Whistleblowing systems: the complete guide to legal obligations for companies

Why companies have a legal obligation to act

A whistleblowing system is no longer an option reserved for large corporations: it is a legal obligation for every company with 50 or more employees in France. Since the Sapin II law of 2016, reinforced by the Waserman law of 2022, lawmakers have made internal reporting a cornerstone of the prevention of corruption, fraud and breaches of the public interest.

This shift reflects a simple observation: employees are best placed to detect wrongdoing within their organisation. But they need a safe, confidential and effective channel to report it. That is exactly what the law now requires employers to provide.

This article reviews the legal obligations applicable to whistleblowing systems, the companies concerned, the penalties for non-compliance, and the practical steps to become compliant.

Who is concerned? The thresholds set by law

The general threshold: 50 employees

Since Law no. 2022-401 of 21 March 2022 (known as the Waserman law), every company or legal entity employing at least 50 people must establish an internal procedure for receiving and handling reports. This obligation, originally introduced by Article 8 of the Sapin II law, also applies to municipalities with more than 10,000 inhabitants, departments, regions and state administrations.

The reinforced anti-corruption regime: 500 employees and €100M

Article 17 of the Sapin II law imposes a stricter regime on companies with at least 500 employees and revenue exceeding €100 million (thresholds assessed at group level where applicable). These companies must deploy a full anti-corruption programme — risk mapping, code of conduct, training, accounting controls — of which the internal whistleblowing system is a mandatory component, under the supervision of the French Anti-Corruption Agency (AFA).

Summary table of laws, thresholds and obligations

The key laws at a glance

Sapin II: the founding text

Law no. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life laid the foundations of French whistleblowing law. It created the first general whistleblower status and required the companies concerned to provide:

• reporting channels allowing alerts to be received securely;
• handling procedures guaranteeing that every report is effectively examined;
• protection of whistleblowers against any form of retaliation.

The Waserman law: the transposition that changed the game

Law no. 2022-401 of 21 March 2022 on improving whistleblower protection, in force since 1 September 2022, transposes the EU directive and thoroughly modernises the French regime:

• broader definition of the whistleblower: the person no longer needs to act "selflessly" — good faith and the absence of direct financial consideration are enough;
• end of the mandatory channel hierarchy: whistleblowers may report directly to a competent external authority without first using the internal channel;
• extended protection for facilitators (colleagues, relatives, unions and NGOs who assist with the report);
• a central role entrusted to the Défenseur des droits (French Ombudsman), responsible for guiding whistleblowers and certifying their status.

Decree no. 2022-1284 of 3 October 2022 sets out the operational requirements: acknowledgement of receipt within 7 working days, feedback to the whistleblower on the follow-up given within a reasonable period not exceeding 3 months, and guarantees of integrity and confidentiality of the information collected.

For a detailed overview of the French framework, see our guide to whistleblowing regulation in France.

The European directive 2019/1937

Directive (EU) 2019/1937 of 23 October 2019 on the protection of persons who report breaches of Union law establishes a common minimum standard for all Member States: mandatory internal reporting channels from 50 workers, external channels with the competent authorities, a general prohibition of retaliation and a reversal of the burden of proof in favour of the whistleblower. Each Member State transposed it with its own specificities — a key point of attention for groups operating in several European countries.

Duty of vigilance and CSRD: the circle widens

• Law no. 2017-399 of 27 March 2017 on the duty of vigilance requires companies with at least 5,000 employees in France (or 10,000 worldwide) to adopt a vigilance plan that must include an alert and reporting mechanism covering serious risks to human rights, health, safety and the environment.
• The CSRD (Corporate Sustainability Reporting Directive), transposed into French law at the end of 2023, progressively requires large companies to publish sustainability information, including on business conduct: the ESRS G1 standard explicitly covers corruption prevention and whistleblower protection. The whistleblowing system thus becomes a reporting item scrutinised by investors and stakeholders.

The mandatory components of a compliant whistleblowing system

To meet the legal requirements, a reporting system must combine several key elements:

1. A secure and accessible reporting channel: the channel must allow written or oral reports and be accessible to employees as well as, depending on the procedure adopted, external and occasional workers, shareholders, contractors and subcontractors. A dedicated platform makes accessibility and traceability much easier.

2. Guaranteed confidentiality: the identity of the whistleblower, of the persons concerned and of any third party mentioned must be strictly protected. Disclosing it without consent is a criminal offence. The system must also be able to handle anonymous reports.

3. Regulated processing deadlines: acknowledgement of receipt within 7 working days, feedback to the whistleblower within a maximum of 3 months. A case management tool helps track these deadlines and document every step.

4. GDPR compliance: the processing of personal data linked to alerts must comply with the CNIL framework: data minimisation, limited retention periods, information of the persons concerned and access security.

5. A formalised and published procedure: the procedure must be established after consulting employee representative bodies, be appropriately publicised (internal rules, intranet, notices) and be known to all employees.

6. Training and awareness: alert officers trained in handling reports, and regular awareness sessions for teams on how the system works and the protections whistleblowers enjoy.

Penalties and risks in case of non-compliance

The absence of a compliant system exposes the company and its executives to significant risks:

1. Criminal penalties for obstruction: obstructing the transmission of a report is an offence punishable by one year's imprisonment and a €15,000 fine. Breaching the confidentiality of a whistleblower's identity is punishable by two years' imprisonment and a €30,000 fine.

2. Civil fine for gag lawsuits: any abusive legal action against a whistleblower exposes its author to a civil fine of up to €60,000, in addition to damages.

3. Nullity of retaliation: dismissal, sanction, discrimination or any adverse measure taken against a whistleblower is null and void by law, with reinstatement and compensation available before the employment tribunal.

4. AFA sanctions: for companies subject to Article 17 of the Sapin II law, the AFA's sanctions committee can impose fines of up to €200,000 for executives and €1 million for the company for failures in the anti-corruption programme.

5. Reputational and commercial risk: a scandal revealed externally for lack of an effective internal channel, exclusion from public procurement or a downgraded ESG rating can cost far more than compliance itself.

How to become compliant: the 5 steps

1. Audit the current situation: map existing reporting channels, procedures and gaps against legal requirements. Our maturity audit provides a quick assessment of your compliance level.

2. Choose a suitable reporting channel: favour a secure platform guaranteeing confidentiality, anonymity, multilingual accessibility and traceability — requirements that are hard to meet with a simple mailbox.

3. Formalise the procedure: draft the receipt and handling procedure, submit it to the works council for consultation, appoint the officers in charge of processing and define conflict-of-interest rules.

4. Inform and train: publicise the procedure to all staff, train alert officers in report handling and confidentiality obligations, and raise managers' awareness of whistleblowers' legal protections.

5. Monitor and continuously improve: track indicators (report volume, processing times, closure rate), document each case so you can demonstrate compliance, and adjust the system based on feedback.

Conclusion

The whistleblowing system has become an unavoidable legal standard: mandatory from 50 employees, with precise operational requirements (confidentiality, deadlines, GDPR) and criminal and civil penalties for breaches. Beyond compliance, an effective reporting channel is a governance tool that detects risks early, resolves them internally and strengthens the trust of employees and partners.

To go further, download our practical Waserman law compliance guide or talk to our team about your whistleblowing system project.

---

Sources

• Law no. 2016-1691 of 9 December 2016 (Sapin II) — Légifrance
• Law no. 2022-401 of 21 March 2022 (Waserman) — Légifrance
• Decree no. 2022-1284 of 3 October 2022 — Légifrance
• Directive (EU) 2019/1937 — EUR-Lex
• Whistleblower guide — Défenseur des droits
• Whistleblowing systems — CNIL