> Switzerland never adopted a whistleblower protection statute, and in 2024 Parliament declined to try again. Swiss case law, corporate criminal liability and EU subsidiaries make an internal whistleblowing channel necessary anyway. What a Swiss channel has to get right. Source: https://ethicsportal.eu/blog/whistleblowing-channel-switzerland/ Updated: 2026-10-12 --- # Switzerland has no whistleblower law. Swiss companies still need a whistleblowing channel Switzerland has no whistleblower protection statute. The Federal Council's revision of the Code of Obligations was rejected by the National Council on 5 March 2020, 147 votes to 42. A motion asking for a new private-sector framework was rejected on 27 February 2024, with the Federal Council opposed. EU Directive 2019/1937 does not reach Switzerland through the bilateral agreements. For most Swiss companies, no law requires a whistleblowing channel. Case law and the criminal code still make one necessary, and some companies are required to run one. The statutory detail is on our [Switzerland law page](/whistleblower-laws/switzerland/). --- ## Swiss case law expects reports to go inside first Without a statute, the Federal Supreme Court decides when a report is lawful. It applies a cascade. An employee must first raise the matter inside the company. A report to an authority is justified only when the internal attempt fails or would plainly be futile. Going public comes last. FINMA states the rule in its own guidance for reporters: "you are fundamentally required first of all to attempt to report the suspected irregularity within the institution concerned." It warns that a reporter who skips that step risks prosecution for breach of confidentiality. A company with a working internal channel is where reports arrive. A company without one has made the internal step futile, which is the condition that justifies going to an authority or the press. The company then learns about the matter last. For the employee, Article 321a of the Code of Obligations binds them to loyalty and confidentiality. If they are dismissed for a report, Article 336a caps the compensation at six months' salary, and the dismissal stands. A channel that visibly works is what makes reporting inside worth the risk. ## The criminal law asks what the company organised Article 102 paragraph 2 of the Swiss Criminal Code punishes the company itself for bribery, money laundering, terrorist financing and criminal-organisation offences when it "failed to take all the reasonable organisational measures that are required in order to prevent such an offence". The fine can reach CHF 5 million, whether or not any individual is convicted. Swiss law does not list the measures. A company that had no way for staff to tell it about a bribe is arguing from a weak position about the measures it did take. The 2023 Swiss Code of Best Practice for Corporate Governance puts it in one line for boards: employees should be able to report suspected irregularities "to an independent internal or external body without expecting disadvantages." ## Two cases where a channel is mandatory **Supply-chain due diligence.** Companies that import or process tin, tantalum, tungsten or gold above the ordinance's thresholds, or that offer products or services with a reasonable suspicion of child labour, must run a reporting procedure under Article 14 of the due diligence ordinance (SR 221.433). It must be open to "all interested persons", so people outside the company can use it too. The reports must be documented. **EU subsidiaries.** The Directive's 50-worker threshold applies to each legal entity. A Swiss group with a 120-person subsidiary in Germany owes that subsidiary a channel under the German HinSchG, whatever the parent does. The group can serve several entities from one system, but each in-scope EU entity carries its own national obligations. The country-by-country detail is on the [law pages](/whistleblower-laws/). ## What a Swiss channel has to get right An EU template adopted as it stands gives Swiss staff wrong advice in four places. - **The external route.** EU policies tell reporters they may go to the competent authority at any time, with no duty to report internally first. That reverses the Swiss cascade and could expose an employee who relies on it. A Swiss policy explains the cascade. Switzerland has no general external authority: FINMA receives reports on financial market law, the Swiss Federal Audit Office on the federal administration, and the prosecution authorities on crimes. - **Retaliation.** The Directive's reversed burden of proof and its liability shield do not exist in Swiss law. A Swiss policy can still prohibit retaliation as the company's own commitment, and it should say that this is what it is. - **Data protection.** The governing law is the Federal Act on Data Protection (FADP), and the supervisory authority is the FDPIC. Article 19(4) FADP requires the privacy notice to name every state the data is disclosed to, so "hosted in the EU" is not enough. - **Where reports go.** Article 273 of the Criminal Code punishes making a trade secret available to a foreign official agency or a foreign private enterprise. A group that routes reports about a Swiss entity to an intake team abroad needs to answer that question before it chooses a system. The Directive is still the best available benchmark for the parts Swiss law leaves open. Acknowledging a report within seven days and giving feedback within three months is what makes an internal channel credible to the people the cascade sends to it. ## EthicsPortal for Swiss entities EthicsPortal now operates whistleblowing channels for organizations registered in Switzerland. When the operating entity is Swiss, the generated documents follow Swiss law: - The whistleblower policy explains the cascade and the sector authorities, and presents retaliation protection as the organization's own commitment. - The privacy notice is written under the FADP, names the FDPIC, and names Germany as the state where reports are stored, along with France and the Netherlands, where the email and monitoring suppliers sit. All three are recognised by the Federal Council as providing adequate data protection. - The compliance certificate and report describe the Directive as a voluntarily applied standard and do not claim compliance with a Swiss whistleblower law. - The [data processing agreement](/dpa/) includes the terms the FADP requires for processors. Reports are stored by [Hetzner in Germany](/subprocessors/) under a processing contract, and report text, reporter details, intake answers and attachments are encrypted in the application. We know of no court decision on whether storage by a contracted processor abroad is "making a secret available" under Article 273. The Federal Supreme Court treats a secret as made available once the recipient could learn it, but requires a connection to Switzerland and notes that prevailing doctrine applies Article 273 with restraint ([BGE 141 IV 155](https://www.bger.ch/ext/eurospider/live/de/php/clir/http/index.php?highlight_docid=atf%3A%2F%2F141-IV-155%3Ade&lang=de&type=show_document)). The part the organization controls is who reads the reports: only the people it adds can open them, so a Swiss entity can keep case handling in Switzerland. Reporters can submit in any of the 14 interface languages, including German, French and Italian, anonymously and without an account, and follow up through an access code. [Set up your whistleblowing channel →](/pricing/)