Mandatory whistleblowing channel: which companies need one under the law

If you run an SME and you have heard about the mandatory whistleblowing channel, you are probably wrestling with a few questions: does it apply to me? From how many employees? What happens if I don’t have one? The Ley 2/2023 (Law 2/2023), which transposes the European Whistleblower Protection Directive into Spanish law, has been in force since 2023 and its deadlines have already passed. The Independent Whistleblower Protection Authority (AAI) is now operational and can impose sanctions. Let’s clear up every doubt in plain language, with no jargon.

Is it mandatory to set up a whistleblowing channel in companies?

Yes, for many companies it is. Since the entry into force of Ley 2/2023, of 20 February (the Spanish law regulating the protection of people who report regulatory breaches), a large part of the Spanish business landscape is required to have an internal information system (the technical name for the whistleblowing channel).

The aim of the law is that anyone who spots a serious irregularity within an organisation —fraud, corruption, breaches of EU regulations, public health risks, and so on— can report it without fear of reprisals and with guarantees of confidentiality. This is not a box-ticking formality: it is a legal obligation with serious financial penalties behind it.

Which types of companies are required to implement a whistleblowing channel?

The obligation does not depend on the sector, but above all on the number of employees. The following are required to have a whistleblowing channel:

• All private companies with 50 or more employees, whatever their line of business.
• Companies with fewer than 50 employees that operate in specific sectors: financial services, prevention of money laundering, transport safety and environmental protection.
• All Public Administrations, with no minimum employee threshold.
• Political parties, trade unions, employers’ associations and foundations that receive public funds.
• Municipalities with more than 10,000 inhabitants and public sector bodies.
• Entities that receive European funds to manage.

In practice, the rule you should remember as an SME is simple: if you have 50 or more people on your payroll, you are required to have one.

If my company has fewer than 50 employees, am I not required to set up a whistleblowing channel?

As a general rule, no. If your company has fewer than 50 employees and you do not operate in one of the regulated sectors mentioned above (finance, money laundering, transport, the environment), the law does not require you to set up the channel.

That said, two points are worth qualifying:

1. How the threshold is counted. The 50 employees are counted on the average headcount, including permanent, temporary and permanent-seasonal workers. If you are hovering just below the limit, check the calculation carefully before ruling out the obligation.
2. Voluntary implementation. Even if you are not required to, many SMEs choose to have one voluntarily: it conveys transparency, helps in tenders and compliance programmes, and detects internal problems before they turn into a serious conflict.

If you are right on the edge of 50 employees and you manage your payroll with spreadsheets, it will be hard to know your true average. A time-tracking software gives you that figure up to date and avoids nasty surprises with the AAI.

When do I have to implement the whistleblowing channel under the law?

The deadlines set by the law passed a long time ago:

• 13 June 2023: deadline for companies with 250 or more employees and for the public sector.
• 1 December 2023: deadline for companies with 50 to 249 employees.

This means that, as of 2026, any company that is required to have the channel and still doesn’t have one has been in breach for more than two years. There is no longer any grace period or leeway: if you are required to have one and you don’t, every day counts against you in the event of an inspection.

What happens if I don’t have a whistleblowing channel?

Here is the part that worries people most —and rightly so. The Independent Whistleblower Protection Authority (AAI) is the body responsible for monitoring compliance and imposing sanctions. The fines are among the highest in Spanish business law:

• Minor infringements: up to €100,000 (or up to €10,000 if the offender is a natural person).
• Serious infringements (for example, failing to set up the channel when required to, or retaliating against a whistleblower): from €100,001 to €600,000.
• Very serious infringements (repeated breaches, obstructing the AAI or particularly serious reprisals): from €600,001 up to €1,000,000.

On top of the financial penalties come additional consequences: a ban on contracting with the public sector for a period of time, loss of grants, or publication of the sanction. And don’t forget that mishandling a report you have received is also sanctioned, not just lacking a channel. That is why it is not enough to “have something” in place — it has to be a system that meets the legal requirements.

How do I implement a whistleblowing channel in my company?

A whistleblowing channel that complies with Ley 2/2023 must, as a minimum, meet these requirements:

1. Accessible to employees, former employees, contractors, suppliers and even job applicants.
2. Allow anonymous reports if the person wishes.
3. Guarantee the confidentiality of the whistleblower’s identity and of the information provided.
4. Acknowledge receipt of the report within a maximum of 7 days.
5. Resolve the investigation within a maximum of 3 months (extendable to 6 in complex cases).
6. Formally appoint a person responsible for the system, with no conflict of interest.
7. Protect the whistleblower expressly against any reprisal.
8. Comply with the RGPD (the Spanish/EU GDPR) in the processing of the data.

You have two ways to set it up:

Your own internal channel

You manage the portal yourself and appoint a person responsible within the company. It gives you full control, but it requires training that person, guaranteeing their independence and assuming the risk if a report is mishandled.

An externally managed channel

You hire a specialist provider that supplies the encrypted portal, the internal policy reviewed by lawyers and the audit trail of the case file. This is the option most SMEs with 50 to 250 employees choose, because it guarantees compliance without complicating their lives internally.

With LapsoWork you can have your channel up and running in 48 hours: a portal with its own URL, an internal policy reviewed by compliance specialists, document management of the case file in line with the law and internal communication ready for your employees. And because it is part of our HR suite, you have it integrated alongside time tracking, holidays and documentation.

Conclusion

The whistleblowing channel stopped being optional for companies with 50 or more employees back in 2023, and the deadlines have already passed. The risk is not theoretical: a fine for not having one starts at €100,000. Setting one up, by contrast, is quick and affordable.

If you have any doubts about whether you are required to have one, or you want to see it in action, discover our whistleblowing channel or contract it and put your mind at rest today.