EU whistleblower directive penalties by country
EU Directive 2019/1937 requires all companies with 50+ employees to establish internal whistleblower reporting channels. Every EU member state has transposed the directive into national law with its own penalty regime.
Non-compliance is not theoretical. In March 2025, the EU Court of Justice fined five member states a combined €39 million just for being late to implement the law. Companies that fail to comply face their own penalties under national law.
Penalties at a glance
| Country | No reporting channel | Retaliation | Criminal liability | Law |
|---|---|---|---|---|
| Spain | Up to €1,000,000 | Up to €1,000,000 | No | Law 2/2023 |
| France | — | €60,000 + 3 years prison | Yes | Loi Waserman (2022-401) |
| Poland | PLN 5,000 (~€1,200) | Obstruction: PLN 1,080,000 (~€250,000) + up to 1 year prison. Retaliation: up to 2 years prison | Yes | Act of 14 June 2024 |
| Portugal | Up to €125,000 | Up to €125,000 | No | Law 93/2021 |
| Italy | €10,000–€50,000 | €10,000–€50,000 | No | D.Lgs. 24/2023 |
| Germany | €20,000–€50,000 (10x for legal entities) | Up to €50,000 | No | HinSchG |
Country details
Spain — Law 2/2023
Law: Ley 2/2023, de 20 de febrero — protection of persons who report regulatory infringements and the fight against corruption.
Applies to: Companies with 50+ employees. Deadline was June 13, 2023 (250+ employees) and December 1, 2023 (50–249 employees). Source: Garrigues
Penalties:
- Not establishing an internal reporting channel: €600,000–€1,000,000 for legal entities. Source: CMS Expert Guide
- Breaching reporting channel obligations: €100,000–€1,000,000 for legal entities; €1,000–€300,000 for individuals. Source: CMS Expert Guide
- Additional sanctions: public warning, prohibition from subsidies/tax benefits for up to 4 years, and possible suspension of operating licenses. Source: Garrigues
Enforcement authority: Autoridad Independiente de Protección del Informante (A.A.I.)
Spain has the harshest penalties in the EU for whistleblower non-compliance.
France — Loi Waserman
Law: Loi n° 2022-401 du 21 mars 2022 (Loi Waserman), amending Loi Sapin II (2016-1691).
Applies to: Companies with 50+ employees. In effect since September 2022. Source: IntegrityLine
Penalties:
- Obstructing a report: up to €60,000 fine and 1 year imprisonment. Source: Whispli
- Retaliation or discrimination against a whistleblower: up to €60,000 fine and 3 years imprisonment. Source: JP Karsenty
France is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Key difference: Whistleblowers in France are no longer required to use internal channels before going to external authorities (end of “cascade reporting”). Source: IntegrityLine
Germany — HinSchG
Law: Hinweisgeberschutzgesetz (HinSchG) — entered into force July 2, 2023.
Applies to: Companies with 50+ employees. Deadline was July 2, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Fines enforceable since December 1, 2023. Source: Library of Congress
Penalties:
- Not establishing a reporting channel: fines of €20,000–€50,000 per Section 40 HinSchG. Source: Ebner Stolz
- For legal entities, fines can increase tenfold (up to €500,000) per Section 40(6). Source: activeMind
- Retaliation against whistleblowers: up to €50,000. Source: Morrison Foerster
Note: Germany was fined €34,000,000 by the EU Court of Justice in March 2025 for late transposition of the directive. Source: eucrim
Italy — D.Lgs. 24/2023
Law: Decreto Legislativo 10 marzo 2023, n. 24.
Applies to: Companies with 50+ employees (and all companies with a Model 231 compliance program regardless of size). Deadline was July 15, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Source: Norton Rose Fulbright
Penalties:
- Not establishing reporting channels or non-compliant procedures: €10,000–€50,000. Source: Norton Rose Fulbright
- Retaliation or obstruction of reporting: €10,000–€50,000. Source: Hogan Lovells
- Breaching confidentiality of reporter identity: €10,000–€50,000. Source: Norton Rose Fulbright
- False reporting by whistleblower: €500–€2,500. Source: Norton Rose Fulbright
Enforcement authority: ANAC (Autorità Nazionale Anticorruzione). ANAC issued its first enforcement action in July 2024 (Decision No. 380, retaliation case). Source: ANAC via Cleary Gottlieb
Poland — Act of 14 June 2024
Law: Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów — entered into force September 25, 2024.
Applies to: Employers with 50+ employees. Internal procedures required by January 1, 2025. Source: DLA Piper
Penalties:
- Not establishing internal reporting procedures: fine of PLN 20–5,000 (~€5–€1,200) as a misdemeanor. Management board members are personally liable. Source: RSM Poland
- Preventing or obstructing reporting: fine up to PLN 1,080,000 (~€250,000), restriction of liberty, or up to 1 year imprisonment. With violence or threats: up to 3 years. Source: Clifford Chance
- Retaliation: fine, restriction of liberty, or up to 2 years imprisonment. Source: Kochański & Partners
- Disclosing whistleblower identity: fine, restriction of liberty, or up to 1 year imprisonment. Source: DLA Piper
Enforcement authority: Independent Authority for Whistleblower Protection (Rzecznik Praw Sygnalistów) — operations commence September 1, 2025. Source: Wozniak Legal
Poland is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Portugal — Law 93/2021
Law: Lei n.º 93/2021, de 20 de dezembro — General Regime for the Protection of Whistleblowers.
Applies to: Companies with 50+ employees. Penalty regime enforceable since June 7, 2024. Source: IntegrityLine
Penalties:
- Not establishing reporting channels: fines up to €125,000. Source: IntegrityLine
Enforcement authority: MENAC (Mecanismo Nacional Anticorrupção). Electronic platform became operational November 2024. Received 152 reports in 2024. Focus shifting to private sector enforcement in 2025. Source: European Commission Rule of Law Report 2025
EU Court of Justice fines against member states (March 2025)
Five EU countries were fined by the Court of Justice for failing to transpose the directive on time:
| Country | Lump sum fine | Daily penalty |
|---|---|---|
| Germany | €34,000,000 | — |
| Czech Republic | €2,300,000 | — |
| Hungary | €1,750,000 | — |
| Estonia | €500,000 | €1,500/day |
| Luxembourg | €375,000 | — |
Source: eucrim — Source: CJEU press release (PDF)
All 27 member states
All EU member states have now transposed the directive. See our complete reference:
Whistleblower laws in all 27 EU member states →
Every country’s national law name, link to official text, penalties, deadlines, and enforcement authority.
Enforcement is accelerating
Most member states only finished transposing the directive in 2023–2024. Enforcement authorities are now operational and actively issuing guidance:
- Italy: ANAC issued its first retaliation fine in July 2024 and published updated enforcement guidelines in November 2025.
- Portugal: MENAC’s electronic enforcement platform went live in November 2024, with private sector focus in 2025.
- Poland: Independent enforcement authority launches September 2025.
- Germany: Fines enforceable since December 2023.
- Spain: Fines enforceable since June 2023.
The window to get compliant before active enforcement is closing.
Get compliant now
EthicsPortal gives your organization a fully compliant whistleblower reporting channel in minutes — encrypted, anonymous, and built for EU Directive 2019/1937.
See how we meet every requirement | Start your portal
Last updated: April 2026. Penalty amounts and enforcement status are based on publicly available legal sources linked above. Contact support@ethicsportal.eu if you spot an error.