As the deadline of the new European directive concerning whistleblowing and the protection of whistleblowers is approaching, companies operating in the EU member states are on the finish line to become compliant.

Addressing the cost of silence and strengthening whistleblower protection across the EU, companies will have to comply with this law by the end of 2021.

Learn more about the requirements for your Organization

After receiving inquiries from various large corporations, the EU Commission issued for the first time since the adoption of the Directive in 2019 two statements (on June 2 and on June 29, 2021), and provided interpretative notes on the implementation of the whistleblower guidelines.

No group-wide whistleblowing solutions for entities with > 250 employees 

This means that Organizations with several legal entities cannot operate a uniform whistleblowing scheme with reporting channels on behalf of the whole group.

Central whistleblowing systems are already fairly widespread, especially in large global companies. It is common practice to set up one central or several regional reporting offices to receive information on possible compliance violations, and these reports are often processed by a central office, with investigation measures coordinated from there. It leads to efficiency gains, the regularly scarce human resources are spared, and the compliance department receives an overview of possible violations of the law in the entire group or compliance weak points in the Organization.

However, this type of whistleblowing management will no longer be sufficient in the future. In the opinion of the Commission, a centralized group-wide whistleblowing system isn’t meeting the Whistleblowing Directive requirements. This may shake up the preexisting Organization of large companies which already have uniform whistleblowing systems implemented, but the main objective of the Directive is to provide a high level of protection to whistleblowers while enhancing the enforcement of Union law. 

Simply put, “the more whistleblowers feel safe to speak up, the higher the number of whistleblowers’ reports, which will feed national and Union enforcement systems.”1

How to comply

Under Article 8 of the Whistleblowers Directive, every company that employs more than 50 people is obliged to set up its own separate reporting channel. This applies to independent companies as well as to group companies, regardless of whether a group-wide whistleblowing system already exists. The whistleblower guideline leaves no room for interpretation here.

Having said that, the Commission makes it clear that an already existing central whistleblowing system can of course continue to be operated in parallel. It is then up to the whistleblower to decide whether they want to speak up through the channel of their subsidiary or the central system.

With a targeted Code of Conduct, the company could try to strengthen the acceptance of the existing central system and thus work towards ensuring that this system is used preferentially. In any case, the whistleblower must have access to a decentralized whistleblower system in addition to the central one.

What about mid-size companies?

Medium-sized companies (with 50 to 249 employees) that are subsidiaries of large company groups can benefit from certain simplifications of the legislation. 

Article 8 of the Whistleblower Directive provides that medium-sized companies can join forces to operate a common whistleblowing system and share capacities both for receiving reports and for subsequent investigative measures.

Given that the subsidiary has less than 250 employees, the Commission also interprets that, under certain conditions, the company (subsidiary) can fall back on the group’s central investigative body and don’t have to carry out their own investigations when they receive a report. The subsidiary, however, still has to:

  • Offer their own reporting channels;
  • Inform the whistleblower about the submission of the investigation to the central office;
  • Follow-up measures and queries to the whistleblower still take place exclusively at the level of the subsidiary.

Central, decentralized, regional, all of the above?

The implementation of this new legislation might come up as tricky for large Organizations. 

  • It will no longer be sufficient for groups with subsidiaries based in the EU to exclusively operate a centrally organized whistleblowing system if they have more than 50 employees. Even with the relief mentioned for mid-size subsidiaries under 250 employees, the positioning of the EU Commission calls for a considerable amount of additional work for Organizations with large corporate structures when reorganizing their whistleblowing systems. 
  • In many cases, it will be necessary to train additional Case Managers to be able to receive and process reports not only centrally, but also regionally in the respective subsidiary, at the request of the whistleblower.

How Whispli can help

The new requirements of the Commission can be challenging to put into practice, especially for companies with cross-company matrix structures. In the meantime, non-compliance with the requirements of the Directive will result in a negative impact on the Organization’s reputation as well as encourage whistleblowers to turn to external reporting solutions (state-run), which is surely not in the company’s best interest. Here is how technology can help you comply:

✅Reporting Channels per entity/country: with Whispli, you can modify, duplicate or create as many new Reporting Forms to gather Reports as you need for each of your subsidiaries/entities.  

✅Automatic Triage of Reports: you can define your own triage rules to automatically allocate a Report to local Case Managers based on the entity of the whistleblower.

Common Dashboards: running a decentralized system doesn't mean you should lose visibility over the Reports coming through your different subsidiaries. Set up custom dashboards to view in real-time how many Reports were received in each of your entities, about which topic, who is managing which Reports etc. 


In conclusion, companies that want to combine a whistleblowing system that meets the requirements of the Whistleblower Directive with the advantages of a central or regional solution will have to supplement their existing system and combine the various design options.

Having a platform allowing your Organization to run decentralized reporting channels while being able to monitor incoming Reports and their investigations at a centralized level might be of interest to you.

Discover how Whispli can help you comply with the EU Directive and allow your Organization to introduce a safe way to let your employees speak up:

Schedule a demo
1. source