Mandatory whistleblowing channel: which companies need one and what the penalties are

Since the Ley 2/2023 came into force, every Spanish company with 50 or more employees is required to have an internal whistleblowing channel. The deadline to comply has already passed, and the Autoridad Independiente de Protección del Informante (AAI, Spain’s independent whistleblower protection authority) is beginning to open proceedings. If your company still doesn’t have one, this article explains in plain language who is obliged, what the penalties are and how to comply in 48 hours.

What Ley 2/2023 is

Ley 2/2023, of 20 February, is the Spanish law that transposes Directiva (UE) 2019/1937 on whistleblower protection. It protects anyone who, in a work or professional context, reports serious or very serious breaches of the law committed within an organisation.

Its purpose is twofold:

1. That companies have an internal channel so that anyone can report irregularities without fear of reprisals.
2. That every report is investigated and resolved with guarantees of confidentiality and protection for the whistleblower.

Which companies are obliged

All of the following entities are required to have a whistleblowing channel:

• Private companies with 50 or more employees (all sectors).
• Companies with fewer than 50 employees that operate in certain regulated sectors: financial services, transport safety, environmental protection, among others.
• Public administrations (in all cases, with no employee threshold).
• Political parties, trade unions, associations and foundations that receive public funds.
• Legal entities that receive European funds.

Deadlines (already expired)

The law set two adaptation deadlines:

• 13 June 2023: companies with 250 or more employees.
• 1 December 2023: companies with 50–249 employees.

If, as of 2026, your company still has no channel and is obliged to have one, it has been in breach for more than two years.

What requirements the channel must meet

A whistleblowing channel compliant with Ley 2/2023 and Directiva 2019/1937 must meet the following minimum requirements:

1. Accessible to employees, former employees, contractors, suppliers and job applicants.
2. Allow anonymous reporting if the whistleblower wishes.
3. Confidentiality of the identity and of the data provided.
4. Traceability of the case, with the date of receipt, deadlines and resolution.
5. A 7-day deadline to acknowledge receipt to the whistleblower.
6. A 3-month deadline (extendable to 6 in complex cases) to investigate and resolve.
7. A formally appointed system officer (a person with no conflict of interest).
8. Explicit protection of the whistleblower against reprisals.
9. A record of processing activities compliant with the RGPD (the EU General Data Protection Regulation as implemented in Spain).

Penalties for not implementing it

The AAI can impose penalties for two distinct breaches: not having a channel when the company is obliged to, or not properly handling a report received.

Serious penalties (€50,001 to €600,000)

• Failing to set up the channel when there is an obligation to.
• Direct reprisals against a whistleblower.
• Disclosing the whistleblower’s identity without authorisation.

Very serious penalties (€600,001 to €1,000,000)

• Systematic or repeated breaches.
• Serious obstruction of the AAI’s work.
• Reprisals of particular gravity (unfair dismissal confirmed by a court).

In addition, if the company is a natural person, penalties can exceed €300,000.

Internal channel vs external channel

The law permits two models:

Internal channel

A portal managed by the company itself, with a formally appointed internal officer. Advantage: full control. Disadvantage: you need to train an employee, guarantee their independence and take on the reputational risk if a report is mishandled.

External channel

A portal managed by an independent third party (such as LapsoWork). Advantage: guaranteed compliance, genuine independence, a team specialised in receiving reports. Disadvantage: an annual cost (from €299.99 + VAT for SMEs).

Most SMEs with 50–250 employees opt for the external channel because it frees them from operational complexity.

How to set up the channel in 48 hours with LapsoWork

If your company is obliged and still has no channel, this is the onboarding process with LapsoWork:

1. Day 1: contract + configuration questionnaire sent (company name, logo, languages, types of reports to allow).
2. Day 1: our legal team reviews and customises the internal whistleblowing policy (a template approved by compliance lawyers).
3. Day 2: the portal goes live with its own URL (whistleblowing.yourcompany.com or a subfolder).
4. Day 2: 1-hour training for the internal officer on managing the reports received.
5. Day 2: internal communication to employees (email template provided) explaining the new channel.

Cost: €299.99/year + VAT (SMEs). Includes the portal, legal advice on the policy and document management of the case.

Frequently asked questions

Can I set up the channel myself with a Google Forms form? No. Google Forms does not meet the basic requirements (genuine anonymity, encryption of the identity, case traceability, legal deadlines). Using it instead of an approved channel constitutes a serious breach.

Does the channel have to be visible on the public website? Yes. Ley 2/2023 requires the channel to be accessible from the corporate website, publicly and easy to find. It must also be explicitly communicated to employees, contractors and suppliers.

What happens if I receive a false or malicious report? The law also protects companies against false reports. The channel officer must investigate impartially; if bad faith on the part of the whistleblower is established, the legal protection lapses and there may be consequences for the whistleblower.

Can someone who no longer works at the company file a report? Yes. Former employees, contractors, suppliers and even job applicants have standing to report. The channel must allow “non-authenticated” reports.

What is the most common first mistake when setting it up? Failing to formally appoint the system officer, or appointing someone with an obvious conflict of interest (managing director, sole shareholder). The AAI detects this in a simple inspection and penalises it.

Conclusion

If your company has 50 or more employees and still has no whistleblowing channel, the legal risk is not theoretical: it is a minimum penalty of €50,000 if proceedings are opened against you. Setting one up costs €299.99/year with LapsoWork and takes 48 hours.

Contract the whistleblowing channel to have it integrated with the rest of the HR software.