Complying with the new EU whistleblowing Directive: time is of the essence
Article 5 minute read

Complying with the new EU whistleblowing Directive: time is of the essence

19 November 2021

The deadline for implementing Directive (EU) 2019/1937 – the Whistleblowing Directive – is fast approaching. The Directive is intended to set a minimum standard of protection for those who report breaches of Union law, and all EU Member States must transpose the new EU regulations into national law no later than 17 December 2021.

With less than two months to go before the deadline for implementing the new EU Directive, it is vital that organisations within the bloc set up internal whistleblowing processes to meet the new requirements – or seek the assistance of a services provider who can make sure that the correct internal processes are in place.

Ahead of the 17 December deadline, Member States must:

Make companies with 250 or more employees, or turnover of €10M or more per annum, implement a whistleblower system (companies between 50 and 249 employees only have 24 months longer to implement).

  • Make public institutions, authorities, as well as municipalities with a population of 10,000 or more, implement a whistleblower system.
  • Create or appoint a competent authority as an escalation route, should an organ-isation fail to manage a whistleblowing complaint.
  • Provide a wide range of legal and financial protections for whistleblowers.
  • Invalidate non-disclosure type agreements in relation to whistleblowing cases.

Whistleblowing reporting: the essentials


All individuals working within an organisation have reporting rights. This includes employees, both temporary and permanent, as well as directors and shareholders, for example. Certain third parties also have reporting rights, including former employees, contractors and suppliers.


A confidential reporting framework is required and the individual making the report should be made aware of who they are reporting to. Companies must designate an “impartial person or department” responsible for following up on whistleblower reports. Receipt of a report should be acknowledged within seven days and responded to with a proper “follow-up” (within three months of acknowledgement of receipt is considered reasonable). The approval of the whistleblower is required in order for their identity to be revealed to people other than the initial person(s) who received the first report.


The Directive requires a system that is GDPR compliant and also secure. The company should provide employees with understandable and easily accessible information on the possibilities of making reports internally, as well as to external competent authorities, institutions, bodies or other entities.


In addition to former practice, whistleblowers must be given the choice of channels through which to make their first report, in order to safeguard their anonymity. This is where it is important for an organisation to have put in place the mechanisms which give individuals the confidence to make a report internally, without fear of retaliation. We advise organisations to allow anonymous reporting through a serviced platform to help with this feeling of confidence.


We recommend making sure investigations are a sound, documented process, that are both auditable and conducted in a timely manner. Setting out a clear, easily followed, and visible process is advised.

Spotlight on Germany

In Germany, whistleblower protection is still considered to be inadequate compared to the standards set by the Directive. There are currently only national regulations on whistleblower protection for the financial services sector, and regarding the protection of business secrets.

On 11 December 2020, the German government developed a draft general law on whistleblower protection which purposely goes beyond the requirements of the Directive. The overall goal is to reach an agreement by 17 December – the end of the Directive’s implementation period. However, following the federal elections in September, and the ongoing negotiations of the coalition government, it is still in question whether the Directive’s transposition into German law will take place before the deadline.

Manuela Reintgen, Director of Business Development at TMF Germany, comments: “Small and medium-sized (SME) organisations are still at a very early stage of implementing a whistleblowing process which meets the requirements of the impending regulation. Currently, just one in seven German organisations is making preparations.”

It is therefore recommended that all employers prepare for the implementation of a whistleblowing system that – as a bare minimum – meets the standard requirements of the Directive, as we await more information from the coalition government regarding the draft general law.

Marc Pruem, Head of Capital Markets Services at TMF Group, comments: “The latest whistleblowing report, entitled ‘Whistleblowing Report 2021: A comprehensive study on whistleblowing in European companies’, shows that every third organisation has reported illegal or unethical behaviour in the past year, ie a violation of its own code of conduct. Enhancing compliance and protecting organisations from financial or legal reprisals, as a consequence of this behaviour, will be of the utmost importance in the future.”

He says: “TMF Group can help mitigate the complexity of implementing streamlined whistleblowing processes and, when acting as an impartial whistleblowing officer, can create trust in the organisation’s efforts to properly protect employees’ rights.”

TMF Germany: Whistleblower services

TMF Germany has set up a whistleblower service, including an online platform, a whistleblowing policy and an impartial whistleblowing officer to assist organisations based in Germany to comply with the Directive’s requirements. This combination guarantees that employees can submit their reports anonymously and track the progress of their submission, from when it is newly assigned in the system, through to its ultimate conclusion.

TMF Germany has the ability to:

  • Act as the outsourcing provider for a portfolio of compliance services
  • Be the one point of contact for whistleblowing services, dealing with non-applicable/non-relevant allegations and engage with all different stakeholders where allegations are relevant
  • Prevent any extra administration expenditure, where staffing is already tight
  • Act as an impartial third party, outside of the hierarchical structure of the client, to ensure the protection of interests of the whistleblower under the regulation.

Talk to us

TMF Group has regional whistleblowing experts in Germany and across all other EU Member States.

For further details of TMF Group’s whistleblowing services, make an enquiry with us today and we can help you further understand and discuss how the Directive will affect your company.

Written by

Marc Pruem and Manuela Reintgen

Head of Capital Markets Services at TMF Group; Director of Business Development at TMF Germany

Insights and updates delivered to your inbox.

Sign up now