What is the threat if a company does not set up an internal reporting office?

The future Whistleblower Protection Act contains many requirements for companies, such as the establishment and operation of an internal reporting office. If a company does not comply with these regulations, it faces heavy fines.

Interne Meldestelle einrichten

For which violations are sanctions provided?

It is common for laws that impose duties on citizens to accompany them with sanctions. This is intended to ensure compliance with the law. The government draft of a whistleblower protection law provides for sanctions for five different violations of the law:

If the management fails to set up or operate an internal reporting office, the competent authority may impose a fine of up to twenty thousand euros. Of course, this only applies to companies that are required by law to set up an internal reporting office. It should be noted that the obligation to set up and operate a reporting office generally applies from the time the law comes into force. Only companies with a maximum of 249 employees are granted a deadline for setting it up until December 17, 2023.

The remaining fines relate to the receipt and handling of information reports. If the submission of a report is already prevented, a fine of up to one hundred thousand euros may be imposed. This also applies if the report was received but the follow-up communication with the whistleblower is disrupted. The same sanction applies if the employer takes reprisals against a whistleblower, for example if he or she terminates employment as a result of the report. At this point, the company also incurs additional costs. In the event of a violation of the ban on reprisals, the whistleblower concerned is entitled to claim damages. In addition, the company must prove in court that the adverse action is not related to the whistleblowing, i.e. that it is not a reprisal. Fines of the same amount can also be imposed if the company merely attempts to prevent a report from being made, to hinder communication or to take measures to the detriment of the person making the report.

Finally, violations of the confidentiality requirement are also subject to fines. If the identity of a person providing information is intentionally or even inadvertently disclosed without authorization, penalties of up to twenty thousand euros may be imposed.

However, whistleblowers may also face fines. This is the case if they provide false information about a violation to the public against their better knowledge. Such behavior can result in a fine of twenty thousand euros. The company concerned can also claim damages.

Who can be affected by the sanctions?

Fines are imposed for behavior that constitutes an administrative offense. This includes, for example, running a red light, but also the above-mentioned behaviors. They are therefore generally imposed on the person who has committed the illegal act. In the examples given, this is the driver or the person who prevented a report from being submitted.

However, the company can also be prosecuted for administrative offenses committed by its employees. If the management does not adequately monitor compliance with the provisions of a law, fines can also be imposed on the company in question. In the case of the Whistleblower Protection Act (draft), up to one million euros must then be paid.


The legal framework for corporate governance is becoming increasingly complex. The government's draft of a whistleblower protection law also stipulates a number of obligations that must be fulfilled, otherwise there is a risk of heavy fines. The establishment of an internal reporting office alone is not enough. Rather, close cooperation with the responsible employees, good compliance and reliable documentation of processes and documents are required to avert possible administrative offense proceedings.