Guide to Whistleblowing

Contributing Editors

In this new age of accountability, organisations around the globe are having to navigate a patchwork of new laws designed to protect those who expose corporate misconduct. IEL’s Guide to Whistleblowing examines what constitutes a protective disclosure, the scope of regulations across 21 countries, and the steps businesses must take to ensure compliance with them.

Learn more about the response taken in specific countries or build your own report to compare approaches taken around the world.

Choose countries

 

Choose questions

Choose the questions you would like answering, or choose all for the full picture.

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

03. Is it possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries?

Flag / Icon

Australia

  • at Lander & Rogers

There is no specific guidance on whether there may be a whistleblower procedure at a Group level encompassing all subsidiaries. However, in the absence of a prohibition to this effect, the better view is that such a procedure is possible at a Group level covering all subsidiaries. 

Under section 1317AA(4) of the Corporations Act, an entity's policy must cover the types of disclosures that qualify for protection. Disclosable matters involve information that the discloser has reasonable grounds to suspect concerns misconduct, or an improper state of affairs or circumstances, concerning:

  • an entity; or
  • if the entity is a body corporate, a related body corporate of the entity.

Under section 1317AAA of the Corporations Act, an entity’s policy must explain the role of “eligible recipients” – that is, to receive disclosures that qualify for protection. If an entity is a body corporate, an eligible recipient includes:

  • an officer or senior manager of the entity or related body corporate;
  • the internal or external auditor (including a member of an audit team conducting an audit) or actuary of the entity or related body corporate; and
  • a person authorised by the entity to receive disclosures that may qualify for protection.
Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

Companies with less than 250 employees will be able to share an internal reporting channel. Legal entities with more than 250 employees will need to have their own internal reporting procedure. The EU Commission has confirmed in an opinion that it will not allow centralised internal reporting systems for a whole group of companies. However, that does not mean that a group cannot provide the framework and policies for the internal procedures of its subsidiaries, provided employees can make reports and receive a decent follow-up at the local entity level. It is also possible to outsource the internal reporting channel to a third party.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

Yes, it is possible to set up a whistleblowing procedure at a Group level, covering all subsidiaries.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

Yes, it is possible to have a whistleblowing procedure applicable at a Group level, but only in addition to an internal reporting channel. This is because the WBP Act states that each company must have its own internal reporting channel (meaning a WBP officer and their deputy appointed by the company). However, neither the Directive (as interpreted by the European Commission) nor the WBP Act prohibits the company from having a separate central reporting channel at a Group level, provided that such a channel is available in addition to (co-existing with) a reporting channel set up under Croatian law.

Last updated on 29/07/2022

Flag / Icon

Denmark

  • at IUNO
  • at IUNO

Yes. The Whistleblowing Act allows all companies to set up a joint whistleblowing procedure at the group level, including larger companies with 250 employees or more.

The special flexibility allowing larger companies with 250 employees or more to establish a joint procedure is subject to the rule being compliant with the EU Whistleblowing Directive. If it becomes clear that it is contrary to the EU Whistleblowing Directive, the rule will be limited to medium-sized companies.

Last updated on 30/11/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

The procedure for collecting and processing alerts may be common to several or all of the companies in a group, under the terms set by an application Decree to be published.

Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

According to the explanatory memorandum of the draft bill of the Whistleblower Protection Act, it is legally permissible to implement an independent and confidential internal reporting office as a "third party" within the meaning of article 8(5) of the EU Whistleblower Directive at another group company (eg, parent company, sister company or subsidiary), which may also work for several independent companies in the group (section 14 (1) HinSchG-E). However, the European Commission has already announced in two statements that a group-wide whistleblower system does not meet the requirements of the EU Whistleblower Directive. It remains to be seen whether the draft law will still be amended at this point in the legislative process. If the German law ends up retaining the outsourcing of the obligation to a third party, which may also be a company belonging to the group, the question of the compatibility of the regulation with EU law will probably arise at a later stage.

The draft bill of the Whistleblower Protection Act in line with the EU Directive further provides that several private employers with between 50 and 249 employees employed on a regular basis may commonly implement and operate an internal reporting office to receive notifications. However, the legal obligation to take action to remedy the violation and the corresponding duty to report back to the person making the report has to remain with the individual employer.   

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

Yes, this may be done. Various organisations in India have adopted a whistleblowing policy at the group level and set up a common hotline channel or speak-up portal to receive complaints of unlawful or unethical conduct and other wrongdoing within group companies.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

Each Group company must establish a system for responding to whistleblowing, but it is possible to set up a point of contact at a Group level, covering all subsidiaries. In this case, each Group company must state in its internal rules in advance that a point of contact is established at a Group level and a responsible person of each Group company must be appointed for the “Whistleblowing Response Operation[1]”[2]. This may be an employee of a Group company or an employee of the parent company of the Group[3].


[1]   “Whistleblowing Response Operation” means receiving whistleblower report, investigating the reportable fact (Please see question 10) pertaining to such whistleblower report, and taking necessary rectifying measures.

[2]   Consumer Affairs Agency, Explanatory Document for Guidelines on Whistleblower Protection Act [Cabinet Office Notification No.118 (2021)] (“Consumer Affairs Agency Guidelines Explanation ”), at footnotes 13 and 18, at pp.8-9, last visited June 28, 2022.

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

There are no provisions in the Whistleblowing Act that would allow for the setting up of a whistleblowing procedure at a group level.

Based on the guidelines prepared by the State Chancellery (the contact point for whistleblowing in Latvia) and EU WBD, one single group whistleblowing procedure is only allowed if the local entity is not required to have an internal reporting channel (if they have less than 50 employees in Latvia) or if the company has a local internal reporting channel and a group whistleblowing procedure is established in addition to it.

If both whistleblowing procedures exist, employees are allowed to use either procedure. A group procedure on its own is not allowed if the local entity has 50 or more employees.

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

Divisions of private legal entities, other organisations, foreign legal entities or organisations with between 50 and 249 employees may share internal channels, subject to the principle of confidentiality.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

Private legal entities with 50 to 249 employees may share resources at the group level for receiving reports and following up on them. However, each Luxembourg entity will have to comply with the obligations set out under the Bill, namely to maintain confidentiality, provide feedback and fix the reported violation.

Last updated on 29/07/2022

Flag / Icon
Malta

Malta

  • at Camilleri Preziosi
  • at Camilleri Preziosi
  • at Camilleri Preziosi

The obligation to establish internal reporting channels and procedures applies to every company with 50 or more employees, even when such companies belong to a group of companies. Notwithstanding this:

  • the Act allows medium-sized entities employing between 50 and 249 persons to share resources concerning the receipt of reports and any investigation to be carried out; and
  • maintaining or creating centralised whistleblowing functions within a group is not prohibited, provided that internal reporting channels and procedures are also available at the subsidiary level.

This is in line with guidance provided by the European Commission on the interpretation of the Directive.

Last updated on 16/11/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

There is no provision that prevents or prohibits a Group company from setting up a whistleblowing procedure at a Group level covering all its subsidiaries.

Last updated on 29/07/2022

Flag / Icon

Poland

  • at Baran Książek Bigaj
  • at Baran Książek Bigaj

The national legislation does not foresee such a solution. Legal entities in the private sector with between 50 and 249 employees may agree to share resources for receiving and verifying reports and conducting an investigation, provided that the activities performed comply with the Bill.

Last updated on 17/11/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

The law does not specify so, in theory, yes provided that we are referring to the general rules of a whistleblowing procedure.

Please note that all companies with 50 or more employees should establish internal reporting channels, irrespective of the nature of their activities.

Nevertheless, in the private sector, companies with 50 to 249 employees may share resources with other legal entities as regards the receipt of reports and any investigation to be carried out.

Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

As a general rule (article 9 paragraph 4), companies with 50 to 249 employees (regardless of the group) should have the option to share resources as regards the receipt of reports and any investigation to be carried out. Companies with fewer employees than that or administrative bodies with less than 10,000 inhabitants cannot pool their resources together.

The Commission states that the protection of whistleblowers and a higher number of disclosures will only be achieved if each company having more than 49 employees will establish its own whistleblowing system. According to the current interpretation instructions of the EU Commission regarding the Whistleblowing Directive (dated 2 June 2021 and 29 June 2021), it is not prohibited to establish a centralised system, but such a system must be run in parallel with the mandatory local system.

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

According to section 11 of the Draft, Group companies as defined in section 42 of the Spanish Code of Commerce (basically, when a company has or may have, directly or indirectly, control of another company or companies), the parent company may adopt a general policy for an internal reporting system and whistleblower protection and should also ensure its application in all entities of the Group, without prejudice to the autonomy and independence of each of the companies to establish its own corporate governance system or to introduce modifications or adaptations as may be necessary to comply with applicable regulations in each case.

The Responsible for the system and an internal information system could be unique for the Group companies or there could be one for each of the companies in the group, under the terms established above.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

Yes; however, a whistleblowing procedure established according to the Whistleblowing Act can only be shared between group companies employing 50 to 249 employees at the beginning of the calendar year. Such group-wide whistleblowing procedures can only include the receipt of reports and investigations into the reported matters (save for contacts with the whistleblower).

It is, however, possible to deviate from the Whistleblowing Act as it relates to internal reporting channels and procedures to be applied concerning employees by way of a collective bargaining agreement (CBA) entered into by trade unions and employer organisations at a central level. As such, the labour market parties within the IT and tech sector have entered  a CBA that allows group-wide whistleblowing procedures to, inter alia, also cover group companies employing 250 or more employees. The CBA is only applicable to members of the relevant employer organisations party to the CBA.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

Yes. Employers can implement a whistleblowing procedure at a Group level.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

Yes, this may be done. Section 301 does not expressly mandate separate whistleblowing procedures for different subsidiaries.

Last updated on 29/07/2022

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

19. Should the employer inform external authorities about the whistleblowing? If so, in what circumstances?

Flag / Icon

Australia

  • at Lander & Rogers

Whistleblower policy provisions will affect how a company can investigate the concern. The company's whistleblower policy must include information about how it will investigate concerns.

However, generally speaking, a company or organisation may report information to external authorities, such as ASIC, APRA, the Australian Federal Police or to a lawyer to seek advice about whistleblower protections.

Last updated on 23/08/2022

Flag / Icon

Belgium

  • at Van Olmen & Wynant

If the investigation of a report leads to the uncovering of severe legal breaches or crimes, there could be a duty for the employer or company to inform the authorities, but this will depend on each case.

Last updated on 01/08/2022

Flag / Icon

Brazil

  • at CGM
  • at CGM
  • at CGM

No, there is no obligation for the employer to inform external authorities about the reports.

Last updated on 29/07/2022

Flag / Icon
Croatia

Croatia

  • at Babic & Partners
  • at Babic & Partners

Yes, under the WBP Act it is the duty of WBP officer and deputy to:

  • forward the report to competent authorities for further processing if the irregularity has not been resolved in cooperation with the company; and
  • notify in writing the authority competent for external reporting on the report and the outcome of the actions undertaken within 30 days after a decision on the report is made.
Last updated on 29/07/2022

Flag / Icon

Denmark

  • at IUNO
  • at IUNO

There is no statutory requirement to inform the external authorities. This also applies if the Whistleblowing Act does not cover the matter reported by the whistleblower.

Last updated on 30/11/2022

Flag / Icon

France

  • at Proskauer
  • at Proskauer

French law does not require an employer to inform external authorities about the reports.

However, this obligation does exist in certain situations. For example:

  • in the public sector, a constituted authority, public official or civil servant who, in the performance of his or her duties, becomes aware of a crime or misdemeanour must report it without delay to the General Prosecutor and must provide all relevant information, minutes and documents relating to the offence (article 40, paragraph 2 of the Criminal Procedure Code); and
  • regarding money laundering, insurers, mutual health insurance companies or credit institutions are required under certain conditions to report to the Tracfin Agency the amounts entered in their books or transactions involving money that they know, suspect or have good reason to suspect come from an offence or are linked with terrorist financing (article L. 561-15 of the Monetary and Financial Code).

In any case, it is highly recommended for the employer, when appropriate, to inform competent authorities if they about punishable facts through the whistleblowing channel. Indeed, silence from the employer would increase the risk of collusion or damages to the image and reputation of the Company.

Last updated on 29/07/2022

Flag / Icon

Germany

  • at Oppenhoff
  • at Oppenhoff

Once the reporting process at the internal reporting office is completed, the internal reporting office can take various follow-up actions. In addition to internal investigations, the process can also be handed over to a competent authority for further investigation (section 18 No. 4 HinSchG-E).

Last updated on 29/07/2022

Flag / Icon

India

  • at Khaitan & Co
  • at Khaitan & Co

There is no blanket requirement for an employer to inform external authorities upon receipt of disclosure from a whistleblower. However, depending on the nature of the disclosure, its gravity and impact, employers may be required to report the same to certain authorities, including but not limited to the Securities Exchange Board of India or relevant stock exchanges (in the case of listed companies) or even the Serious Fraud Investigation Office.

Last updated on 29/07/2022

Flag / Icon

Japan

  • at City-Yuwa
  • at City-Yuwa
  • at City-Yuwa

If necessary, the business operator must report to the relevant administrative agencies when its investigation reveals that there is a violation of laws and regulations but there is no specific provision prescribing the cases in which reports should be made to the relevant administrative agencies[1].


[1]   Id, Section 3 II(1)(iii)(c), at p.11.

Last updated on 29/07/2022

Flag / Icon
Latvia

Latvia

  • at Ellex Klavins
  • at Ellex Klavins

No. The only exception is if during the investigation of a whistleblower’s report it was discovered that a crime had been committed, then the company must inform the respective state authorities about this fact.

Last updated on 29/07/2022

Flag / Icon
Lithuania

Lithuania

  • at Ellex Valiunas

Yes, if the institution that received the information on the breach is not competent to assess this information and if the person who provided the information through the internal channel wishes to be recognised as a whistleblower.

Last updated on 29/07/2022

Flag / Icon
Luxembourg

Luxembourg

  • at Castegnaro
  • at Castegnaro

The Bill does not specify this point.

Last updated on 29/07/2022

Flag / Icon
Malta

Malta

  • at Camilleri Preziosi
  • at Camilleri Preziosi
  • at Camilleri Preziosi

The investigation of whistleblowing cases is handled internally but if an internal disclosure leads to the detection of improper practices that constitute a crime or contravention under any applicable law, the WRO may refer the report to the police for investigation. However, the WRO is not legally obliged to do so if the subject of the report received has been rectified.

There are only specific crimes (namely, crimes against the state) which, under Maltese law, an individual must report to the authorities if he or she becomes aware that they are about to be committed.

Last updated on 16/11/2022

Flag / Icon
Nigeria

Nigeria

  • at Bloomfield LP

Whether an employer should inform external authorities about whistleblowing depends on the nature of the illegality or unethical conduct disclosed. Where the disclosure is not a crime, the employer need not disclose it to external authorities. However, where whistleblowing is about the commission of a crime, the employer is required to disclose the same to external authorities such as law enforcement agencies.

Last updated on 29/07/2022

Flag / Icon

Poland

  • at Baran Książek Bigaj
  • at Baran Książek Bigaj

The internal investigation bodies can carry out a variety of follow-up actions after the reporting procedure has been completed. The Bill does not specify any particular circumstances in which companies must notify authorities about whistleblowing. Nevertheless, if the reported act or omission is a criminal offence, the employer should notify the public prosecutor. In addition, if the disclosed act or omission could be recognised as an administrative infraction, the appropriate state authority should be notified.

Last updated on 17/11/2022

Flag / Icon

Portugal

  • at Cuatrecasas
  • at Cuatrecasas

External complaints will be submitted to those authorities that, under their duties and powers, should know the matter covered by the complaint, including:

  • the Public Prosecutor’s office (Ministério Público);
  • the criminal police bodies;
  • the Bank of Portugal;
  • independent administrative authorities;
  • public institutes;
  • the Inspectorates-General, similar entities and other central services of the direct administration of the state with administrative autonomy;
  • local authorities; and
  • public associations.
Last updated on 29/07/2022

Flag / Icon

Romania

  • at STALFORT Legal. Tax. Audit.
  • at STALFORT Legal. Tax. Audit.

As a general rule, the person or department designated to check reports is bound to keep information confidential regarding the whistleblower and the reports. However, exceptions apply when the law provides an obligation to inform public authorities (ie, in the context of investigations by national authorities or judicial proceedings).

Last updated on 16/08/2022

Flag / Icon

Spain

  • at Cuatrecasas
  • at Cuatrecasas
  • at Cuatrecasas

The Draft does not establish specific situations in which employers need to inform external authorities about the whistleblowing. However, if the reported act or omission could be considered a criminal offence, the employer should inform the public prosecutor. If the reported act or omission could be considered an administrative infraction, the competent authority should also be informed.

Last updated on 29/07/2022

Flag / Icon

Sweden

  • at Lindahl
  • at Lindahl
  • at Lindahl

There is no such legal requirement.

Last updated on 02/08/2022

Flag / Icon

United Kingdom

  • at Proskauer
  • at Proskauer
  • at Proskauer

A protected disclosure may trigger a requirement to inform an external authority. This will ultimately depend on the nature of the company, the protected disclosure and the relevant failure disclosed. For example, if the disclosure relates to a regulatory breach, a regulated employer may need to inform the Financial Conduct Authority, or a disclosure that indicates money laundering would need to be disclosed to the National Crime Agency.

Last updated on 29/07/2022

Flag / Icon

United States

  • at Proskauer
  • at Proskauer

An employer may have an obligation to inform external authorities about misconduct discovered as a result of whistleblowing in some instances. For example, the discovery of potential shareholder fraud may in certain circumstances need to be disclosed to the SEC.

Last updated on 29/07/2022