Companies with more than 50 employees will have to activate a complaints channel that will receive tips about regulatory irregularities starting December 1. This measure, tied to Law 2/2023 on the Protection of Whistleblowers in Spain, targets 27,000 SMEs and represents a significant structural shift in the Spanish business landscape. Until now, only multinational corporations or firms that created their own channels had access to such reporting tools. With the new obligation, a large portion of the business community will be required to enable this mechanism. “Business leaders should view this as a way to foresee violations that could threaten the business. Many already see it this way,” says Rafael Sánchez, Compliance and Crime partner at Fieldfisher. Yet industry groups such as Pimec, representing small and medium-sized firms in Catalonia, warn that the obligation brings extra costs and additional operational responsibilities for entrepreneurs.
Under the law, companies must provide a computer system through which complaints can be submitted and designate a person to manage and investigate their accuracy. “It should be an external employee or someone from within the company. In some organizations, HR handles this, but it is wise to rely on an external expert to avoid conflicts of interest,” Sánchez notes. He adds that the challenge lies in implementing a compliant system without imposing a heavy financial burden. “Initial reactions saw it as another cost and obligation, but many firms are adapting well.”
“Even though there are affordable solutions for SMEs, the channel’s inclusion imposes an extra expense because resources and personnel must be allocated for management,” explains Itziar Ruedas, head of the legal department at Pimec. She notes that firms with existing compliance policies already meet many requirements, but the main hurdle is the availability of a dedicated, specialized role within SMEs, a position that is not common today.
The law requires the reporting channel to be accessible not only to employees but also to third parties outside the organization, such as customers, suppliers, and even competitors. “There is no need to fear complaints. The channel can help anticipate problems and resolve them before they cause substantial damage,” asserts the Fieldfisher expert. Many firms offer technological solutions to support the technical setup and software implementation for the channel.
Legal fundamentals for operating the channel
Beyond the technical tools and the channel lead, companies must also address the legal framework guiding the reporting channel. “Employees should be informed about what is allowed, how to use the channel if irregularities are detected, and so forth,” Sánchez explains. When a complaint arrives, the firm should initiate an investigation to determine whether corruption occurred or any criminal indicators emerge.
Fieldfisher’s Compliance Manager notes that some cases connected to reporting channels involve occupational health and safety issues. “These matters are more often managed by human resources and account for a large portion of inquiries,” he says. Other complaints may concern criticisms of internal procedures or, less frequently, allegations with criminal implications. “For example, hiring a relative or acquaintance at above-market prices to benefit someone can be a signal of fraud,” Sánchez explains, underscoring the channel’s role in detecting wrongdoing and preventing further harm to the organization.
Sanctions
Firms that fail to implement the complaint channel by the mandated date could face severe penalties. Fines may reach up to one million euros, and additional sanctions could include ineligibility for subsidies for up to four years or prohibitions on entering public contracts for up to three years. “In these early months, adjustments will be necessary as systems are tested,” warns Sánchez. “Preparation is critical because the deadline has arrived.”
Related news
“There is little information on sanctions so far. Liability for the largest companies has already been established by June, though some observers note a paradox at the state level: the Independent Authority for the Protection of Whistleblowers has not yet been fully constituted. Nevertheless, prevention remains a priority,” explains Itziar Ruedas of Pimec. She adds that some autonomous communities have begun to absorb these functions, with Catalonia’s Anti-Fraud Office taking on several tasks including channel transmission, support, and enforcement capacity.
Ethical compliance practices in the corporate world often originated in English-speaking markets, where such channels were first adopted. A European directive later mandated these measures, and while each country adapted the rules to its own legal tradition, EU states subsequently integrated similar requirements. “Some nations allow confidential reporting only, while Spain requires both confidential and anonymous reporting,” concludes Sánchez.