Spain’s whistleblower authority — AIPI #

The Autoridad Independiente de Protección del Informante, A.A.I. (AIPI) is the Spanish state body that operates the national external reporting channel, grants protection against retaliation, and exercises the power to sanction under Ley 2/2023.

This page is a reference on the authority itself: what it is, what it can and cannot do, how a report is filed, which deadlines apply, and what happens next. For the duty to operate an internal reporting system, the thresholds and the penalties, see whistleblower law in Spain .

What the AIPI is #

The law gives it full autonomy and organic and functional independence from the Government, the public sector and other public powers (art. 42.1). The president holds the rank of subsecretario, is appointed by royal decree on the proposal of the Ministry of Justice for a five-year, non-renewable term that cannot be extended, and the appointment must be ratified by an absolute majority of the relevant committee of the Congreso de los Diputados within one month (art. 53.2). The president is advised by a Comisión Consultiva that includes representatives of the Tribunal de Cuentas and the Consejo de Transparencia y Buen Gobierno, among others (art. 54).

One feature of its funding is worth knowing: its resources include a percentage — set in the State Budget Act — of the fines it itself imposes (art. 47.2.c).

Functions #

Article 43 gives it five functions:

1. Operating the external channel governed by Title III.
2. Adopting protection measures for reporting persons within its competence (art. 41).
3. Issuing a mandatory opinion on draft general provisions affecting its remit.
4. Conducting sanctioning procedures and imposing penalties for the infringements in Title IX.
5. Promoting a culture of reporting.

The president may also issue circulars and recommendations; circulars are binding once published in the BOE (art. 51).

What it can and cannot do #

Material scope #

Ley 2/2023 protects people who report (art. 2):

• Acts or omissions that may constitute breaches of EU law within the annex to Directive (EU) 2019/1937, that affect the EU’s financial interests (art. 325 TFEU), or that concern the internal market (art. 26(2) TFEU), including competition, State aid and corporate-tax avoidance practices.
• Acts or omissions that may constitute a criminal offence or a serious or very serious administrative infringement.

The second limb is broader than the Directive’s minimum: in Spain the external channel covers any criminal offence or serious/very serious administrative infringement, not only the annex subject matters.

How competence is split with the regional authorities #

The AIPI is not competent for everything. Article 24 divides it:

In practice: a breach at a company operating in a single autonomous community that has its own authority belongs to that authority, not the AIPI. Ten autonomous communities have their own legislation — among them Andalusia, Asturias, Catalonia, Castilla-La Mancha, Castilla y León, Galicia, Madrid, Navarre, the Basque Country and the Valencian Community — with bodies such as the Oficina Antifrau de Catalunya and the Oficina Andaluza contra el Fraude y la Corrupción.

Any authority that receives a report it is not competent for must forward it to the AIPI within ten days and tell the reporting person within that same period (art. 23).

Limits #

• Its decisions on a report cannot be appealed, either administratively or before the contentious-administrative courts (art. 20.4). Only the decision closing any sanctioning procedure that follows can be challenged.
• Filing a report does not by itself make someone an interested party in the procedure (art. 20.5).
• The AIPI does not resolve the employment dispute or award compensation: it adopts protection measures and, where appropriate, sanctions. Individual claims go to the competent courts.

How to report through the external channel #

Any natural person may report to the AIPI directly, or after using the internal channel (art. 16.1). There is no obligation to exhaust the internal channel first.

A report may be filed (art. 17.2):

• In writing, by post or by any electronic means provided for the purpose.
• Orally, by telephone or through a voice-messaging system.
• At an in-person meeting, at the reporting person’s request, within a maximum of seven days.

For oral reports the reporting person is warned that the communication will be recorded and informed about the processing of their data.

Reports may be anonymous (art. 17.1). Where they are not, the reporting person’s identity is withheld and is not disclosed to third parties or to the person concerned (arts. 21 and 33).

Article 21 also gives the reporting person the right to designate an address, email or safe place for notifications, to waive receiving communications, to appear assisted by a lawyer, and to ask that any appearance be held by videoconference or other secure electronic means.

The AIPI states that the secure external channel reachable from its electronic office is the recommended route; ordinary email and post do not carry the same confidentiality guarantees.

Deadlines #

The external-channel deadlines are not the same as the internal ones. This is the most common confusion.

The external channel’s three-month deadline cannot be extended. The internal one can, up to six months in total.

The acknowledgment may be omitted where the reporting person has expressly waived communications, or where the AIPI reasonably considers that acknowledging receipt would compromise protection of their identity (art. 17.4).

What happens after a report #

1. Registration and admissibility #

Once registered, the AIPI checks whether the facts fall within the scope of article 2 and decides, within no more than ten working days, whether to reject the report, admit it, refer it to the public prosecutor, or transfer it to the competent authority (art. 18.2).

Grounds for inadmission (art. 18.2.a):

1. The facts reported are wholly implausible.
2. The facts do not constitute an infringement within the scope of the law.
3. The report is manifestly unfounded, or there are reasonable indications it was obtained through a criminal offence — in which case a reasoned account is also sent to the public prosecutor.
4. It contains no new and significant information compared with an earlier report whose procedures have concluded, absent new circumstances of fact or law.

Inadmission is notified with reasons, unless the report was anonymous or the reporting person waived communications.

2. Investigation #

The investigation covers the steps needed to verify the plausibility of the facts (art. 19). The person concerned is told of the facts in summary form and of their right to submit written submissions, although that notice may be deferred to the hearing stage where giving it earlier could help conceal, destroy or alter evidence.

The reporting person’s identity is never disclosed to the person concerned, who is also given no access to the report itself.

3. Closure #

Once the steps are complete, the AIPI issues a report and takes one of the following decisions (art. 20.2):

• Closing the file. The reporting person keeps the law’s protection, unless the investigation shows the report should have been rejected on one of the art. 18.2.a) grounds.
• Referral to the public prosecutor, or to the European Public Prosecutor’s Office where the EU’s financial interests are affected.
• Transfer to the competent authority.
• Opening a sanctioning procedure under Title IX.

The decision is communicated to the reporting person, unless they waived it or the report was anonymous.

How internal and external reporting interact #

• The reporting person may choose the external channel from the outset (art. 16.1).
• Obliged entities must give clear, accessible information about their internal channel and about the external channels before the competent authorities. Where they have a website, that information must appear on the home page in a separate, easily identifiable section (art. 25).
• Public disclosure is protected (art. 28) where the matter was first reported internally and externally, or directly externally, without appropriate action being taken in time; or where there are reasonable grounds to believe the breach is an imminent or manifest danger to the public interest, that there is a risk of irreversible harm, a risk of retaliation, or little prospect of the report being handled effectively.

Protection against retaliation #

The AIPI provides the Title VII support measures for breaches committed in the private sector and the state public sector; the regional bodies do so within their own scope (art. 41).

A person who reports or discloses information in accordance with the law incurs no liability for that report, provided they had reasonable grounds to believe it was necessary to reveal the act or omission, without prejudice to criminal liability (art. 38). The protection extends to the acquisition of, or access to, the information reported.

The person concerned retains the presumption of innocence, the right of defence, access to the file, and the same confidentiality protection as the reporting person (art. 39).

Someone who took part in the infringement and reports it before being notified that proceedings have been opened may be exempted from, or have their administrative penalty reduced, provided they ceased the conduct, cooperated fully and diligently, and supplied truthful and relevant information (art. 40).

Sanctioning powers #

The AIPI exercises the power to sanction the infringements in Title IX (art. 52). The fines in article 65 reach €1,000,000 for legal persons for very serious infringements — a category that includes failing to have an internal reporting system (art. 63.1.g) — with the possible addition of a public reprimand, a ban on obtaining subsidies or tax benefits for up to 4 years, and a ban on contracting with the public sector for up to 3 years (art. 65.2).

Very serious infringements become time-barred after three years, serious ones after two, and minor ones after six months (art. 64).

Thresholds, implementation deadlines and the real state of enforcement are covered on the Ley 2/2023 page .

Official contact details #

To file a report or request protection, the AIPI directs people to the secure external channel on its website, not to the general email address.

Official sources #

• Ley 2/2023, de 20 de febrero — consolidated BOE text
• Real Decreto 1101/2024, de 29 de octubre — AIPI Statute
• Orden PJC/908/2025, de 8 de agosto — date the AIPI began operating
• Real Decreto 328/2025, de 15 de abril — appointment of the president
• AIPI — what it is
• AIPI — functions
• AIPI — competence
• AIPI — how to report
• AIPI — report-handling procedure
• AIPI — sanctioning procedure
• AIPI — president
• AIPI — contact

Last updated: September 20, 2026