> Fines and penalties for non-compliance with EU Directive 2019/1937 in every member state. Updated regularly with enforcement actions. Source: https://ethicsportal.eu/penalties/ Updated: 2026-08-24 --- # EU whistleblower directive penalties by country EU Directive 2019/1937 requires all companies with 50+ employees to establish internal reporting channels. Every EU member state has transposed the directive into national law with its own penalty regime. Non-compliance is not theoretical. In March 2025, the [EU Court of Justice fined five member states a combined €38.9 million](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) just for being late to implement the law. Companies that fail to comply face their own penalties under national law. --- ## Penalties at a glance | Country | No reporting channel | Retaliation | Criminal liability | Law | |---|---|---|---|---| | [Spain](/whistleblower-laws/spain/) | Up to €1,000,000 | Up to €1,000,000 | No | [Law 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) | | [France](/whistleblower-laws/france/) | --- | €60,000 + 3 years prison | **Yes** | [Loi Waserman (2022-401)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) | | [Poland](/whistleblower-laws/poland/) | PLN 5,000 (~€1,200) | Obstruction: PLN 1,080,000 (~€250,000) + up to 1 year prison. Retaliation: up to 2 years prison | **Yes** | [Act of 14 June 2024](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) | | [Portugal](/whistleblower-laws/portugal/) | Up to €125,000 | Up to €250,000 | No | [Law 93/2021](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) | | [Italy](/whistleblower-laws/italy/) | €10,000--€50,000 | €10,000--€50,000 | No | [D.Lgs. 24/2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) | | [Germany](/whistleblower-laws/germany/) | €20,000--€50,000 (10x for legal entities) | Up to €50,000 | No | [HinSchG](https://www.gesetze-im-internet.de/hinschg/) | | [Romania](/whistleblower-laws/romania/) | RON 3,000--30,000 (~€600--6,000) | Obstruction: RON 2,000--20,000 (~€400--4,000) | No | [Legea 361/2022](https://legislatie.just.ro/public/DetaliiDocument/262872) | --- ## Country details ### [Spain](/whistleblower-laws/spain/) --- Law 2/2023 {#spain} **Law:** [Ley 2/2023, de 20 de febrero](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) --- protection of persons who report regulatory infringements and the fight against corruption. **Applies to:** Companies with 50+ employees. Deadline was June 13, 2023 (250+ employees) and December 1, 2023 (50--249 employees). [Source: Garrigues](https://www.garrigues.com/en_GB/new/spain-whistleblowing-law-published) **Penalties:** - Not establishing an internal reporting channel: €600,000--€1,000,000 for legal entities. [Source: CMS Expert Guide](https://cms.law/en/int/expert-guides/whistleblower-protection-and-reporting-channels/spain) - Breaching reporting channel obligations: €100,000--€1,000,000 for legal entities; €1,000--€300,000 for individuals. [Source: CMS Expert Guide](https://cms.law/en/int/expert-guides/whistleblower-protection-and-reporting-channels/spain) - Additional sanctions: public warning, prohibition from subsidies/tax benefits for up to 4 years, and possible suspension of operating licenses. [Source: Garrigues](https://www.garrigues.com/en_GB/new/whistleblowing-channels-companies-spain-key-aspects-new-law-protecting-whistleblowers-all) **Enforcement authority:** Autoridad Independiente de Protección del Informante (A.A.I.) Spain has the harshest penalties in the EU for whistleblower non-compliance. --- ### [France](/whistleblower-laws/france/) --- Loi Waserman {#france} **Law:** [Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745), amending [Loi Sapin II (2016-1691)](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528). **Applies to:** Companies with 50+ employees. In effect since September 2022. [Source: IntegrityLine](https://www.integrityline.com/expertise/blog/new-french-whistleblowing-law/) **Penalties:** - Obstructing a report: up to €60,000 fine and 1 year imprisonment. [Source: Whispli](https://www.whispli.com/eu-directive-whistleblowing/france/) - Retaliation or discrimination against a whistleblower: up to €60,000 fine and 3 years imprisonment. [Source: JP Karsenty](https://www.jpkarsenty.com/en/the-whistleblower-the-impact-of-the-waserman-law-on-criminal-provisions-4-4/) France is one of the few EU countries where obstruction and retaliation carry **criminal penalties including prison time**. **Key difference:** Whistleblowers in France are no longer required to use internal channels before going to external authorities (end of "cascade reporting"). [Source: IntegrityLine](https://www.integrityline.com/expertise/blog/new-french-whistleblowing-law/) --- ### [Germany](/whistleblower-laws/germany/) --- HinSchG {#germany} **Law:** [Hinweisgeberschutzgesetz (HinSchG)](https://www.gesetze-im-internet.de/hinschg/) --- entered into force July 2, 2023. **Applies to:** Companies with 50+ employees. Deadline was July 2, 2023 (250+ employees) and December 17, 2023 (50--249 employees). Fines enforceable since December 1, 2023. [Source: Library of Congress](https://www.loc.gov/item/global-legal-monitor/2023-07-13/germany-whistleblower-protection-act-enters-into-force/) **Penalties:** - Not establishing a reporting channel: fines of €20,000--€50,000 per Section 40 HinSchG. [Source: Ebner Stolz](https://www.ebnerstolz.de/en/what-we-offer/services/legal-advice/commercial-criminal-law/german-whistleblower-protection-act-27384.html) - For legal entities, fines can increase **tenfold** (up to €500,000) per Section 40(6). [Source: activeMind](https://www.activemind.legal/guides/german-whistleblower-protection-act/) - Retaliation against whistleblowers: up to €50,000. [Source: Morrison Foerster](https://www.mofo.com/resources/insights/230602-the-new-german-whistleblowing-act) **Note:** Germany was fined €34,000,000 by the EU Court of Justice in March 2025 for late transposition of the directive. [Source: eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) --- ### [Italy](/whistleblower-laws/italy/) --- D.Lgs. 24/2023 {#italy} **Law:** [Decreto Legislativo 10 marzo 2023, n. 24](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg). **Applies to:** Companies with 50+ employees (and all companies with a Model 231 compliance program regardless of size). Deadline was July 15, 2023 (250+ employees) and December 17, 2023 (50--249 employees). [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) **Penalties:** - Not establishing reporting channels or non-compliant procedures: €10,000--€50,000. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) - Retaliation or obstruction of reporting: €10,000--€50,000. [Source: Hogan Lovells](https://www.hoganlovells.com/en/publications/italy-implements-eu-whistleblower-directive-the-new-obligations-for-companies) - Breaching confidentiality of reporter identity: €10,000--€50,000. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) - False reporting by whistleblower: €500--€2,500. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) **Enforcement authority:** ANAC (Autorità Nazionale Anticorruzione). ANAC issued its first enforcement action in July 2024 (Decision No. 380, retaliation case). [Source: ANAC via Cleary Gottlieb](https://www.clearygottlieb.com/news-and-insights/publication-listing/whistleblowing-in-focus-part-two) --- ### [Poland](/whistleblower-laws/poland/) --- Act of 14 June 2024 {#poland} **Law:** [Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) --- entered into force September 25, 2024. **Applies to:** Employers with 50+ employees. Internal procedures required by January 1, 2025. [Source: DLA Piper](https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2024/poland-whistleblower-protection-act.html) **Penalties:** - Not establishing internal reporting procedures: fine of PLN 20--5,000 (~€5--€1,200) as a misdemeanor. Management board members are personally liable. [Source: RSM Poland](https://www.rsm.global/poland/en/insights/doing-business-poland/whistleblower-protection) - Preventing or obstructing reporting: fine up to PLN 1,080,000 (~€250,000), restriction of liberty, or up to 1 year imprisonment. With violence or threats: up to 3 years. [Source: Clifford Chance](https://www.cliffordchance.com/insights/resources/blogs/regulatory-investigations-financial-crime-insights/2024/07/poland-implements-the-eu-whistleblowing-directive.html) - Retaliation: fine, restriction of liberty, or up to 2 years imprisonment. [Source: Kochański & Partners](https://www.kochanski.pl/en/whistleblower-protection-act-all-you-need-to-know/) - Disclosing whistleblower identity: fine, restriction of liberty, or up to 1 year imprisonment. [Source: DLA Piper](https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2024/poland-whistleblower-protection-act.html) **Enforcement authority:** Independent Authority for Whistleblower Protection (Rzecznik Praw Sygnalistów) --- operations commence September 1, 2025. [Source: Wozniak Legal](https://wozniaklegal.com/en/news-and-insight/454/protection-of-whistleblowers-in-poland.html) Poland is one of the few EU countries where obstruction and retaliation carry **criminal penalties including prison time**. --- ### [Portugal](/whistleblower-laws/portugal/) --- Law 93/2021 {#portugal} **Law:** [Lei n.º 93/2021, de 20 de dezembro](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) --- General Regime for the Protection of Whistleblowers. **Applies to:** Companies with 50+ employees. Penalty regime enforceable since June 7, 2024. [Source: IntegrityLine](https://www.integrityline.com/expertise/blog/new-portuguese-whistleblowing-law/) **Penalties:** - Not establishing reporting channels (serious offence): fines up to €125,000. [Source: IntegrityLine](https://www.integrityline.com/expertise/blog/new-portuguese-whistleblowing-law/) - Retaliation, obstruction, or breach of confidentiality (very serious offence): fines up to €250,000. [Source: Lei 93/2021, art. 27.º](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) **Enforcement authority:** MENAC (Mecanismo Nacional Anticorrupção). Electronic platform became operational November 2024. Received 152 reports in 2024. Focus shifting to private sector enforcement in 2025. [Source: European Commission Rule of Law Report 2025](https://commission.europa.eu/document/download/5a482f87-1f24-47bd-8595-d25f1ca29c6a_en) --- ### [Romania](/whistleblower-laws/romania/) --- Legea 361/2022 {#romania} **Law:** [Legea nr. 361/2022 privind protecția avertizorilor în interes public](https://legislatie.just.ro/public/DetaliiDocument/262872) --- transposing Directive (EU) 2019/1937. **Applies to:** All public-sector entities regardless of headcount; private-law entities with 50+ employees; certain Annex 3 sector entities (financial services, AML, insurance) regardless of size. Deadline was December 22, 2022 (public sector and 250+ employees) and December 17, 2023 (50--249 employees). [Source: ANI](https://integritate.eu/comunicat-privind-obligatia-persoanelor-juridice-de-drept-privat-care-au-intre-50-si-249-de-angajati-de-a-identifica-sau-institui-canale-interne-de-raportare-legea-nr-361-2022-privind-protectia-ave/) **Penalties (administrative contraventions under Art. 28--29):** - Not establishing internal reporting channels: RON 3,000--30,000 (~€600--6,000). [Source: Legea 361/2022, Art. 28(2)(c)](https://legislatie.just.ro/public/DetaliiDocument/262872) - Obstructing or preventing a report: RON 2,000--20,000 (~€400--4,000). - Breaching whistleblower confidentiality: RON 4,000--40,000 (~€800--8,000). - Knowingly false reporting: RON 2,500--30,000 (~€500--6,000). **Enforcement authority:** [Agenția Națională de Integritate (ANI)](https://integritate.eu/competente/avertizori-in-interes-public/). **Honest assessment of enforcement:** No public record of any company being fined specifically for a missing internal channel has surfaced, and enforcement to date appears reactive rather than audit-driven. ANI [registered 329 external reports in 2025](https://agerpres.ro/justitie/2026/05/18/ani-anul-trecut-au-crescut-semnificativ-raportarile-avertizorilor-de-integritate-privind-incalcari-a--1557362) (188 in domains regulated by Legea 361/2022) --- reports received by the authority, not sanctions issued against employers. Independent analysis ([CEELI Institute, 2023](https://ceeliinstitute.org/resource/beyond-paper-rights)) documents a gap between the law on paper and its implementation. The real exposure is a report reaching ANI with no internal channel in place, not a large fine. --- ## EU Court of Justice fines against member states (March 2025) Five EU countries were fined by the Court of Justice for failing to transpose the directive on time: | Country | Lump sum fine | Daily penalty | |---|---|---| | [Germany](/whistleblower-laws/germany/) | €34,000,000 | --- | | [Czech Republic](/whistleblower-laws/czech-republic/) | €2,300,000 | --- | | [Hungary](/whistleblower-laws/hungary/) | €1,750,000 | --- | | [Estonia](/whistleblower-laws/estonia/) | €500,000 | €1,500/day | | [Luxembourg](/whistleblower-laws/luxembourg/) | €375,000 | --- | [Source: eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) --- [Source: CJEU press release (PDF)](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) --- ## All 27 member states All EU member states have now transposed the directive. See our complete reference: **[Whistleblower laws in all 27 EU member states →](/whistleblower-laws/)** Every country's national law name, link to official text, penalties, deadlines, and enforcement authority. --- ## Enforcement is accelerating Most member states only finished transposing the directive in 2023--2024. Enforcement authorities are now operational and actively issuing guidance: - **Italy:** ANAC issued its first retaliation fine in July 2024 and published updated enforcement guidelines in November 2025. - **Portugal:** MENAC's electronic enforcement platform went live in November 2024, with private sector focus in 2025. - **Poland:** Independent enforcement authority launches September 2025. - **Germany:** Fines enforceable since December 2023. - **Spain:** Fines enforceable since June 2023. - **Romania:** ANI is the enforcement authority, but no public record of a company fined for a missing channel has surfaced; enforcement remains reactive and complaint-driven. ANI logged 329 external reports in 2025. The window to get compliant before active enforcement is closing. --- ## Get compliant now EthicsPortal gives your organization a secure internal reporting channel for EU Directive 2019/1937 compliance: encrypted, anonymous, and deadline-tracked. [See how we meet every requirement](/directive-coverage/) | [Deploy your internal reporting channel](https://secure.ethicsportal.eu/session/new) --- *Last updated: April 2026. Penalty amounts and enforcement status are based on publicly available legal sources linked above. Contact [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) if you spot an error.*