Penalties for failing to implement a whistleblowing system: fines of up to €1 million

The Spanish Law 2/2023, of 20 February, regulating the protection of persons who report on regulatory infringements and the fight against corruption, establishes that all companies with 50 or more employees, and organisations managing public funds, must have an Internal Information System, within which the so-called ethics or whistleblowing reporting channel is integrated.

The purpose of this system is to allow employees and other individual connected with the organisation to report, without fear of suffering retaliation, possible infringements of European Union law, criminal offences, and serious or very serious administrative infringements of which they have become aware in a work or professional context.

The channel must guarantee confidentiality, allow the submission of anonymous reports, and prevent access by unauthorised persons. Its proper functioning requires an adequate implementation and management of the whistleblowing channel, from a legal, organisational, and technical standpoint.

Is a whistleblowing channel mandatory?

The whistleblowing reporting channel is mandatory for companies with 50 or more employees and for other entities expressly included within the scope of Law 2/2023.

As a general rule, the following must have one:

• Private-sector companies and self-employed professionals with 50 or more employees.
• Private entities carrying out certain activities regulated by European Union law, even if they have fewer than 50 employees.
• Political parties, trade unions, business organisations, and foundations created by them, when they receive or manage public funds.
• Entities forming part of the public sector, subject to the specific rules set out in Law 2/2023.

The deadline for companies with 250 or more employees to adapt to the new regulation ended on 13 June 2023. Companies with between 50 and 249 employees, in turn, had until 1 December 2023 to do so.

Despite the legal obligation, many companies still do not have a whistleblowing system, and others that have already implemented one appear to regard it as a mere formality, believing it will not be necessary to comply rigorously with the requirements of the law when managing the channel.

However, it is not enough to have a platform or an email address. The system must have a Channel Manager, an internal policy, a management procedure, and the safeguards required by Law 2/2023.

Having a reporting channel that does not comply with the law can also be sanctioned

A company can be penalised not only for lacking a reporting channel, but also for managing it incorrectly.

The whistleblowing system must:

• Guarantee confidentiality and anonymity.
• Protect the whistleblower against retaliation.
• Restrict access to communications.
• Comply with statutory time limits.

For many business owners, this new regulation is nothing more than another burden on companies, since it requires allocating resources and funds, with the resulting cost, without providing any benefit.

Although its implementation requires the allocation of resources, this is a rule that stems from European Union (EU) legislation. European whistleblowing regulation laid the groundwork for making the implementation of the ethics or whistleblowing channel mandatory for companies and entities falling within its scope.

Its purpose is to protect individuals who, in a work or professional context, detect serious or very serious criminal or administrative infringements and report them.

Furthermore, a correctly implemented reporting channel helps to detect irregularities, reduce legal and reputational risks, and strengthen the company’s regulatory compliance system.

The aim is thereby to pursue infringements of EU law and serious or very serious criminal and administrative infringements under our legal system. Regardless of any opinion on the merits of this regulation, companies must be aware of the strict penalty regime set out in this law for cases of non-compliance with its requirements.

Who can be penalised for failing to comply with Law 2/2023?

The parties liable for infringements are legal entities, i.e. companies, as well as individuals, whether they form part of a collegiate body (provided they voted in favour of the infringing decision) or act individually.

Within collegiate bodies, such as boards of directors, those who did not attend for a justified reason or who voted against the infringing decision are exempt.

Furthermore, liability arising from infringements will extend to those responsible even after they have ceased their activity within the company.

What are the 3 types of penalties for not having a whistleblowing system?

Article 63 of the law classifies infringements as very serious, serious, or minor. Each carries a different range of fines.

Minor infringements

These are lesser breaches, such as the deliberately incomplete or late submission of certain information by the System Manager, failure to cooperate with an investigation, or other breaches not classified as serious or very serious.

Serious infringements

In addition to minor and very serious infringements, Law 2/2023 establishes a number of acts that may be classified as serious infringements. The sanction imposed will depend on the particular circumstances of the case, taking into account factors such as intent, repeated misconduct, and the damage or prejudice caused.

Very serious infringements

Very serious conduct includes not having the channel when required, taking retaliatory action, obstructing or hindering communications, and deliberately breaching the confidentiality or anonymity of the whistleblower.

It should be noted that most infringing conduct is classified as serious or very serious, and the distinction between them is based on the intentionality of the act or omission.

Failure to comply with the obligation to have a whistleblowing channel is, in all cases, considered a very serious infringement.

What kind of fines can companies face for not having a whistleblowing channel?

An obligated company that does not have a whistleblowing channel can face a fine of between 600,001 € and 1,000,000 €, as this failure constitutes a very serious infringement:

The maximum fine of one million euros is not imposed automatically. To determine the amount, factors such as intent, repeated infringements, the duration of the non-compliance, the damage caused, financial capacity, and voluntary remediation are taken into account.

Other consequences of very serious infringements

In addition to the fine, a very serious infringement may result in:

• A public reprimand.
• A ban on obtaining subsidies or tax benefits for up to four years.
• A ban on contracting with the public sector for up to three years.
• Publication of certain final penalties in the Official State Gazette (BOE).

The power to impose penalties lies with the Independent Whistleblower Protection Authority (A.A.I.) and the relevant regional bodies. The A.A.I. is already able to supervise and penalise breaches relating to the whistleblowing channel.

How to avoid penalties?

To reduce the risk of non-compliance, the company should check that:

• The whistleblowing system has been formally approved.
• An independent Manager has been appointed.
• A policy and management procedure are in place.
• The channel allows anonymous and confidential communications.
• Statutory time limits are complied with.
• The whistleblower is protected against retaliation.
• The processing of personal data complies with the regulations.
• Evidence of the system’s proper functioning is retained.

Therefore, aside from more commendable reasons, the serious consequences of failing to comply with whistleblowing channel regulations should be sufficient to compel companies to comply with the law.

Advice on implementing the ethics or whistleblowing channel

If you have any doubts about compliance with Law 2/2023, or need to implement or review your company’s whistleblowing channel, our team of specialist Criminal Compliance lawyers can help ensure your whistleblowing system complies fully with all legal requirements. Contact us to receive advice tailored to your organisation’s needs.