EU whistleblower directive penalties by country #
EU Directive 2019/1937 requires all companies with 50+ employees to establish internal reporting channels. Every EU member state has transposed the directive into national law with its own penalty regime.
Non-compliance is not theoretical. In March 2025, the EU Court of Justice fined five member states a combined €38.9 million just for being late to implement the law. Companies that fail to comply face their own penalties under national law.
Penalties at a glance #
| Country | No whistleblowing channel | Retaliation | Criminal liability | Law |
|---|---|---|---|---|
| Spain | Up to €1,000,000 | Up to €1,000,000 | No | Ley 2/2023 |
| France | — | €60,000 + 3 years prison | Yes | Loi Waserman (2022-401) |
| Poland | PLN 5,000 (~€1,200) | Obstruction: PLN 1,080,000 (~€250,000) + up to 1 year prison. Retaliation: up to 2 years prison | Yes | Ustawa z dnia 14 czerwca 2024 |
| Portugal | Up to €125,000 | Up to €250,000 | No | Lei 93/2021 |
| Italy | €10,000–€50,000 | €10,000–€50,000 | No | D.Lgs. 24/2023 |
| Germany | €20,000–€50,000 (10x for legal entities) | Up to €50,000 | No | HinSchG |
| Romania | RON 3,000–30,000 (~€600–6,000) | Obstruction: RON 2,000–20,000 (~€400–4,000) | No | Legea 361/2022 |
| Slovenia | €2,000–€6,000 | €5,000–€60,000 | No | ZZPri |
Country details #
Spain — Law 2/2023 #
Law: Ley 2/2023, de 20 de febrero — protection of persons who report regulatory infringements and the fight against corruption.
Applies to: Companies with 50+ employees. Deadline was June 13, 2023 (250+ employees) and December 1, 2023 (50–249 employees). Source: Garrigues
Penalties:
- Not establishing an internal reporting channel: €600,000–€1,000,000 for legal entities. Source: CMS Expert Guide
- Breaching whistleblowing channel obligations: €100,000–€1,000,000 for legal entities; €1,000–€300,000 for individuals. Source: CMS Expert Guide
- Additional sanctions: public warning, prohibition from subsidies/tax benefits for up to 4 years, and possible suspension of operating licenses. Source: Garrigues
Enforcement authority: Autoridad Independiente de Protección del Informante (A.A.I.)
Spain has the harshest penalties in the EU for whistleblower non-compliance.
France — Loi Waserman #
Law: Loi n° 2022-401 du 21 mars 2022 (Loi Waserman) , amending Loi Sapin II (2016-1691) .
Applies to: Companies with 50+ employees. In effect since September 2022. Source: IntegrityLine
Penalties:
- Obstructing a report: up to €60,000 fine and 1 year imprisonment. Source: Whispli
- Retaliation or discrimination against a whistleblower: up to €60,000 fine and 3 years imprisonment. Source: JP Karsenty
France is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Key difference: Whistleblowers in France are no longer required to use internal channels before going to external authorities (end of “cascade reporting”). Source: IntegrityLine
Germany — HinSchG #
Law: Hinweisgeberschutzgesetz (HinSchG) — entered into force July 2, 2023.
Applies to: Companies with 50+ employees. Deadline was July 2, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Fines enforceable since December 1, 2023. Source: Library of Congress
Penalties:
- Not establishing a whistleblowing channel: fines of €20,000–€50,000 per Section 40 HinSchG. Source: Ebner Stolz
- For legal entities, fines can increase tenfold (up to €500,000) per Section 40(6). Source: activeMind
- Retaliation against whistleblowers: up to €50,000. Source: Morrison Foerster
Note: Germany was fined €34,000,000 by the EU Court of Justice in March 2025 for late transposition of the directive. Source: eucrim
Italy — D.Lgs. 24/2023 #
Law: Decreto Legislativo 10 marzo 2023, n. 24 .
Applies to: Companies with 50+ employees (and all companies with a Model 231 compliance program regardless of size). Deadline was July 15, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Source: Norton Rose Fulbright
Penalties:
- Not establishing whistleblowing channels or non-compliant procedures: €10,000–€50,000. Source: Norton Rose Fulbright
- Retaliation or obstruction of reporting: €10,000–€50,000. Source: Hogan Lovells
- Breaching confidentiality of reporter identity: €10,000–€50,000. Source: Norton Rose Fulbright
- False reporting by whistleblower: €500–€2,500. Source: Norton Rose Fulbright
Enforcement authority: ANAC (Autorità Nazionale Anticorruzione). ANAC issued its first enforcement action in July 2024 (Decision No. 380, retaliation case). Source: ANAC via Cleary Gottlieb
Poland — Act of 14 June 2024 #
Law: Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów — entered into force September 25, 2024.
Applies to: Employers with 50+ employees. Internal procedures required by January 1, 2025. Source: DLA Piper
Penalties:
- Not establishing internal reporting procedures: fine of PLN 20–5,000 (~€5–€1,200) as a misdemeanor. Management board members are personally liable. Source: RSM Poland
- Preventing or obstructing reporting: fine up to PLN 1,080,000 (~€250,000), restriction of liberty, or up to 1 year imprisonment. With violence or threats: up to 3 years. Source: Clifford Chance
- Retaliation: fine, restriction of liberty, or up to 2 years imprisonment. Source: Kochański & Partners
- Disclosing whistleblower identity: fine, restriction of liberty, or up to 1 year imprisonment. Source: DLA Piper
Enforcement authority: Independent Authority for Whistleblower Protection (Rzecznik Praw Sygnalistów) — operations commence September 1, 2025. Source: Wozniak Legal
Poland is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Portugal — Law 93/2021 #
Law: Lei n.º 93/2021, de 20 de dezembro — General Regime for the Protection of Whistleblowers.
Applies to: Companies with 50+ employees. Penalty regime enforceable since June 7, 2024. Source: IntegrityLine
Penalties:
- Not establishing whistleblowing channels (serious offence): fines up to €125,000. Source: IntegrityLine
- Retaliation, obstruction, or breach of confidentiality (very serious offence): fines up to €250,000. Source: Lei 93/2021, art. 27.º
Enforcement authority: MENAC (Mecanismo Nacional Anticorrupção). Electronic platform became operational November 2024. Received 152 reports in 2024. Focus shifting to private sector enforcement in 2025. Source: European Commission Rule of Law Report 2025
Romania — Legea 361/2022 #
Law: Legea nr. 361/2022 privind protecția avertizorilor în interes public — transposing Directive (EU) 2019/1937.
Applies to: All public-sector entities regardless of headcount; private-law entities with 50+ employees; certain Annex 3 sector entities (financial services, AML, insurance) regardless of size. Deadline was December 22, 2022 (public sector and 250+ employees) and December 17, 2023 (50–249 employees). Source: ANI
Penalties (administrative contraventions under Art. 28–29):
- Not establishing internal reporting channels: RON 3,000–30,000 (~€600–6,000). Source: Legea 361/2022, Art. 28(2)(c)
- Obstructing or preventing a report: RON 2,000–20,000 (~€400–4,000).
- Breaching whistleblower confidentiality: RON 4,000–40,000 (~€800–8,000).
- Knowingly false reporting: RON 2,500–30,000 (~€500–6,000).
Enforcement authority: Agenția Națională de Integritate (ANI) .
Honest assessment of enforcement: No public record of any company being fined specifically for a missing internal channel has surfaced, and enforcement to date appears reactive rather than audit-driven. ANI registered 329 external reports in 2025 (188 in domains regulated by Legea 361/2022) — reports received by the authority, not sanctions issued against employers. Independent analysis (CEELI Institute, 2023 ) documents a gap between the law on paper and its implementation. The real exposure is a report reaching ANI with no internal channel in place, not a large fine.
Slovenia — ZZPri #
Law: Zakon o zaščiti prijaviteljev (ZZPri) , Uradni list RS no. 16/23 — in force 22 February 2023.
Applies to: Public and private sector entities with 50+ employees (Art. 9(2)), dropping to 10+ employees where the principal registered activity is healthcare, or water supply, sewerage and waste management (Art. 9(3)). Deadlines were 23 May 2023 (public sector and 250+ employees) and 17 December 2023 (50–249 employees).
Penalties (Slovenia bands fines by offender size as well as by offence):
- No internal reporting channel, channel not described in the internal act, or a missed annual return: €3,000–€6,000 for medium and large companies, €2,000–€4,000 for other legal entities, €1,000–€2,000 for sole traders, €300–€2,000 for the responsible person.
- Trying to establish the reporter’s identity, or threatening or attempting retaliation: the same bands.
- Carrying out a retaliatory measure: €10,000–€60,000 for medium and large companies, €5,000–€20,000 for other legal entities, €3,000–€15,000 for sole traders, €500–€2,500 for the responsible person.
- Disclosing the identity of a reporter, facilitator or connected person: €300–€2,500.
- Knowingly false reporting by the reporter: €400–€1,200, prosecuted by the external reporting authority that handled the report.
Source: KPK official guidance on ZZPri (PDF)
Enforcement authority: Komisija za preprečevanje korupcije (KPK) , which prosecutes the systemic offences and is the catch-all external reporting authority where no sectoral regulator has jurisdiction.
The obligation most often missed: Art. 9(16) requires every obliged employer to file an annual return to the KPK by 1 March for the preceding year — reports received, how many anonymous, how many well-founded, retaliation cases handled, and who the zaupnik is. Missing it is the same offence band as having no channel at all. Slovenia also requires the zaupnik to be appointed from among the employer’s own employees; the role cannot be outsourced.
EU Court of Justice fines against member states (March 2025) #
Five EU countries were fined by the Court of Justice for failing to transpose the directive on time:
| Country | Lump sum fine | Daily penalty |
|---|---|---|
| Germany | €34,000,000 | — |
| Czech Republic | €2,300,000 | — |
| Hungary | €1,750,000 | — |
| Estonia | €500,000 | €1,500/day |
| Luxembourg | €375,000 | — |
Source: eucrim — Source: CJEU press release (PDF)
All 27 member states #
All EU member states have now transposed the directive. See our complete reference:
Whistleblower laws in all 27 EU member states →
Every country’s national law name, link to official text, penalties, deadlines, and enforcement authority.
Enforcement is accelerating #
Most member states only finished transposing the directive in 2023–2024. Enforcement authorities are now operational and actively issuing guidance:
- Italy: ANAC issued its first retaliation fine in July 2024 and published updated enforcement guidelines in November 2025.
- Portugal: MENAC’s electronic enforcement platform went live in November 2024, with private sector focus in 2025.
- Poland: Independent enforcement authority launches September 2025.
- Germany: Fines enforceable since December 2023.
- Spain: Fines enforceable since June 2023.
- Slovenia: The KPK prosecutes the systemic offences and collects an annual return from every obliged employer, which gives it a direct view of who has not established a channel.
- Romania: ANI is the enforcement authority, but no public record of a company fined for a missing channel has surfaced; enforcement remains reactive and complaint-driven. ANI logged 329 external reports in 2025.
The window to get compliant before active enforcement is closing.
Get compliant now #
EthicsPortal gives your organization a secure internal reporting channel for EU Directive 2019/1937 compliance: encrypted, anonymous, and deadline-tracked.
See how we meet every requirement | Deploy your internal reporting channel
Last updated: April 2026. Penalty amounts and enforcement status are based on publicly available legal sources linked above. Contact legal@ethicsportal.eu if you spot an error.
Last updated: