Internal Whistleblowing Channel under Spain's Law 2/2023: Who Must Have One, Requirements and Penalties
What the internal whistleblowing channel is
Spain's Law 2/2023, regulating the protection of persons who report regulatory breaches and the fight against corruption, transposes the EU Whistleblower Directive. It requires organisations to set up an internal reporting system, commonly known as the whistleblowing channel, so that anyone can safely report wrongdoing.
Which companies are obliged
- Private-sector companies with 50 or more employees.
- All public-sector entities.
- Regardless of headcount: political parties, trade unions, foundations and companies in areas such as financial services, anti-money laundering or transport safety.
Companies with 50 to 249 employees may share resources to manage the channel, but each remains responsible for its own system.
System requirements
- Allow reports to be made in writing, verbally or both, and in person on request.
- Guarantee the confidentiality of the whistleblower's identity and of any third parties mentioned.
- Accept anonymous reports.
- Acknowledge receipt within 7 days and respond within a maximum of 3 months.
- Keep a record log of the reports received, complying with data-protection rules.
The System Manager
The company must appoint a System Manager (Responsable del Sistema), an individual or a collegiate body in charge of running the channel and handling cases. They must act with independence and autonomy, without receiving instructions, and their appointment is notified to the Independent Whistleblower Protection Authority.
Protection against retaliation
The law expressly prohibits any form of retaliation against the whistleblower: dismissal, sanctions, harmful changes of duties or exclusion. People who report in good faith are protected, which strengthens the organisation's compliance culture.
Deadlines and penalties
The obligation is already fully in force for all affected companies. The penalty regime is strict:
- Minor breaches: fines of up to 100,000 euros.
- Serious breaches: up to 600,000 euros.
- Very serious breaches: fines from 600,001 to 1,000,000 euros, plus possible additional sanctions.
Setting up the channel is not just a legal duty: it strengthens transparency and reduces risk. At RegulaKit we help you organise your employment-compliance obligations. To estimate the financial impact of non-compliance, use our penalty calculator.
Frequently Asked Questions
Which companies must have a whistleblowing channel?
Private-sector companies with 50 or more employees, all public-sector bodies and certain obliged entities regardless of size, under Law 2/2023.
Are anonymous reports allowed?
Yes. The internal reporting system must allow anonymous reports and guarantee the confidentiality of the whistleblower.
What are the deadlines to handle a report?
Receipt must be acknowledged within 7 days and the case resolved within a maximum of 3 months from receipt.
Who is the System Manager?
The person or body appointed by the company to run the channel with independence and autonomy, notified to the Independent Whistleblower Protection Authority.
What penalties apply for not having a channel?
Very serious breaches can reach fines of up to 1,000,000 euros, alongside other additional sanctions set out in Law 2/2023.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. The information may not be complete, accurate or up to date. For specific legal matters related to your company, always consult a qualified labor law professional or your employment advisor.