All companies with 50 or more employees are required to have an internal whistleblower channel, regardless of their activity or turnover, as of December 1, 2023.
All companies with 50 or more employees are required to have an internal whistleblower channel, regardless of their activity or turnover, as of December 1, 2023.
According to Law 2/2023 of February 20, 2023, regulating the protection of persons who report regulatory violations and the fight against corruption, also known as the whistleblower channel law, companies with 50 or more employees must comply with the whistleblower channel obligation.
What is a whistleblower channel?
An internal whistleblowing channel, or information channel, consists of an alert system. It alerts the unit responsible for regulatory compliance about suspected malpractices in the management of a company or organization. The aim is to identify such alleged malpractices that may pose a risk to the corporation and to combat them. In this channel, whistleblowers transmit the information through a secure system that should prevent leaks that could damage the company’s reputation.
Some of the situations that could be reported through this channel are:
- Possible conducts and behaviors considered illegal in the performance of the job.
- Presumed lucrative management of company resources.
- Situations of discrimination or sexual abuse
- Corrupt practices, theft, fraud, etc.
Which companies are obliged to set up an internal whistleblower channel, in addition to those with 50 employees?
In addition to all companies with less than 50 employees, companies with fewer employees must also have a whistleblower channel if they meet any of these characteristics:
- Legal entities of the private sector that fall within the scope of application of the acts of the European Union regarding financial services, products and markets, prevention of money laundering or financing of terrorism, transport security and environmental protection, regardless of the number of employees they have. Legal entities that, despite not having their domicile in national territory, carry out activities in Spain through branches or agents or through the provision of services without a permanent establishment, will be considered as included in the previous paragraph.
- Companies that have a compliance plan, regardless of the number of employees.
- Political parties, trade unions, employers’ associations and foundations created by them, provided that they receive or manage public funds.
- Companies and public bodies with more than 250 employees and local authorities that provide services to more than 10,000 citizens.
In the case of a group of companies, in accordance with Article 42 of the Commercial Code, the controlling company shall approve a general policy regarding the internal information system referred to in Article 7 and the defense of the informant. In addition, it shall ensure the application of its principles in all the entities that comprise it, without prejudice to the autonomy and independence of each company, subgroup or set of member companies that may establish the respective corporate governance or group governance system, and the modifications or adaptations that may be necessary for compliance with the applicable regulations in each case.
Requirements for the whistleblower channel
In addition to being effectively secure and ensuring transparency in its operation, any communication channel must meet five fundamental requirements:
- Ensure the anonymity of the informant and guarantee the confidentiality of his or her data.
- To have a person responsible for managing it.
- Send the acknowledgement of receipt to the informant (complainant) within a maximum of seven calendar days from receipt of the complaint.
- Respond to the complaint within a maximum period of three months from the acknowledgement of receipt or, from the expiration of the seven-day period after the complaint is made. This is excepted in cases of special complexity that require an extension of the deadline. In this case, it may be extended up to a maximum of three additional months.
- Allowing external access from outside the corporate network. Not only internal employees have the right to report. The channel must offer the possibility of being used by any counterparty interested in the company. The recommendation is to extend this coverage once the proper functioning of the previous four points has been consolidated and verified.
The complaints channel must also comply with deadlines and schedules based on the possible information or incidents that are communicated through the channels.
For further information, please consult with Legal Department
