The Channel That Need Not Be Anonymous: Why Germany's Whistleblower Act Punishes the Missing Reporting Office More Mildly Than the Handling of a Report – and Why the Real Liability Sits in a Presumption

The Hook: The Wrong Question in the Project Brief

Picture a company with 140 employees. Software-adjacent services, three sites, a works council, and a management team that takes compliance seriously as soon as someone reminds them. In the autumn of 2023 the reminder arrives as a client bulletin from the tax advisors: as of 17 December you need a whistleblowing system.

What happens next happened in this same variant across thousands of mid-market companies. A tool gets procured. A portal, a mailbox, a phone number, in better cases software with a case file. Someone from HR or Legal is appointed. An intranet page appears. The project counts as finished, because the question it started with has been answered: do we have a reporting channel?

That is the wrong question. Not because the channel is unimportant, but because the statute puts its weight somewhere else. Read the German Whistleblower Protection Act by the relationship between duty and sanction, and you find a tier structure that runs against intuition: failing to set up an internal reporting office – the one duty everybody talked about – sits in § 40(6) HinSchG in the middle fine tier, up to twenty thousand euros. The top tier, up to fifty thousand euros, holds three other things: obstructing a report, taking a reprisal, and the intentional or reckless breach of confidentiality.

So the statute does not primarily punish the absence of the channel. It punishes more severely what happens to a report once it has arrived.

And even that tier structure is not the real lever. That sits in § 36(2) HinSchG: if a reporting person suffers a detriment after a report and asserts the connection, the detriment is presumed to be a reprisal – and the employer has to prove otherwise. A fine of up to twenty thousand euros is an annoyance for a company of 140 people. A presumption you can only rebut with documents created before the report is an architectural problem.

This article therefore reads the HinSchG and the underlying Directive (EU) 2019/1937 not as a procurement requirement, but as what they actually are for an IT system: a requirement about deadlines, role separation, evidential record-keeping – and a deletion duty that stands in tension with the need for evidence.

Part 1: The Core Concept – Two Legal Acts, One Procedure

The Directive

The foundation is Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. It was published on 26 November 2019; according to the EUR-Lex metadata it first entered into force on 16 December 2019.

Its underlying idea is not "reporting channel" but protection. The Directive governs first and foremost the conditions under which a reporting person incurs no liability and may not be disadvantaged; the channel is the means, not the end. Article 21(2) makes this visible by framing protection as an exclusion of liability: where persons report in accordance with the Directive, they "shall not be considered to have breached any restriction on disclosure of information and shall not incur liability of any kind in respect of such a report or public disclosure", provided they had reasonable grounds to believe the report was necessary for revealing a breach. Article 21(7) carries this into proceedings "including for defamation, breach of copyright, breach of secrecy, breach of data protection rules, disclosure of trade secrets, or for compensation claims" – with an express right to rely on the report to seek dismissal of the case.

Only on top of that does the organisational duty rest. Article 8(1) requires Member States to ensure that legal entities in the private and public sector establish channels and procedures for internal reporting and for follow-up, "following consultation and in agreement with the social partners where provided for by national law". For the private sector, Article 8(3) states that this duty "shall apply to legal entities in the private sector with 50 or more workers."

Two opening clauses matter more in practice than their numbering suggests:

Article 8(6) allows private entities with 50 to 249 workers to share resources for receiving reports and carrying out investigations – expressly "without prejudice to the obligations imposed upon such entities by this Directive to maintain confidentiality, to give feedback, and to address the reported breach." The duties of confidentiality, feedback and remediation therefore stay with the individual entity. What may be shared is the workbench, not the responsibility.

Article 8(7) allows Member States, following an appropriate risk assessment that takes account of the nature of the activities and the resulting level of risk "in particular, the environment and public health", to require entities with fewer than 50 workers to establish internal channels too. Germany did not take this option for small companies in general; it did, however, exempt one sector from the threshold altogether via § 12(3) HinSchG (see Part 2).

The German Statute

Transposition came through the Act for Better Protection of Reporting Persons (Whistleblower Protection Act – HinSchG) of 31 May 2023, published as BGBl. 2023 I Nr. 140. Under Article 10(2) of that Act it entered into force on 2 July 2023, with § 41 already on 3 June 2023. At the time this article was written, gesetze-im-internet.de states its status as: last amended by Article 9(1) of the Act of 25 September 2026 (BGBl. 2026 I Nr. 275). What that amendment changed is not apparent from the page retrieved, so I did not evaluate it.

The material scope in § 2 is built so that it treats two categories of breach differently. Under § 2(1) no. 1 the Act covers reports about "Verstöße, die strafbewehrt sind" – breaches subject to criminal penalty, without restriction. Under no. 2, by contrast, only those breaches "die bußgeldbewehrt sind, soweit die verletzte Vorschrift dem Schutz von Leben, Leib oder Gesundheit oder dem Schutz der Rechte von Beschäftigten oder ihrer Vertretungsorgane dient" – subject to administrative fine, but only where the provision breached protects life, limb or health, or the rights of employees or their representative bodies. That asymmetry matters in practice: every criminal offence counts, but not every regulatory offence. On top of this come the Union-law subject areas in § 2(1) nos. 3 to 11, and in § 2(2) breaches against the protection of the Union's financial interests (Article 325 TFEU) and against internal market rules (Article 26(2) TFEU).

For a system, this means: scope is not a checkbox on the reporting form. Whether a report falls under the Act is the outcome of a legal assessment that is only possible after receipt – and the clock runs from receipt.

The Free Choice, and What Is One-Sided About It

§ 7(1) HinSchG gives the reporting person the choice between an internal and an external reporting office. Sentence 2 expresses a preference, but only as a recommendation: such persons "sollten" – should – prefer the internal route in cases where the breach can be effectively addressed internally and they fear no reprisals. Sentence 3 makes clear that the external route remains open if an internally reported breach was not remedied.

The other direction is drafted more strictly. § 7(3) requires covered employers to create incentives for internal reporting and to provide clear, easily accessible information about the internal procedure – and immediately draws the line: "Die Möglichkeit einer externen Meldung darf hierdurch nicht beschränkt oder erschwert werden." The possibility of external reporting must not thereby be restricted or made more difficult. And § 7(2) sets up a prohibition of its own: it is forbidden to obstruct, or attempt to obstruct, reports or the subsequent communication between the reporting person and the reporting office.

This obstruction prohibition is the provision that reappears in the top fine tier in Part 5. It is broadly drafted: obstruction is not only shutting down the portal, but plausibly also making the communication harder – a reporting route unreachable without a corporate login, say, or a procedure that routes every follow-up question through the line manager. I am of the opinion that this second reading matches the wording; I did not check, in this run, for a decision confirming it for concrete system designs.

Part 2: Who Is Covered – and From When

§ 12(1) sentence 1 HinSchG is terse: employers "haben dafür zu sorgen, dass bei ihnen mindestens eine Stelle für interne Meldungen eingerichtet ist und betrieben wird, an die sich Beschäftigte wenden können (interne Meldestelle)" – they must ensure that at least one internal reporting office is set up and operated. Two verbs, and both count: a portal that exists but whose mailbox nobody reads does not satisfy the provision.

§ 12(2) sets the threshold: "Die Pflicht nach Absatz 1 Satz 1 gilt nur für Beschäftigungsgeber mit jeweils in der Regel mindestens 50 Beschäftigten." The word "jeweils" – each, respectively – is not filler: it ties the threshold to the individual employer, not to the group.

§ 12(3) inverts the logic for one sector: "Abweichend von Absatz 2 gilt die Pflicht nach Absatz 1 Satz 1 unabhängig von der Zahl der Beschäftigten für" nine categories, among them investment services firms, institutions within the meaning of § 1(1b) of the Banking Act, capital management companies, undertakings under § 1(1) of the Insurance Supervision Act, and institutions within the meaning of § 1(3) of the Payment Services Supervision Act. For a financial or payment services firm with twelve employees, then, the duty applies from day one.

The Two Deadlines That Are Not the Same Deadline

Here is a detail that the advisory literature of 2023 often collapsed into one, although the statute separates it. § 42 HinSchG contains two different dates:

The ordering of these dates is the instructive part. The fine provision became applicable on the 1st of December 2023 – that is, sixteen days before the duty began to run at all for the group with 50 to 249 employees. For companies with 250 or more employees, who had been covered since 2 July 2023, § 42(2) thereby closed the sanction gap as of 1 December 2023; for the smaller group the duty only began on 17 December 2023 and was subject to the fine from that day on. The two dates therefore belong to two different sets of addressees – read them as one deadline and you date one of the two groups wrongly.

And the Directive shows how narrow its own exception was: Article 26(2) does not defer transposition of the Directive for smaller companies, only "the obligation to establish internal reporting channels under Article 8(3)". Everything else – protection against retaliation, confidentiality, exclusion of liability – had to be in force from 17 December 2021, irrespective of company size.

The Joint Office, and What It Does Not Take Off Your Plate

In Germany, the shared-service solution sits not in § 12 but in § 14(2) HinSchG: "Mehrere private Beschäftigungsgeber mit in der Regel 50 bis 249 Beschäftigten können für die Entgegennahme von Meldungen und für die weiteren nach diesem Gesetz vorgesehenen Maßnahmen eine gemeinsame Stelle einrichten und betreiben." Several private employers with, as a rule, 50 to 249 employees may set up and operate a joint office for receiving reports and for the further measures provided for by the Act. And then the sentence that limits the construction: "Die Pflicht, Maßnahmen zu ergreifen, um den Verstoß abzustellen, und die Pflicht zur Rückmeldung an die hinweisgebende Person verbleiben bei dem einzelnen Beschäftigungsgeber." The duty to take measures to stop the breach, and the duty to give feedback to the reporting person, remain with the individual employer.

That is the literal transposition of Article 8(6) of the Directive, and it has an immediate consequence for every group or consortium solution: the shared service is an intake desk, not a case owner. Build a central reporting office for several entities and you need a separate, demonstrable allocation of remediation and feedback per entity – and therefore a tenancy separation in the system that governs not only the visibility of data but the ownership of deadlines.

Part 3: The Anonymity Gap

Here the German legislature made a decision that many system rollouts tacitly assume went the other way.

The Directive expressly leaves the question to the Member States. Article 6(2) reads: "Without prejudice to existing obligations to provide for anonymous reporting by virtue of Union law, this Directive does not affect the power of Member States to decide whether legal entities in the private or public sector and competent authorities are required to accept and follow up on anonymous reports of breaches." The Directive therefore does not require anonymous reporting channels; it leaves the decision open and does not touch existing Union-law obligations.

Germany made that decision in § 16(1) HinSchG, in two sentences whose modal verbs have to be read separately: "Die interne Meldestelle sollte auch anonym eingehende Meldungen bearbeiten. Es besteht allerdings keine Verpflichtung, die Meldekanäle so zu gestalten, dass sie die Abgabe anonymer Meldungen ermöglichen." The internal reporting office should also process anonymously submitted reports. There is, however, no obligation to design the channels so that anonymous reports can be made.

That is twice less than a duty. Sentence 1 is a "should" – an expectation without an enforcement mechanism. Sentence 2 expressly rules out deriving a channel-design obligation from sentence 1. Operating a whistleblowing system in Germany without an anonymity function therefore does not breach § 16(1).

Only: the risk does not disappear, it shifts. Article 6(3) of the Directive provides that persons who reported or publicly disclosed anonymously "but who are subsequently identified and suffer retaliation, shall nonetheless qualify for the protection provided for under Chapter VI", provided they meet the conditions of paragraph 1. Protection therefore attaches to the person, not to the channel. A system without an anonymity function must consequently withstand exactly what one with it must: it must stop the identity of a reporting person circulating further than the procedure requires.

And that duty is the sharply sanctioned one. § 8(1) sentence 1 HinSchG establishes the confidentiality requirement; § 40(3) makes intentional or reckless breach a regulatory offence; § 40(6) assigns it to the top tier of up to fifty thousand euros. Failing to set up the channel sits below that.

From this follows an architectural requirement that holds regardless of the anonymity decision: the reporting person's identity is a protected asset in its own right with its own access control, not a field in the case record. Case handling, investigation and remediation must be able to work, as far as possible, with a pseudonymised case – not because the law demands anonymity, but because it punishes the breach of confidentiality more harshly than the absence of the entire system.

Part 4: The Clock – Seven Days, Three Months, and a Deadline That Does Not Wait

Both legal acts set identical deadlines, and they set them so that doing nothing does not extend them.

Article 9(1)(b) of the Directive requires "acknowledgment of receipt of the report to the reporting person within seven days of that receipt". § 17(1) no. 1 HinSchG transposes this: the internal reporting office "bestätigt der hinweisgebenden Person den Eingang einer Meldung spätestens nach sieben Tagen" – confirms receipt no later than seven days.

For substantive feedback, Article 9(1)(f) names "a reasonable timeframe to provide feedback, not exceeding three months from the acknowledgment of receipt or, if no acknowledgement was sent to the reporting person, three months from the expiry of the seven-day period after the report was made". § 17(2) HinSchG says the same: feedback "innerhalb von drei Monaten nach der Bestätigung des Eingangs der Meldung oder, wenn der Eingang nicht bestätigt wurde, spätestens drei Monate und sieben Tage nach Eingang der Meldung" – within three months of the acknowledgement, or, if receipt was not acknowledged, at the latest three months and seven days after the report arrived.

That second clause is the real design decision. The three-month deadline attaches to the acknowledgement – but whoever fails to acknowledge gains no time, merely loses the reference point and receives a maximum deadline of receipt plus seven days plus three months. The deadline is thereby immunised against the obvious workaround: you cannot push it back by omitting the acknowledgement.

And the deadline has an effect outside the company. Article 15(1)(a) of the Directive makes a public disclosure eligible for protection where the person first reported internally and externally, or directly externally, "but no appropriate action was taken in response to the report within the timeframe referred to in point (f) of Article 9(1) or point (d) of Article 11(2)". So the three months are not merely a service commitment. They are the period after whose expiry going public can acquire its protection.

Article 15(1)(b) names two further routes there that need no deadline: reasonable grounds to believe the breach "may constitute an imminent or manifest danger to the public interest, such as where there is an emergency situation or a risk of irreversible damage", or – in the case of external reporting – that "there is a risk of retaliation or there is a low prospect of the breach being effectively addressed", for instance because evidence may be concealed or destroyed or an authority may be in collusion with the perpetrator.

For a system, the deadline mechanics mean three things. First: the timestamp of receipt is a legally relevant date and must be tamper-resistant. Second: the clock needs two timers per case, not one, and the second depends on the outcome of the first. Third: an exceeded three-month deadline is not primarily a fine risk – it is the precondition under which the same information may land in the press with legal protection.

Part 5: The Fine Tiers, and the Weight in the Unexpected Place

§ 40 HinSchG is where the legislature's priorities can be read off – not from the offences, but from how they are assigned to the tiers in paragraph 6.

The offences:

• (1): knowingly disclosing incorrect information contrary to § 32(2).
• (2) no. 1: obstructing a report or the communication named in § 7(2).
• (2) no. 2: failing, contrary to § 12(1) sentence 1, to ensure that an internal reporting office is set up and operated.
• (2) no. 3: taking a reprisal contrary to § 36(1) sentence 1, also in conjunction with § 34.
• (3): intentionally or recklessly failing to maintain confidentiality contrary to § 8(1) sentence 1.
• (4): committing an act described in paragraph 3 negligently.
• (5): the attempt, in the cases of paragraph 2 nos. 1 and 3.

And the assignment, verbatim from § 40(6): the offence may be sanctioned "in den Fällen des Absatzes 2 Nummer 1 und 3, der Absätze 3 und 5 mit einer Geldbuße bis zu fünfzigtausend Euro, in den Fällen der Absätze 1 und 2 Nummer 2 mit einer Geldbuße bis zu zwanzigtausend Euro und in den übrigen Fällen mit einer Geldbuße bis zu zehntausend Euro".

Three observations that follow from the table itself:

First: the attempt to obstruct a report or to take a reprisal sits in the same tier as the completed act – up to fifty thousand euros. The completed failure to set up a reporting office sits below it. On this scale, a failed attempt to suppress a report carries a higher ceiling than the complete absence of the system.

Second: the missing reporting office is the only duty in this list that is a state rather than a behaviour. Every offence in the top tier presupposes an act directed at a specific person. That explains the tiering, but does not automatically justify it: the top tier only arises where someone has already reported – and an employer who operates no channel produces such an occasion less often. I am of the opinion that this constitutes an incentive problem; I did not find, in this run, a study establishing that empirically for the HinSchG.

Third: Article 23(1) of the Directive requires "effective, proportionate and dissuasive penalties" for four behaviours – hindering reporting (point (a)), retaliating (point (b)), bringing vexatious proceedings against protected persons (point (c)), and breaching the duty of confidentiality as to the reporting person's identity (point (d)). The missing internal reporting office is not among them. Germany made it subject to a fine on its own initiative and at the same time placed it in the middle tier. As far as weighting goes, the German scale therefore follows Article 23's list of priorities – it punishes exactly those four behaviours most severely. Conversely, Article 23(2) also requires penalties against reporting persons who knowingly report or disclose false information; that reappears in § 40(1).

Part 6: The Reversal of the Burden of Proof – Where Liability Really Arises

§ 36 HinSchG is headed "Verbot von Repressalien; Beweislastumkehr" – prohibition of reprisals; reversal of the burden of proof – and the second half of that heading is the statute's most expensive sentence for a company.

Paragraph 1: "Gegen hinweisgebende Personen gerichtete Repressalien sind verboten. Das gilt auch für die Androhung und den Versuch, Repressalien auszuüben." Reprisals against reporting persons are prohibited; so is threatening or attempting them.

Paragraph 2, in two steps: if a reporting person suffers a detriment in connection with their professional activity and asserts that they suffered it as a consequence of a report or disclosure under the Act, "so wird vermutet, dass diese Benachteiligung eine Repressalie für diese Meldung oder Offenlegung ist" – it is presumed to be a reprisal. "In diesem Fall hat die Person, die die hinweisgebende Person benachteiligt hat, zu beweisen, dass die Benachteiligung auf hinreichend gerechtfertigten Gründen basierte oder dass sie nicht auf der Meldung oder Offenlegung beruhte." In that case the person who caused the detriment must prove that it rested on sufficiently justified grounds, or that it was not based on the report or disclosure.

Article 21(5) of the Directive is the same in principle: given that the person established that they reported or disclosed and suffered a detriment, "it shall be presumed that the detriment was made in retaliation for the report or the public disclosure", and "it shall be for the person who has taken the detrimental measure to prove that that measure was based on duly justified grounds".

Two differences in detail are worth laying side by side. The Directive turns on the report and the detriment being established; German law ties the presumption to the detriment plus the reporting person's assertion of the connection. And German law gives the employer two routes to rebuttal rather than one: sufficiently justified grounds – or that the detriment was not based on the report. Whether that second route is easier in practice is a question of case law that I have not examined here.

For practice the consequence is the same regardless of these subtleties, and it is temporal: the rebuttal has to come from material created before the report. A performance review that documents criticism for the first time after a report arrives is hardly evidence that a missed promotion had nothing to do with the report. A review that has documented the same criticism for two years serves that purpose very well.

That is not a legal requirement but a data requirement: unbroken, time-anchored, non-retroactively-alterable traces of personnel decisions. Keep decisions about promotion, transfer, fixed terms, bonus and dismissal in a system whose history can be overwritten, and you will have no evidence precisely when you need it. The day a report arrives is the day every piece of documentation that already exists gains value, and every new one loses credibility.

Part 7: Thirty-Four Million Euros – and Why They Do Not Land on the Company

On 6 March 2025 the Court of Justice of the European Union ruled in five infringement proceedings concerning the whistleblower directive. The Court's press release No 29/25 of the same day – expressly a non-binding document for media use – names the cases and the amounts:

Germany thus pays the highest lump sum, and without a daily penalty payment; the press release records that the States must pay a lump sum to the Commission and that Estonia, "if it has still not transposed the directive", must also pay the daily penalty. As the governing deadline, footnote 3 of the press release states: "In accordance with Article 26 of that directive, Member States were obliged to adopt the provisions necessary for its application by 17 December 2021 at the latest." The EUR-Lex entry for C-149/23 describes the decision as "Judgment of the Court (Sixth Chamber) of 6 March 2025" and lists in its subject line Article 258 TFEU, Article 26(1) and (3) of the Directive, and Article 260(3) TFEU as the basis for the lump sum. An earlier judgment in the same series, against Poland (C-147/23), is dated by the press release to 25 April 2024.

Now the framing that often gets lost in reporting: these 34 million euros are not a corporate sanction. It is a penalty against the Federal Republic of Germany for late transposition and notification – borne by the federal budget, not by employers. The amount is relevant to a company not as a liability risk but as a signal: the Commission pursued this Directive all the way into the penalty procedure under Article 260(3) TFEU, and the Court attached the highest of the five amounts to the delay.

The comparison between the amounts also admits a reading that has to be put carefully. The order Germany – Czech Republic – Hungary – Estonia – Luxembourg roughly tracks the order of economic size, and the subject line for C-149/23 expressly names the issue "Automatic application of a coefficient for seriousness" – so the Court did engage with the methodology of setting the amount. I am of the opinion that the gaps between the five amounts cannot therefore be explained by the length of the delay alone; which factors the Court weighed, and how, is set out in the grounds of the judgment, which I did not retrieve in this run.

Part 8: The Deletion Duty Against the Need for Evidence

At this point two duties of the Act run towards one another, and the result is not a contradiction but a tension that has to be resolved deliberately.

§ 11(1) HinSchG requires documentation: the responsible persons "dokumentieren alle eingehenden Meldungen in dauerhaft abrufbarer Weise unter Beachtung des Vertraulichkeitsgebots (§ 8)" – they document all incoming reports in a permanently retrievable manner, observing the confidentiality requirement. § 11(5) then sets a deadline: "Die Dokumentation wird drei Jahre nach Abschluss des Verfahrens gelöscht." The documentation is deleted three years after the procedure is closed. And sentence 2 reopens it: "Die Dokumentation kann länger aufbewahrt werden, um die Anforderungen nach diesem Gesetz oder nach anderen Rechtsvorschriften zu erfüllen, solange dies erforderlich und verhältnismäßig ist." It may be kept longer to meet requirements under this Act or other legislation, as long as that is necessary and proportionate.

The Directive does it in Article 18(1) without any fixed period: records of every report received must be kept, and "Reports shall be stored for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law." Germany turned this into a default period with an exception; the Directive knows only the standard.

The tension arises with § 36(2). A presumption of reprisal can bite four years after a reporting procedure closed – employment-law detriments have long lead times, and the presumption is not tied to a deadline. An employer who has deleted the file under § 11(5) sentence 1 must then prove without it that the detriment had other grounds.

Sentence 2 is the way out, but not a comfortable one: longer retention must be "necessary and proportionate", and that is a decision to be justified and documented case by case – not a setting you flip globally to "never delete". In practice this means the deletion deadline belongs in the system as a process with a justification field, not as a cron job.

And one separation helps considerably. What must be deleted is the documentation of the reporting procedure. The history of personnel decisions, on which the rebuttal under § 36(2) actually depends, is a different data holding with its own retention periods. Mix the two – put the performance reviews in the case file – and you delete your defence along with the case file.

Part 9: The Empirical Background – How Tips Actually Arrive

The legal duty says nothing about whether reporting channels work. There are figures on that, and they come with varying degrees of reliability.

The Association of Certified Fraud Examiners publishes "Occupational Fraud 2026: A Report to the Nations", the fourteenth edition of its survey. The following come from the ACFE's own page, which I retrieved in this run: 2,402 real cases, data from 143 countries and territories, 22 major industry categories; the survey ran from July 2025 to September 2025, and the investigations covered had to have occurred since January 2024; of 10,276 responses, 2,402 were usable. Also from the ACFE page: the most common mechanisms by which tips are reported are web-based forms at 46%, email at 34%, and telephone at 23%.

The frequently cited finding that tips are the most common way occupational fraud is detected could not be checked against the primary source in this run: the ACFE report PDF is blocked for automated retrieval. Several secondary summaries consistently cite 43% detection by tip, followed by internal audit at 15% and management review at 13%, along with a median loss of USD 104,000 and a median duration of twelve months; the same summaries report, for organisations with a formal reporting mechanism, a median loss of USD 100,000 versus 150,000 and a median duration of eleven versus seventeen months. I pass these figures on expressly as secondary, not as verified values.

The one figure that is solid from the primary source – the predominance of web-based channels over email and telephone – already carries a design message on its own: the channel through which tips most often arrive is the one that can most easily bring with it a case number, a timestamp and a reply function without disclosing identity. A mailbox cannot do that; neither can a phone call without a record.

Part 10: A Framework for Practice – Six Properties That Follow From the Statutory Text

Not from best practice, but each from a nameable provision:

The difference from the usual checklist is that none of these six properties shows up in a procurement process. Every whistleblowing portal on the market satisfies the criterion "reporting channel present". The six above decide whether the system proves anything in a dispute.

Fact Check

94 claims in this article were checked against primary sources retrieved in this run: the full text of the HinSchG on gesetze-im-internet.de (the single-provision pages for §§ 2, 7, 11, 12, 14, 16, 17, 36, 40, 42 and the consolidated edition), the full text of Directive (EU) 2019/1937 in the version of the EU act published on legislation.gov.uk, press release No 29/25 of the Court of Justice of the European Union and the EUR-Lex entry for C-149/23, and the ACFE report page. 17 claims were corrected or weakened.

The three most important corrections:

1. The draft assigned the missing internal reporting office to the top fine tier of EUR 50,000. § 40(6) HinSchG assigns it to the middle tier of up to EUR 20,000; the EUR 50,000 tier covers obstruction, reprisal, intentional or reckless breach of confidentiality, and the attempt. This correction changed the article's central claim and was carried through into the hook, Part 5, the table and the takeaway.
2. The draft dated the penalty judgment against Germany to 25 April 2024. According to press release No 29/25 it is 6 March 2025; 25 April 2024 is the judgment against Poland (C-147/23).
3. The draft gave the Official Journal reference of the Directive with an L number and page. That detail appeared on no page retrieved in this run and was struck; only the publication date evidenced by the EUR-Lex metadata is given. Likewise the statement that resource sharing for 50 to 249 workers sits in Article 8(7) was corrected – it is Article 8(6) – and the sentence that anonymous reporting channels are mandated by Union law was reduced to the actual content of Article 6(2).

Note: automated AI verification against primary sources; no human expert review. This article is a technical account of the regulatory position and not legal advice.

The Central Takeaway

Two things are worth taking from the statutory text, and both shift the focus away from the reporting channel.

The first: the fine tiers of § 40(6) HinSchG put the weight not on the existence of the channel but on the conduct towards a person who has used it. Obstruction, reprisal and intentional breach of confidentiality sit at up to EUR 50,000, as does the mere attempt at the first two; the missing reporting office sits at up to EUR 20,000. That matches the list of priorities in Article 23(1) of the Directive, in which the missing reporting office does not appear at all.

The second, and the more uncomfortable: the real liability risk is not a fine but the presumption in § 36(2). After a report, any detriment in a professional context is presumed to be a reprisal, and the employer bears the burden of proving otherwise. That presumption can only be rebutted with material created before the report – and § 11(5) simultaneously requires the procedural documentation to be deleted three years after closure, with extension only in so far as it is necessary and proportionate.

The practical prompt for action that follows is technical and achievable in a week. Take the whistleblowing system you have and answer three questions out of the system, not from memory. First, can it output, for every report received, the receipt timestamp, the date of the acknowledgement, and the resulting three-month deadline – and what happens if no acknowledgement was ever sent? Second, can a case be handled without the reporting person's real name appearing in the handling path, and is every access to that identity logged? Third, where does the history of personnel decisions live – in the same file as the reporting procedure or separate from it, and is it change-resistant?

The gaps that surface are the work list. What does not belong on that list is the anonymity function: under § 16(1) sentence 2 HinSchG it is expressly not mandatory in Germany – whereas protecting the identity of those who have identified themselves very much is.

Reflection Question

The German legislature decided in § 16(1) HinSchG against a duty to provide anonymous reporting channels, even though Article 6(2) of the Directive left the decision to it – and even though Article 6(3) expressly continues to protect an anonymous person who is later identified.

That creates a choice every organisation makes for itself. An anonymous channel lowers the threshold for reporting, but makes establishing the facts harder, because follow-up questions remain stuck at the information level of the first report, and it opens a route for reports whose motive cannot be examined. An identified channel allows clean investigation, but asks of the reporting person precisely the trust whose absence was the reason for the whole body of legislation.

How would you decide this for an organisation you are responsible for today? And does your answer change if you frame it not as the person who operates the procedure, but as the person who on Monday morning has to decide whether to report something involving their own direct manager?

Cross-References in the Vault

• Psychological Safety: The Hidden Force Behind High-Performing Teams – the psychological precondition for what the HinSchG tries to compel legally. A reporting channel in a team where raising problems carries a cost stays unused, and no fine ceiling changes that.
• The 38 Witnesses Who Never Were: The Bystander Effect Between Laboratory Finding and Video Evidence – the other side of the same question: what keeps people from acting on observed wrongdoing? The reversal of the burden of proof in § 36(2) is an attempt to shift part of that cost from the observer to the organisation.
• NIS2 and What It Really Means for Mid-Market IT Consulting Firms in Germany – the same shape: a duty with a threshold whose fulfilment you must be able to evidence, and a transposition that arrived in Germany later than the European deadline.
• The Documented Excuse: Why the Exemption in Europe's Accessibility Law Saves No Work but Relocates It – and Why the Duty to Track Standard Revisions Currently Points at a Standard That Does Not Yet Legally Exist – the direct relative in fine architecture: there too, the weight of the scale does not sit where public discussion assumes it does.
• The Algorithm as Judge: Article 22 GDPR, the SCHUFA Ruling, and the Right to a Human Decision – the neighbourhood on burden of proof: in both regimes it is the side holding the information that must explain itself, not the side suffering the detriment.
• When IT Is Not Allowed to Fail: DORA and Digital Operational Resilience in Finance – the same sector that § 12(3) HinSchG covers regardless of headcount, and the same European reflex of lifting financial undertakings out of size thresholds.
• Security by Default: The EU Cyber Resilience Act and the End of the Insecure Product – the third example of a European duty that in practice hangs on whether your own system keeps the right metadata and timestamps.

Sources and Further Reading

1. Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law. Publication date per EUR-Lex metadata 26 Nov 2019; first entry into force 16 Dec 2019. Checked: Art. 6(2) and (3), Art. 8(1), (3), (6), (7) and (9), Art. 9(1)(b) and (f), Art. 15, Art. 18(1), Art. 21(1), (2), (5) and (7), Art. 23, Art. 26(1) to (3) and Art. 27 – in the full text of the EU act as published on legislation.gov.uk, since the EUR-Lex full-text pages refuse automated retrieval. legislation.gov.uk/eudr/2019/1937 · EUR-Lex entry
2. Hinweisgeberschutzgesetz (HinSchG) – Act for Better Protection of Reporting Persons of 31 May 2023 (BGBl. 2023 I Nr. 140); date of signature 31 May 2023, in force under Art. 10(2) of the Act on 2 July 2023, § 41 on 3 June 2023; status of the version retrieved: last amended by Art. 9(1) of the Act of 25 Sept 2026 (BGBl. 2026 I Nr. 275). Checked: §§ 2, 7, 11, 12, 14, 16, 17, 36, 40 and 42. gesetze-im-internet.de/hinschg · § 40 HinSchG · § 42 HinSchG
3. Court of Justice of the European Union: Press Release No 29/25, Luxembourg, 6 March 2025 – judgments in Cases C-149/23 (Commission v Germany), C-150/23 (Luxembourg), C-152/23 (Czech Republic), C-154/23 (Estonia) and C-155/23 (Hungary); the lump sums and the daily penalty payment against Estonia; footnote 3 on the 17 December 2021 transposition deadline; footnote 1 on the judgment against Poland (C-147/23) of 25 April 2024. Expressly an "Unofficial document for media use, not binding on the Court of Justice". curia.europa.eu, cp250029en.pdf
4. EUR-Lex: entry for CELEX 62023CJ0149 – "Judgment of the Court (Sixth Chamber) of 6 March 2025. European Commission v Federal Republic of Germany"; subject line citing Article 258 TFEU, Article 26(1) and (3) of Directive (EU) 2019/1937, Article 260(3) TFEU and the keyword "Automatic application of a coefficient for seriousness". The full text of the judgment was not retrieved in this run. eur-lex.europa.eu, 62023CJ0149
5. Association of Certified Fraud Examiners: Occupational Fraud 2026: A Report to the Nations, 14th edition – 2,402 usable cases from 143 countries and territories, 22 major industry categories, survey July to September 2025, investigations covered since January 2024, 10,276 responses; reporting mechanisms for tips: web-based 46%, email 34%, telephone 23%. The ACFE report page was checked; the report PDF itself is blocked for automated retrieval, which is why the figures on detection method (43% by tip), median loss and the comparison with and without a reporting mechanism are reproduced here as secondary data only. acfe.com/rttn

← All articles