June 14, 2026

EU Whistleblower Directive: statistics and enforcement data (2026) #

A reference page of checked statistics on EU Directive 2019/1937 — the EU Whistleblower Directive. Every number below links to its original source: the Court of Justice of the EU, the European Commission, Eurostat, the ACFE’s annual fraud report, and peer-reviewed academic research. Each figure has a date, so you can see how recent it is.

If you are a journalist, analyst, or compliance officer who needs a number you can quote, this page is built for that. See Methodology and sources at the end for how it is put together and kept up to date.

Key statistics at a glance #

• ~306,000 organizations in the EU meet the Directive’s 50-employee threshold — 55,000 large enterprises (250+) plus roughly 251,000 medium ones (50–249). Eurostat, 2024
• €38.9 million in fines was ordered by the Court of Justice of the EU on 6 March 2025 against five member states for being late to put the Directive into national law. CJEU, March 2025
• 3 of 27 member states had fully put the Directive into national law by the first deadline of 17 December 2021. eucrim
• 43% of occupational frauds are first detected by a tip — more than three times any other detection method. ACFE, 2024
• 52% of fraud tips come from employees — the people an internal reporting channel exists to reach. ACFE, 2024
• €1,000,000 is the highest fine for not running a reporting channel. It is in Spain, which has the strictest rules in the EU. Law 2/2023
• €5.8–9.6 billion a year is the European Commission’s estimate of what the EU loses in public procurement alone for the lack of whistleblower protection. European Commission, 2017

The scale of the obligation #

The Directive requires every organization with 50 or more employees operating in the EU to run an internal reporting channel, plus all financial-services firms and many public bodies regardless of size (who must comply ).

Source: Eurostat structural business statistics, 2024 reference year (published December 2025). The ~306,000 figure counts private businesses only. It leaves out most public-sector bodies and financial firms, which must comply no matter how many employees they have — so the real number of organizations that must comply is higher.

How the law was adopted: a timeline #

To “transpose” a directive means to turn the EU law into a country’s own national law. Every member state had to do this for the Whistleblower Directive.

By mid-2024 all 27 member states had adopted transposing laws — Estonia and Poland were the last, in May 2024. European Commission

€38.9 million in fines for being late #

Each EU country had to turn the Directive into its own national law by a set deadline. Some countries were late. On 6 March 2025, the Court of Justice of the EU made five of them pay fines for the delay (cases C-149/23, C-150/23, C-152/23, C-154/23 and C-155/23):

Source: Court of Justice of the EU, press release 29/25 and eucrim .

Germany’s fine is so much larger than the others that the rest are barely visible on the same scale — which is the point.

These fines were paid by countries, not by companies. Companies face their own fines under each country’s national law — and those can be high too.

Company penalties: highest national maximums #

France and Poland attach criminal liability, including prison time, for retaliating against or obstructing a whistleblower. See the full penalties by country page for all 27 member states.

A working internal channel lowers litigation risk #

The largest academic study of internal reporting — Stubben and Welch’s analysis of close to 2 million reports across more than 1,000 US-listed companies — found that the more actively a firm used its internal whistleblowing system, the fewer material lawsuits it faced and the lower the settlement amounts it paid in later years. Heavier users were also more profitable. The mechanism is simple: an internal report surfaces a problem early, while management can still fix it, instead of surfacing later as a lawsuit or a press story. Stubben & Welch, Journal of Accounting Research, 2020

This is the business case behind the legal obligation: the channel is not only a compliance requirement but a risk-reduction control.

Why the channel matters: the fraud-detection evidence #

The Association of Certified Fraud Examiners studies occupational fraud worldwide. Its 2024 Report to the Nations makes the case for reporting channels in numbers:

• 43% of frauds are first detected by a tip — more than three times any other method. ACFE 2024
• Of those tips, 52% come from employees, 21% from customers, and 11% from vendors — all categories the Directive defines as protected reporting persons.
• The next-best detection methods trail far behind: internal audit (14%) and management (13%).
• 71% of victim organizations had an anonymous fraud-reporting hotline in place — yet fraud still ran a median of ~12 months before detection.

The data shows the same thing again and again: the best way to catch fraud is to give people a safe way to report it. The Directive makes that a legal requirement.

Methodology and sources #

This page is proof of work. Every number can be traced back to its original, official source — not a second-hand summary.

Sources used, and what each supports:

• Court of Justice of the EU, press release 29/25 (6 March 2025) — the €38.9 million in transposition fines and the per-country breakdown.
• European Commission — Protection of whistleblowers and COM(2024) 269 — transposition status and the 2024 implementation review.
• EUR-Lex — Directive (EU) 2019/1937 — the legal text, deadlines, and article references.
• Eurostat — enterprise counts and employment by size class (2024 reference year).
• ACFE Report to the Nations 2024 — fraud detection methods and tip sources.
• Stubben & Welch, Journal of Accounting Research (2020) — peer-reviewed evidence linking active internal reporting to fewer lawsuits, lower settlements, and higher profitability.
• European Commission — economic benefits of whistleblower protection in public procurement (2017) — the €5.8–9.6 billion annual EU procurement-loss estimate.
• National laws (linked inline) — company-level penalty figures, cross-checked against our maintained penalties by country page.

How to read the figures. EU institutional and Eurostat numbers are authoritative for the EU. The ACFE fraud figures and the Stubben & Welch study are global and US datasets, flagged as such. Currency conversions are approximate and noted with ~.

Last reviewed: 14 June 2026. Spotted a figure that has moved? Tell us — corrections are welcome and we update the source links when laws or reports change.

EthicsPortal is EU whistleblower compliance infrastructure: secure intake, deadline tracking under Article 9, confidentiality controls under Article 16, and audit-ready records under Article 18. See the Directive 2019/1937 coverage map for an article-by-article breakdown, or set up your portal .

Last updated: July 6, 2026