EU Whistleblowing Directive 2019/1937 Compliance Auditor
Verify compliance with mandatory internal reporting channels, strict statutory deadlines (7-day ack / 3-month follow-up), and anti-retaliation rules.
Internal whistleblowing channel: Directive 2019/1937 duties
Directive (EU) 2019/1937 requires an internal reporting channel in every private entity with at least 50 workers, and in all financial-services and anti-money-laundering firms whatever their size. The reporting person must get an acknowledgement within 7 days and feedback on follow-up within 3 months. The tool tells you whether you are covered and scores your set-up out of 100.
What the tool assesses
The scheme is mandatory from 50 employees, or with no threshold if you tick a financial, insurance or anti-money-laundering activity. The timeline shown depends on headcount: 17 December 2021 from 250 employees, 17 December 2023 for 50 to 249. The score adds up five criteria:
| Criterion | Points |
|---|---|
| Secure channel ensuring confidentiality | 25 |
| Acknowledgement within 7 days | 20 |
| Feedback on follow-up within 3 months | 20 |
| Written anti-retaliation procedure | 20 |
| Impartial designated officer | 15 |
Below 50 points the tool flags critical non-compliance; from 50 to 79, partial compliance; from 80, satisfactory compliance.
Example
Company with 120 employees meeting every criterion except the officer: 25 + 20 + 20 + 20 = 85 points. The scheme has been mandatory since 17 December 2023 and the level is satisfactory; appointing an officer brings the score to 100.
Limits
- The score is a reading grid, not a legal measure: the law awards no points.
- The deadlines shown follow the directive. In France, the decree of 3 October 2022 sets 7 working days for the acknowledgement.
- The label on obstructing a report (up to 3 years) does not match French law: obstruction carries one year's imprisonment and a €15,000 fine; the 3 years apply to discriminatory retaliation.
- The tool helps spot gaps and does not replace advice from a lawyer.
Sources and dates: Directive (EU) 2019/1937, Arts. 8, 9 and 26; French Law No. 2022-401 of 21 March 2022 (Waserman Law), in force on 1 September 2022; Decree No. 2022-1284 of 3 October 2022, Art. 4; Law No. 2016-1691, Art. 13, version of 1 September 2022 (checked 14/10/2026).
Frequently Asked Questions
From how many employees is an internal reporting channel required?
From 50 employees in the private sector, under Directive (EU) 2019/1937 and, in France, the Sapin II Law as amended by the Waserman Law. Financial-services and anti-money-laundering firms must have one whatever their size. Entities with 50 to 249 employees had to comply by 17 December 2023 at the latest.
What deadlines apply after a report?
Acknowledge receipt in writing within 7 days (7 working days in France under the decree of 3 October 2022), then tell the reporting person what action is planned or taken within 3 months of the acknowledgement. Without an acknowledgement, the 3 months run from the end of the 7 days following the report.
What are the penalties for obstructing a report in France?
Obstructing the transmission of a report in any way is punishable by one year's imprisonment and a €15,000 fine (Article 13 of the Sapin II Law). Abusive proceedings against a whistleblower can lead to a civil fine of up to €60,000, on top of any damages.
Does a company with fewer than 50 employees need a whistleblowing scheme?
It is not required to, unless it operates in financial services or anti-money laundering. Its employees remain protected: they can go straight to an external authority, such as the Défenseur des droits in France. The tool then shows not mandatory but still scores the set-up.
Is this tool really free?
Yes, all tools on Kristools are 100% free and accessible without registration.
Is my data protected?
Yes. All processing is performed directly and securely inside your browser. No personal data is sent to our servers.