EU whistleblower directive penalties by country #
EU Directive 2019/1937 requires all companies with 50+ employees to establish internal whistleblower reporting channels. Every EU member state has transposed the directive into national law with its own penalty regime.
Non-compliance is not theoretical. In March 2025, the EU Court of Justice fined five member states a combined €39 million just for being late to implement the law. Companies that fail to comply face their own penalties under national law.
Penalties at a glance #
| Country | No reporting channel | Retaliation | Criminal liability | Law |
|---|---|---|---|---|
| Spain | Up to €1,000,000 | Up to €1,000,000 | No | Law 2/2023 |
| France | — | €60,000 + 3 years prison | Yes | Loi Waserman (2022-401) |
| Poland | PLN 5,000 (~€1,200) | Obstruction: PLN 1,080,000 (~€250,000) + up to 1 year prison. Retaliation: up to 2 years prison | Yes | Act of 14 June 2024 |
| Portugal | Up to €125,000 | Up to €125,000 | No | Law 93/2021 |
| Italy | €10,000–€50,000 | €10,000–€50,000 | No | D.Lgs. 24/2023 |
| Germany | €20,000–€50,000 (10x for legal entities) | Up to €50,000 | No | HinSchG |
Country details #
Spain — Law 2/2023 #
Law: Ley 2/2023, de 20 de febrero — protection of persons who report regulatory infringements and the fight against corruption.
Applies to: Companies with 50+ employees. Deadline was June 13, 2023 (250+ employees) and December 1, 2023 (50–249 employees). Source: Garrigues
Penalties:
- Not establishing an internal reporting channel: €600,000–€1,000,000 for legal entities. Source: CMS Expert Guide
- Breaching reporting channel obligations: €100,000–€1,000,000 for legal entities; €1,000–€300,000 for individuals. Source: CMS Expert Guide
- Additional sanctions: public warning, prohibition from subsidies/tax benefits for up to 4 years, and possible suspension of operating licenses. Source: Garrigues
Enforcement authority: Autoridad Independiente de Protección del Informante (A.A.I.)
Spain has the harshest penalties in the EU for whistleblower non-compliance.
France — Loi Waserman #
Law: Loi n° 2022-401 du 21 mars 2022 (Loi Waserman), amending Loi Sapin II (2016-1691).
Applies to: Companies with 50+ employees. In effect since September 2022. Source: IntegrityLine
Penalties:
- Obstructing a report: up to €60,000 fine and 1 year imprisonment. Source: Whispli
- Retaliation or discrimination against a whistleblower: up to €60,000 fine and 3 years imprisonment. Source: JP Karsenty
France is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Key difference: Whistleblowers in France are no longer required to use internal channels before going to external authorities (end of “cascade reporting”). Source: IntegrityLine
Germany — HinSchG #
Law: Hinweisgeberschutzgesetz (HinSchG) — entered into force July 2, 2023.
Applies to: Companies with 50+ employees. Deadline was July 2, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Fines enforceable since December 1, 2023. Source: Library of Congress
Penalties:
- Not establishing a reporting channel: fines of €20,000–€50,000 per Section 40 HinSchG. Source: Ebner Stolz
- For legal entities, fines can increase tenfold (up to €500,000) per Section 40(6). Source: activeMind
- Retaliation against whistleblowers: up to €50,000. Source: Morrison Foerster
Note: Germany was fined €34,000,000 by the EU Court of Justice in March 2025 for late transposition of the directive. Source: eucrim
Italy — D.Lgs. 24/2023 #
Law: Decreto Legislativo 10 marzo 2023, n. 24.
Applies to: Companies with 50+ employees (and all companies with a Model 231 compliance program regardless of size). Deadline was July 15, 2023 (250+ employees) and December 17, 2023 (50–249 employees). Source: Norton Rose Fulbright
Penalties:
- Not establishing reporting channels or non-compliant procedures: €10,000–€50,000. Source: Norton Rose Fulbright
- Retaliation or obstruction of reporting: €10,000–€50,000. Source: Hogan Lovells
- Breaching confidentiality of reporter identity: €10,000–€50,000. Source: Norton Rose Fulbright
- False reporting by whistleblower: €500–€2,500. Source: Norton Rose Fulbright
Enforcement authority: ANAC (Autorità Nazionale Anticorruzione). ANAC issued its first enforcement action in July 2024 (Decision No. 380, retaliation case). Source: ANAC via Cleary Gottlieb
Poland — Act of 14 June 2024 #
Law: Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów — entered into force September 25, 2024.
Applies to: Employers with 50+ employees. Internal procedures required by January 1, 2025. Source: DLA Piper
Penalties:
- Not establishing internal reporting procedures: fine of PLN 20–5,000 (~€5–€1,200) as a misdemeanor. Management board members are personally liable. Source: RSM Poland
- Preventing or obstructing reporting: fine up to PLN 1,080,000 (~€250,000), restriction of liberty, or up to 1 year imprisonment. With violence or threats: up to 3 years. Source: Clifford Chance
- Retaliation: fine, restriction of liberty, or up to 2 years imprisonment. Source: Kochański & Partners
- Disclosing whistleblower identity: fine, restriction of liberty, or up to 1 year imprisonment. Source: DLA Piper
Enforcement authority: Independent Authority for Whistleblower Protection (Rzecznik Praw Sygnalistów) — operations commence September 1, 2025. Source: Wozniak Legal
Poland is one of the few EU countries where obstruction and retaliation carry criminal penalties including prison time.
Portugal — Law 93/2021 #
Law: Lei n.º 93/2021, de 20 de dezembro — General Regime for the Protection of Whistleblowers.
Applies to: Companies with 50+ employees. Penalty regime enforceable since June 7, 2024. Source: IntegrityLine
Penalties:
- Not establishing reporting channels: fines up to €125,000. Source: IntegrityLine
Enforcement authority: MENAC (Mecanismo Nacional Anticorrupção). Electronic platform became operational November 2024. Received 152 reports in 2024. Focus shifting to private sector enforcement in 2025. Source: European Commission Rule of Law Report 2025
EU Court of Justice fines against member states (March 2025) #
Five EU countries were fined by the Court of Justice for failing to transpose the directive on time:
| Country | Lump sum fine | Daily penalty |
|---|---|---|
| Germany | €34,000,000 | — |
| Czech Republic | €2,300,000 | — |
| Hungary | €1,750,000 | — |
| Estonia | €500,000 | €1,500/day |
| Luxembourg | €375,000 | — |
Source: eucrim — Source: CJEU press release (PDF)
All 27 member states #
All EU member states have now transposed the directive. See our complete reference:
Whistleblower laws in all 27 EU member states →
Every country’s national law name, link to official text, penalties, deadlines, and enforcement authority.
Enforcement is accelerating #
Most member states only finished transposing the directive in 2023–2024. Enforcement authorities are now operational and actively issuing guidance:
- Italy: ANAC issued its first retaliation fine in July 2024 and published updated enforcement guidelines in November 2025.
- Portugal: MENAC’s electronic enforcement platform went live in November 2024, with private sector focus in 2025.
- Poland: Independent enforcement authority launches September 2025.
- Germany: Fines enforceable since December 2023.
- Spain: Fines enforceable since June 2023.
The window to get compliant before active enforcement is closing.
Get compliant now #
EthicsPortal gives your organization a fully compliant whistleblower reporting channel in minutes — encrypted, anonymous, and built for EU Directive 2019/1937.
See how we meet every requirement | Start your portal
Last updated: April 2026. Penalty amounts and enforcement status are based on publicly available legal sources linked above. Contact [email protected] if you spot an error.