Whistleblower compliance for financial services #

Financial institutions operate under the EU Whistleblower Directive and sector-specific regulations that independently require internal reporting channels. Non-compliance exposes firms to penalties from both national transposition laws and financial regulators.

Regulations that require reporting channels #

• EU Directive 2019/1937 — requires confidential reporting channels, 7-day acknowledgment, and 3-month feedback deadlines. The 50-employee threshold that applies to most private-sector firms does not apply to regulated financial entities: under Article 8(4), entities within the scope of the Union financial-services and anti-money-laundering acts listed in Parts I.B and II of the Annex must operate an internal reporting channel irrespective of headcount. A supervised firm with 20 employees carries the same obligation as one with 2,000.
• MiFID II (2014/65/EU) — Article 73 requires investment firms to have procedures for employees to report potential breaches internally. National regulators enforce this independently of the Whistleblower Directive.
• Market Abuse Regulation (EU 596/2014) — Article 32 requires member states to establish mechanisms for reporting actual or potential market abuse. Firms must ensure internal channels exist so employees can report before going to regulators.
• Anti-Money Laundering Directives (AMLD 4/5/6) — require internal reporting procedures for suspicious transactions. The upcoming AMLD package (2024) strengthens whistleblower protections for AML reporting.
• Solvency II (2009/138/EC) — Article 71 requires insurers to maintain whistleblowing procedures.

Sector regulators with enforcement powers #

These regulators can impose fines independently of national whistleblower authorities.

Procurement under DORA #

Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025. It does not require a reporting channel — but for financial entities within its scope, it governs how one is procured. Whistleblowing software is an ICT service, so the engagement runs through your ICT third-party risk process rather than as an ordinary software purchase.

In practice:

• The engagement is recorded in your Register of Information and reported to your competent authority.
• Article 30 contractual provisions apply. Which set — the baseline in Article 30(2), or the extended requirements in Article 30(3) — depends on whether the service is classified as supporting a critical or important function. That classification is the financial entity’s determination, not the vendor’s.
• Audit, access, and inspection rights must extend to your competent authority, not only to you.
• Subcontracting, incident reporting, service levels, and a documented exit strategy must be addressed contractually.

Most of what a DORA third-party assessment asks for is published rather than released on request: the subprocessor list , security architecture , business continuity plan , incident register , and the data export and deletion terms in the DPA .

What gets reported #

• Market manipulation and insider trading
• AML/KYC procedure failures
• Mis-selling of financial products
• Sanctions evasion
• Unauthorized trading or risk limit breaches
• Conflicts of interest in advisory roles

Why a dedicated channel matters #

Financial sector employees who report through general HR channels risk having their disclosure misrouted to the person responsible for the breach. Article 9 of the Directive requires channels that protect confidentiality and prevent conflicts of interest — critical in organizations where compliance, trading, and management overlap.

Deploy your reporting channel →

Last updated: August 24, 2026