Decision-making within companies or by employees that breaches regulations can lead to more severe discovery and harsher penalties. Law No. 2/2023, which implements a European directive, requires organizations with more than 50 employees to establish a channel for reporting behavior that contravenes the rules. This reporting option can be completely anonymous, allowing any member of the workforce to raise concerns without revealing their identity.
The goal is to push companies toward heightened vigilance to prevent illegal actions that could impact them, with the risk of public scrutiny and an official investigation if a complaint is corroborated. Legal consequences may follow if the facts disclosed prove true.
In practice, the state will require many firms to implement this anonymous reporting system once they exceed 50 employees. For those with more than 250 workers, a specific deadline applies sooner, while others have additional time to comply. These deadlines have prompted many business leaders to plan information sessions and seminars to align with the new requirements.
These sessions are already attracting attention. The Elche Business Circle and a partner group organized one such event with additional advisory support to help companies understand the impact of the regulation and how to set up the whistleblowing channel.
The Elche business park is home to several large companies that will be affected by the rules. This development underscores the practical shift many firms face as they implement the new channel for reporting misconduct.
One notable innovation is the emphasis on the whistleblowing platform itself. Unlike traditional compliance plans that are primarily about adherence, this regulation mandates a functioning reporting mechanism as a legal requirement.
Alongside the reporting channel, each affected company must establish an internal process to handle submissions and appoint a responsible person to liaise with the new Independent Whistleblower Protection Agency. Confidentiality must always be protected, and anonymity should be preserved where possible for the complainant.
That said, this area remains controversial because it can encourage unfounded complaints or retaliation against coworkers or executives. Critics compare the regime to a new form of inquisition, arguing that modern criminal law has moved away from blaming individuals without proof. Some lawyers caution that care must be taken to distinguish genuine issues from personal grievances.
Planeta Huerto adopts a penalty compliance plan with Devesa & Calvo
From a legal perspective, the law provides a screening process to prevent unnecessary or unfounded complaints. The person responsible for the internal information system should receive training and follow clear criteria for evaluating whether a submission warrants processing. If the matter is personal, clearly false, or merely an opinion about how things should have been done differently, it should not be acted upon.
Complaints may target colleagues who engage in unlawful acts within the firm or even the company itself if irregularities are suspected, such as tax evasion. Any action contrary to European Union law or any act that constitutes a serious offense, including damage to public funds, is covered by the framework.
Where there are indications that a report could amount to a crime, the responsible channel person should refer the matter to the prosecutor’s office for action. It is important to note that in Spain, legal persons can bear criminal liability and may be held responsible alongside individuals.
The scope of the regulation extends beyond private firms to include political parties, trade unions, and commercial organizations that manage public funds. The absence of an anonymous reporting channel can result in substantial penalties, with fines reaching into the hundreds of thousands or even millions of euros. The law allows external providers to manage internal information systems, provided they guarantee independence, confidentiality, data protection, and respect for communications secrecy. This shift is described as a paradigm change by industry observers, highlighting a stronger compliance posture across many organizations.