Setting up a whistleblowing procedure

Companies with 250 employees or more already had to have their internal reporting channel in place by 15 February 2023. For companies with fifty to 249 employees, that deadline expired on 17 December 2023. Both dates have now passed, and the Law of 28 November 2022 grants no further extension.

Below fifty employees, an exemption applies in principle. That exemption falls away entirely for a company covered by the provisions on financial services, products and markets, or itself subject to anti-money laundering legislation. Such a company needed its internal channel from 15 February 2023 onwards, regardless of its staff numbers.

The procedure has two fixed deadlines. You acknowledge receipt of a report within seven days, and you give feedback within at most three months of that acknowledgement. Without an acknowledgement, that three-month period still runs from the seventh day, so staying silent buys no extra time.

You also appoint a report manager who is independent and has no conflict of interest, and you keep a register of every report received. You may not disclose the identity of the reporting person without their explicit consent, except in the limited cases the law itself provides for.

The threshold of fifty employees is not counted at random. It is the average number of employees, fixed each year on 1 January across the four quarters of the preceding calendar year, using the same method as for the social elections.

Together with an external partner, we implement your whistleblowing procedure both technically and legally, tailored to your company’s context. Our solution helps you not only meet your legal obligations, but also detect irregularities in the broadest sense, from integrity breaches to internal corporate fraud, at an early stage and investigate them when needed.

A reporting channel that works well fits alongside a corporate fraud policy that sets out who reviews a report, and a delegation of powers that gives the report manager their own authority. Without those two pieces, a reporting channel stays an empty box.

A breach of these duties falls under the Social Criminal Code and carries a level 4 sanction: imprisonment of six months to three years, a criminal fine of 6,000 to 70,000 euro, or an administrative fine of 3,000 to 35,000 euro. A company that never set up its reporting channel therefore faces a real risk of sanction, beyond the reputational damage.

An employer who harms a reporting person because of their report stands on weak ground in court: the law presumes that the detriment is retaliation, and the employer must then show that the measure was duly justified. We wrote earlier about the new law on the whistleblowing procedure. Back to our page for company directors.

No, not to a company subject to anti-money laundering legislation or to the provisions on financial services, products and markets. For such a company, no threshold and no extension apply: it needed its internal channel from 15 February 2023 onwards, regardless of staff numbers. A ten-person firm falls under it just the same.

Within at most three months of acknowledging receipt of the report. That acknowledgement must be sent within seven days of the report. If you send no acknowledgement, the three-month period still runs from the seventh day, so staying silent gains the company no extra time.

No, the law bans every form of retaliation against a reporting person, listing fifteen forms from dismissal to blacklisting. If an employer dismisses the reporting person anyway, the law presumes the dismissal is retaliation, and the employer must show the measure has nothing to do with the report.

A level 4 sanction under the Social Criminal Code: imprisonment of six months to three years, a criminal fine of 6,000 to 70,000 euro, or an administrative fine of 3,000 to 35,000 euro. A company that never set up its reporting channel therefore faces a real risk of sanction, beyond the reputational damage.