What is Evidencia - Centralized Whistleblowing & Case Management platform?

La solution SaaS centralisée pour la gestion des cas d'investigation, le lancement d'alertes et la conformité.

Does French law apply to foreign companies operating in France?

Yes. Any entity employing 50 or more employees on French territory is subject to the law, regardless of its nationality. A French subsidiary of a foreign group must therefore comply.

Can whistleblowing channels be pooled at group level?

Yes, under conditions. Parent companies may set up a pooled channel for subsidiaries with fewer than 250 employees. Beyond this threshold, each entity must have its own channel or justify a dedicated procedure.

What is the deadline for responding to a report?

The organisation must acknowledge receipt of the report within 7 days of receiving it, and communicate feedback on follow-up actions within a reasonable period not exceeding 3 months.

Can a whistleblower report directly to an external authority?

Yes. Since the 2022 law, the whistleblower can approach an external authority directly without having to go through the internal channel first, unlike the original Sapin II law.

Is Evidencia compliant with French requirements?

Yes. Evidencia was designed to meet French legal requirements: secure internal channel with automatic acknowledgements, encryption of the whistleblower's identity, management of regulatory deadlines, and complete audit trail.

Whistleblower Regulation in France

Sapin II & Law No. 2022-401 - What Your Company Needs to Know

France transposed the EU Directive 2019/1937 through the law of 21 March 2022. Since 1 September 2022, every company with 50 or more employees must have a compliant internal reporting channel.

← All countries

Regulation Overview

Key reference texts in France

Law name

Sapin II Law & Law No. 2022-401

Reference

Law No. 2016-1691 (Sapin II) + Law No. 2022-401 of 21 March 2022

In force since

1 September 2022

Application threshold

50+ employees (mandatory internal channels)

Competent authority

Défenseur des droits (Defender of Rights)

Penalties

Up to 1 year imprisonment and €15,000 fine for obstruction; administrative sanctions for failure to set up internal channel

Who Must Comply?

Scope of the obligation

Any private-sector legal entity employing at least 50 employees, as well as municipalities with over 10,000 inhabitants and public establishments. Corporate groups may pool their channels under certain conditions.

Required Reporting Channels

Setup obligations

Internal channel

Mandatory from 50 employees. Must allow written and/or oral reporting, guarantee confidentiality of the whistleblower's identity, the person implicated, and third parties mentioned. Acknowledgement of receipt within 7 days, feedback within 3 months.

External channel

To the Defender of Rights (guidance), the competent authority depending on the nature of the facts (ACPR, AMF, AFA, etc.) or the Public Prosecutor. Can be used directly if the internal channel is non-existent or inoperative.

Whistleblower Protections

A reinforced protection framework

Civil and criminal immunity for facts reported in good faith

Protection against any form of retaliation (dismissal, demotion, harassment)

Strict confidentiality of the whistleblower's identity

Reversal of burden of proof: employer must prove absence of connection

Right to provisional measures in case of imminent retaliation

Access to confidential legal advice via the Defender of Rights

Penalties for Non-Compliance

Risks for your organisation

Failure to set up a reporting channel exposes the organisation to criminal and administrative sanctions. Retaliation against a whistleblower constitutes a separate criminal offence.