Penalties for not having a whistleblowing channel

Failing to have a whistleblowing channel when the law requires you to have one is not a mere administrative oversight: it can cost your company up to one million euros. Ley 2/2023, de 20 de febrero (Spain’s law transposing the EU whistleblower protection directive), which implements the European directive on the protection of informants (whistleblowing), sets out a robust sanctioning regime for companies that fail to comply. And now that the Autoridad Independiente de Protección del Informante (AAI) (Independent Whistleblower Protection Authority) is fully operational, those penalties are no longer merely theoretical. In this article we explain, in plain language, who can be penalised, how much is at stake and how to avoid it.

Who can be penalised for not having a whistleblowing channel?

Any natural or legal person who breaches the obligations of Ley 2/2023, or who commits any of the infringements defined in its article 63, may be penalised. We are not talking only about “the company” as an abstract entity: liability can fall both on the organisation and on the specific individuals involved in managing the system.

It is worth recalling who is required to set up the channel:

Private companies with 50 or more employees.
All public sector bodies, regardless of their size.
Companies in certain sectors (financial services, anti-money laundering, transport safety or the environment), regardless of the number of employees.
Political parties, trade unions, employers’ organisations and foundations that receive public funds.

If your company falls under any of these scenarios and does not have an internal reporting system, you are already exposed to the sanctioning regime. And having “something” is not enough: the channel must guarantee confidentiality, allow anonymity and meet the response deadlines set by the regulation.

Penalties and fines relating to whistleblowing channels

Penalties are divided into three categories —minor, serious and very serious— and their amount depends on whether the offender is a natural person or a legal person. These are the ranges set by the law:

Natural persons:

Minor infringements: fine of 1,001 to 10,000 euros.
Serious infringements: fine of 10,001 to 30,000 euros.
Very serious infringements: fine of 30,001 to 300,000 euros.

Legal persons (companies):

Minor infringements: fine of up to 100,000 euros.
Serious infringements: fine of 100,001 to 600,000 euros.
Very serious infringements: fine of 600,001 to 1,000,000 euros.

As you can see, the difference between having no channel and having one properly implemented can be the difference between continuing to operate normally or facing a fine that jeopardises the very survival of an SME. And the financial amount is not the only thing at stake, as we will see below.

Types of infringements

Article 63 of Ley 2/2023 classifies breaches into three levels according to their severity. Each one carries different penalties and also different limitation periods.

Very serious infringements

These are the most severe conducts, those that strike at the very root of the law’s protective purpose. Among others, the following are considered very serious:

Deliberately preventing or restricting the submission of reports, or setting up contracts or clauses for that purpose that limit the rights and safeguards provided for in the regulation.
Revealing the identity of a whistleblower who has chosen to remain anonymous, or breaching the duty of confidentiality.
Taking reprisals against whoever reports (dismissals, demotions, exclusions, etc.).
Knowingly breaching the system’s duty of confidentiality.

In addition to the financial fine (up to one million euros for companies), the AAI can impose ancillary penalties with a strong reputational and commercial impact: public reprimand, a ban on obtaining grants and a ban on contracting with the public sector for a set period. Very serious infringements have a limitation period of three years.

Serious infringements

These cover conducts that limit the rights and safeguards of the system, but without reaching the severity of the above. Included here, for example, are:

Failing to adopt the necessary measures to guarantee the confidentiality and secrecy of communications.
Breaching the whistleblower’s anonymity in a manner less harmful than in the very serious case.
Repeat offending in the commission of minor infringements.

Serious infringements have a limitation period of two years.

Minor infringements

These are the least significant breaches, although that does not mean they go unpunished. Among them:

The deliberate sending of incomplete information by whoever is required to inform the AAI.
Failing to comply with the duty to cooperate with the investigation of reports.
Any breach of the law’s obligations that is not classified as serious or very serious.

Minor infringements have a limitation period of six months.

LapsoWork whistleblowing channel: avoid penalties

The simplest way not to expose yourself to any of these fines is to set up a whistleblowing channel that meets all the legal requirements from day one. And that is exactly what the LapsoWork whistleblowing channel offers: an internal reporting system that guarantees the whistleblower’s anonymity and confidentiality, with a clear, accessible interface so that any employee can use it without friction.

With LapsoWork you get:

Receipt of anonymous or identified reports, with secure, encrypted communication.
Traceability and a record of every case, with the acknowledgement (7 days) and response (3 months) deadlines required by law.
Guaranteed confidentiality throughout the process, complying with RGPD and Ley 2/2023.
Integration with the rest of your people management: you can keep it alongside your time tracking software and other HR tools on a single platform.

It is not worth risking the future of your company by not spending a few minutes setting up the channel. Against fines that start at 1,001 euros and reach up to one million, having a compliant system is the most cost-effective decision you can make. If you want to see it in action, contract the whistleblowing channel and discover how easy it is to comply with the law using LapsoWork.