as follows:

  • no protection for whistleblower status;
  • civil liability: may be ordered to pay damages in case of harm caused to the entity targeted by the whistleblower in bad faith;
  • criminal liability for knowingly reporting false information: may result in imprisonment of three days to three months or a fine of EUR 1,500 to 50,000; and
  • disciplinary sanctions: by the employer or a disciplinary authority.
Last updated on 29/07/2022