If your company has 50 or more employees, or works in financial services or anti-money laundering with any headcount, Law 2/2023 requires you to have an internal reporting system. We design it, document it and help you run it without putting confidentiality at risk.
Is your company obliged? Free assessment
Tell us your headcount and your sector, and we will tell you whether you need a whistleblowing channel and what you are missing.
A whistleblowing channel is not just a mailbox: the law requires a System Manager, a policy, a procedure, a register and safeguards against retaliation. We take care of the whole system.
We review your headcount, your sector and your corporate group to confirm the obligation under Article 10 of Law 2/2023 and whether you can share the system or its resources with other companies.
We draft the policy that sets out the principles of the system and the procedure approved by the management body: acknowledgment of receipt, investigation, deadlines and the rights of the parties.
We help you choose and appoint the System Manager, ensure their independence and notify the appointment to the competent authority on time.
We define the means of reporting (in writing, verbally or at an in-person meeting if the whistleblower requests one) and make sure they accept anonymous reports and protect identities.
If you decide to entrust the receipt of reports to a third party, we prepare the engagement with the safeguards of independence, confidentiality and data protection required by Article 6.
We support the System Manager in handling cases, in internal investigations and in keeping the register of reports, and in referring matters to the Public Prosecutor’s Office when there are signs of a criminal offense.
The obligation depends on your headcount and, in some sectors, on your activity; not on your revenue.
Every natural or legal person in the private sector with fifty or more employees must have an internal reporting system.
If your activity falls within financial services or anti-money laundering, the obligation applies regardless of the number of employees.
The parent company approves a general policy, and the group can have a single system and a single System Manager.
Companies with between 50 and 249 employees can share the internal reporting system, and the resources to manage it, with each other.
Key data from Law 2/2023 on the protection of persons who report regulatory breaches and on the fight against corruption.
Deadline for sending the whistleblower an acknowledgment of receipt of their report.
Maximum period for responding to the investigation proceedings, extendable by another three months in particularly complex cases.
Deadline for notifying the authority of the System Manager’s appointment or removal, with the reasons in the case of removal.
If no investigation has been opened, the data must be deleted, except to keep evidence of how the system works.
Maximum retention period for data in the register of reports, which is not public.
Maximum fine for legal persons for very serious infringements, such as not having the system or retaliating.
We check whether you are obliged, what you are missing and how to close the gaps before the first report or an inspection arrives.
Private-sector companies with 50 or more employees and, regardless of headcount, those operating in financial services, products and markets, anti-money laundering, transport safety or environmental protection (Article 10 of Law 2/2023). Also political parties, trade unions and business organizations that receive or manage public funds.
Not exactly. The channel is the route through which reports arrive; the internal reporting system also includes the System Manager, the policy, the management procedure, the register of reports and the whistleblower protection safeguards. The law requires the complete system.
Yes. The channel must allow anonymous reports to be submitted and then processed (Article 7(3)). In addition, when whistleblowers identify themselves, their identity must be kept confidential.
Yes, the receipt of reports can be entrusted to an external third party that offers safeguards of independence, confidentiality, data protection and secrecy of communications (Article 6). But responsibility remains with the System Manager, and the third party acts as data processor.
The management body appoints them. In the private sector, it must be an executive who performs the role independently; if the body is collegiate, it must delegate management of the system to one of its members. The appointment and the removal are notified to the authority within ten business days.
Acknowledgment of receipt within seven calendar days and a response within a maximum of three months, extendable by another three in particularly complex cases. If the facts could constitute a criminal offense, the information is immediately referred to the Public Prosecutor’s Office.
Not having an internal reporting system is a very serious infringement. For legal persons, the fine ranges from €600,001 to €1,000,000, and ancillary penalties may be imposed, such as a public reprimand or a ban on contracting with the public sector.
Law 10/2010 already requires obliged entities to have an internal procedure for reporting potential breaches, even anonymously (Article 26 bis), which can be integrated into the general system. Law 2/2023 applies to matters not governed by that specific legislation, so the efficient approach is a single, well-designed system.
A system that works shows at the first report: the whistleblower knows where to go, the System Manager knows what to do and the company can prove it acted properly.
Headcount, sector and group determine whether you are obliged and whether you can share the system with other companies.
An executive with authority, free of conflicts of interest and with the means to handle and investigate reports.
The register of reports, the acknowledgments, the deadlines and the documented decisions prove to the authority that the system works.
Source: Law 2/2023 of February 20 (Arts. 5–12, 26, 32, 36–38 and 63–65).
These terms appear in Law 2/2023 and in any review of your system. Understanding them helps you implement it right the first time.
The whole formed by the channel, the System Manager, the policy, the procedure and the protection safeguards.
Executive appointed by the management body to run the system independently: the person responsible for the system.
Anyone who reports an infringement they learned of in a work or professional context, and who is protected against retaliation.
The person to whom the facts are attributed: they have the right to be informed of them and to be heard.
National authority created by Law 2/2023, with its Statute approved by Royal Decree 1101/2024. It runs the external channel.
A route for reporting directly to the authority, or after using the internal channel. Its existence does not exempt you from having the internal one.
Any harm suffered for having reported: dismissal, demotion, blacklisting or denial of training, among others.
A record of the reports received and of the internal investigations. It is not public.
A provider that receives reports on the company’s behalf and acts as data processor.
In-house management: appointed by the management body.
Outsourced receipt: still internal: responsibility is not transferred.
In-house management: carried out by the company itself with its own resources.
Outsourced receipt: carried out by a third party with safeguards of independence and confidentiality.
In-house management: the company is the data controller.
Outsourced receipt: the third party acts as data processor.
In-house management: led by the System Manager.
Outsourced receipt: still led by the System Manager.
In-house management: real independence from management.
Outsourced receipt: oversight of the provider and traceability of deadlines.
These are failures that a review spots immediately and that leave the company with no defense.
Tell us your headcount, your sector and whether you already have a channel, and we will tell you what you need to comply with Law 2/2023.
Law 2/2023 of February 20, on the protection of persons who report regulatory breaches and on the fight against corruption, transposes Directive (EU) 2019/1937 and requires many companies to have an internal reporting system, known as a whistleblowing channel. Its aim is that anyone who becomes aware of an infringement can report it with safeguards and without fear of retaliation.
Article 10 imposes the obligation on natural or legal persons in the private sector with fifty or more employees and, whatever their headcount, on those operating in financial services, products and markets, the prevention of money laundering or terrorist financing, transport safety and environmental protection. Groups can have a single system, and companies with 50 to 249 employees can share the system and resources.
The management body implements the system, after consulting the employees’ legal representatives, and is the controller of the data. The system must allow written or verbal reports, including anonymous ones, and must have a System Manager (the person responsible for the system), a policy, a management procedure and a register of reports. The deadlines are demanding: acknowledgment of receipt within seven calendar days and a response within three months, extendable by another three.
The law prohibits any retaliation, including threats and attempts. When the whistleblower suffers harm, it is up to whoever took the measure to prove that it was based on justified grounds unrelated to the report. Not having the system, breaching confidentiality or retaliating are very serious infringements, with fines of up to €1 million for legal persons.
The Independent Whistleblower Protection Authority (A.A.I.), whose Statute was approved by Royal Decree 1101/2024, has been operating since September 1, 2025. It runs the external channel and is the authority that must be notified of the System Manager’s appointment at the national level; some autonomous communities have their own authority.
The channel is also part of the compliance model and of the crime prevention plan, and the entry point for internal investigations. If you are an obliged entity under anti-money laundering rules, it is advisable to integrate it with the procedure under Article 26 bis of Law 10/2010.
Key legislation, linked to the official text:
Legislation and links reviewed in .