On 21st February 2023, the Spanish Congress passed Law 2/2023 of 20 February on the protection of whistleblowers and the fight against corruption. This finally transposes European Directive 2019/1937 of the European Parliament and of the Council of 23 October 2019, known as the “Whistleblowing Directive”.
The fundamental objective of the law is to protect persons who report possible wrongdoing or irregularities from retaliation. It establishes minimum standards for reporting channels and internal investigation procedures and regulates the system of whistleblower management and protection.
Below you will find the answers to all the questions that this regulation may raise:
When does it apply?
The maximum period for the establishment of the internal information systems is three months from the entry into force of the law, which will be twenty days after its publication in the Official State Gazette.
As an exception, in the case of private sector legal entities with 249 or fewer employees, the deadline is extended to 1 December 2023.
Who are the obliged entities?
The entities obliged to have a complaints channel in the private sector:
- Natural or legal persons with 50 or more employees.
- Entities dedicated to intermediation with financial services, products, and markets, as well as the prevention of money laundering or the financing of terrorism, transport security and environmental protection, regardless of the number of employees.
Also included are entities that are not domiciled in national territory and that carry out their activities in Spain through branches or agents or by providing services without a permanent establishment. - Political parties, trade unions, business organizations and foundations created by them, provided that they receive or manage public funds.
- – In the case of groups of companies, the parent company will be the obliged entity, and this reporting channel must be extended to the rest of the companies in the group.
In the public sector, entities that are part of the public sector are also obliged to have an internal information system or whistle-blowing channel.
What should the Whistleblowing Channel look like?
- It should be a channel open internally and to suppliers or partners.
- The whistleblowing channel should allow for written or verbal whistleblowing, in the latter case, the whistleblowing should be recorded or transcribed completely and accurately.
- The internal whistleblowing channel should inform the whistleblower, in a clear and concise manner, about external reporting channels to the competent authorities.
- The anonymity of the whistleblower and the confidentiality of the entire file to which the complaint may give rise must be preserved.
- There must be a person in charge of the system.
- Access to information from the internal channel by unauthorized personnel is strictly forbidden.
Who can report?
For private sector entities:
- Employees, managers or any members of the company.
- Suppliers or business partners.
For public sector entities:
- All its members, regardless of the nature of their contractual relationship.
- Any third parties, i.e. it must be open to the public.
For what type of complaints should the channel be established?
Any irregularities that may constitute a serious or very serious criminal or administrative offence, understood as any breach of a contractual, legal, or regulatory nature, should be reported.
Likewise, any suspicion or certainty that a crime may have been committed within the organization must be reported.
Is the implementation of a Whistleblower Channel related to the implementation of a Criminal Compliance model?
As a result of the aforementioned regulations, it is not mandatory to implement a Criminal Compliance model, but it is highly advisable.
The establishment of a Criminal Compliance system promotes regulatory compliance in the organization and prevents the commission of crimes by employees, managers, and directors of the company, avoiding criminal liability and the imposition of sanctions on companies.
The law, on the other hand, requires the implementation of an Ethical or Whistleblowing Channel Protocol that regulates the management, processing and resolution of complaints and queries.
What can happen if the Whistleblowing Channel is not implemented?
The law includes an extensive list of sanctions in the event of failure to comply with the obligation to create a Whistleblowing Channel.
For individuals (self-employed persons with 50 or more employees) the following sanctions will be established:
- Fines of up to €10,000 for minor infringements.
- Fines of €10,000 to €30,000 for serious infringements.
- Fines of €30,001 to €300,000 for very serious infringements.
And, for legal persons, the following:
- Fines of up to €100,000 for minor infringements.
- Fines of 100,001 € to 600,000 € for serious infringements.
- Fines of €600,001 to €1 million for very serious infringements.
In case of data protection violations, fines of up to €20 million or 4% of the organization’s annual turnover are added.
This law aims to comply with European regulations, to protect citizens who report breaches of the legal system or internal rules of an entity, to create procedures and other internal regulations to regulate whistleblowing channels with the ultimate aim of making progress in the fight against corruption.
Do you want to solve this need?
IVC can provide you with the following services:
- Advice on the need to implement a Whistleblowing Channel. Management of the whistleblowing channel.
- Implementation of a Criminal Compliance Model.
- Legal and Compliance Consultancy.
