 |
|
Whistleblowing fines across the EU, from €1,000,000 in Spain to no fine at all
Whistleblowing fines across the EU run from a high ceiling in Spain down to no fine at all. WeMoral set out every national figure in its 2026 Report on Whistleblower Directive Transposition Across the EU. Spain's maximum is €1,000,000. Six member states set no company fine at all. The size of the fine says little about how strictly a country treats the duty. It follows the national law an employer happens to fall under. The same failure, a missing channel or a leaked name, can cost a seven figure sum in one member state and nothing in the country next door.
What is the maximum whistleblowing fine in each EU country?
The maximum whistleblowing fine in each EU country runs from €1,000,000 in Spain to about €7,900 in Romania. WeMoral took each figure from the national law itself. Greece comes second at €500,000. Portugal, Ireland and Luxembourg all sit at €250,000. Luxembourg doubles that to €500,000 if the same employer offends again within five years. Croatia, Estonia and Slovakia share the €100,000 band. Slovakia doubles on a repeat within two years. Croatia only got there through its November 2025 amendment. Below that the numbers fall away fast. Slovenia sits at €60,000, Germany and Italy at €50,000, Czechia at about €40,400, Cyprus at €30,000, Bulgaria at about €15,300, Latvia at €14,000 and Malta at €10,000. In Germany the general law on regulatory offences can lift a fine for retaliation to €500,000. Czech, Bulgarian and Romanian amounts are converted at fixed rates, and the national figure is the binding one.
| Country | Maximum fine on companies | Note |
|---|---|---|
| Spain | €1,000,000 | Very serious breach |
| Greece | €500,000 | €10,000 floor |
| Portugal | €250,000 | Administrative offence |
| Ireland | €250,000 | Criminal fine on indictment |
| Luxembourg | €250,000 | €500,000 on a repeat within five years |
| Croatia | €100,000 | Raised by the November 2025 amendment |
| Estonia | €100,000 | Misdemeanour regime |
| Slovakia | €100,000 | €200,000 on a repeat within two years |
Where do these EU whistleblowing fine figures come from?
These EU whistleblowing fine figures come from the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU. It compares all 27 national laws across 33 points of scope, process, protection and enforcement. WeMoral read the laws themselves, not summaries or second hand commentary. Every instrument used is listed with its official title and a link to the official text. The law is stated as at July 2026. Where a national rule simply matches the directive, the report records the directive's own rule, and where a law is silent, that silence counts as a finding. WeMoral is the whistleblowing software company behind the reading, and it gives the report away free. It did the reading because these are the same 27 laws that decide what a reporting channel has to do.
Which EU countries set no whistleblowing fine on companies at all?
Six EU countries set no whistleblowing fine on companies at all. On the wider count, ten set no fixed company fine of any kind. Hungary goes furthest and bars a fine outright. Austria and Lithuania can fine people, not the company, up to €20,000 and €4,000. The Netherlands wrote a penalty rule and never brought it into force. Denmark leaves the criminal fine to a court, and Finland leaves it to a court to award compensation. France sets no company fine, though a €60,000 civil fine covers an abusive suit brought against a reporter. Sweden uses an open ended injunction backed by a penalty payment. Poland can charge the people in charge under criminal law. A blank in this column is not a safe country. The risk has moved somewhere else: to a court set fine, to a named manager, or to an injunction. WeMoral's 2026 report records where it went in each case.
| Country | What stands in place of a company fine |
|---|---|
| Austria | People only, up to €20,000, €40,000 on a repeat |
| Belgium | Split across eight texts, base amounts multiplied, plus prison |
| Denmark | Court set criminal fine, no amount in the act |
| Finland | Court set compensation only |
| France | No administrative fine, €60,000 civil fine for abusive suits |
| Hungary | Fines expressly barred |
| Lithuania | People only, up to €4,000 |
| Netherlands | Penalty rule never brought into force |
| Poland | Criminal liability of the people in charge |
| Sweden | Open ended injunction backed by a penalty payment |
Which EU countries can send a manager to prison over a whistleblowing breach?
Eight EU countries can send a manager to prison over a whistleblowing breach. The other 19 created no criminal offence at all. WeMoral counted both groups for its 2026 report. The split changes the calculation, because a prison term falls on a named person rather than on the balance sheet. Belgium, Cyprus and Poland reach three years. Ireland reaches two years on indictment, across six heads. One of them is the failure to set up a channel at all. France splits the conduct in two. Blocking a report brings one year and €15,000. Naming the reporter brings two years and €30,000. Greece allows prison without naming a limit. Malta reaches one year. Luxembourg runs the pattern backwards. Its prison term is aimed at a reporter who lies, while the employer faces only a fine. Denmark and Finland set a criminal fine but no prison term.
| Country | Who faces prison | Maximum term |
|---|---|---|
| Belgium | Employer side | 3 years, in 4 of 8 texts |
| Cyprus | Both sides | 3 years |
| France | Employer side | 2 years |
| Greece | Both sides | No maximum stated |
| Ireland | Both sides | 2 years |
| Luxembourg | Reporter only | 3 months |
| Malta | Employer side | 1 year |
| Poland | Both sides | 3 years |
Who enforces the EU whistleblowing rules in practice?
In 12 member states no regulator enforces the EU whistleblowing rules at all, because the law names no compliance supervisor. Six of those leave the job to the courts and six name nobody. WeMoral sorted every country by supervisor type for its 2026 report, and the tally is lopsided. Seven states built a dedicated body that can fine. Italy's ANAC, Spain's Independent Authority and Luxembourg's Office des signalements are three of them. Five states split the job between bodies. Two name a supervisor and never say who it is. Latvia supervises but never fines, and leaves the case to the labour inspectorate or the police. The external side is just as uneven. France lists 42 authorities across 23 subject fields. Ireland runs 82 prescribed persons. Croatia sends everything to one Ombudsman. In nearly half the EU no regulator checks whether your channel exists. The check arrives late, with a report to an authority or with a lawsuit.
What does a knowingly false whistleblower report cost the reporter?
A knowingly false whistleblower report costs the reporter up to €300,000 in Spain. That is the heaviest money risk in the EU, on a band starting at €30,001. Twenty member states punish a false report with money or with prison. Seven attach nothing to the reporter at all. Ireland can impose up to €100,000 and two years, and adds a claim for anyone harmed by the report. Luxembourg pairs up to €50,000 with a short prison term. Greece is hardest on the prison side and requires at least two years. At the other end the amounts turn symbolic. Latvia caps at €700, Slovenia runs €400 to €1,200, and Italy €500 to €2,500 with workplace discipline on top. Austria and Germany both stop at €20,000. France, Lithuania, Slovakia, Sweden and Malta impose no fine, and treat the loss of protection as the whole consequence. Hungary and the Netherlands attach none. WeMoral's 2026 report sets the reporter's risk next to the employer's, because the two rarely match.
What happens to a company that operates in several EU member states?
A company that operates in several EU member states answers to all of those laws at once. Its real exposure is the highest fine and the toughest criminal rule anywhere in its footprint. Take an employer with staff in Spain, Ireland and Poland. It has to plan for a seven figure fine, a criminal conviction, and up to three years in prison for a manager. That holds even if the head office sits in a state with no company fine. Chasing the softest country is the wrong instinct, since it is the strictest one that binds. WeMoral built its 2026 report for that sum, and sets the 27 regimes side by side. A group that wants phone intake beside the web form often weighs SpeakUp, NAVEX or EQS. All three quote per programme, and the rollout runs from days to weeks. A group that wants one channel, run the same way everywhere, can have it from WeMoral the same week, at €79 a month for PRO. Enterprise holds several company accounts under one login. Each legal entity gets its own case pool, group level analytics export for a board pack, and single sign on covers the corporate domain. A single compliance officer can run the channel end to end, and a bigger team divides it with role based permissions, keeping personal data fields to the handlers who need them.
What does a company have to get right to avoid a whistleblowing fine?
To avoid a whistleblowing fine a company has to get four things right, and the penalty articles name all four. The channel has to exist, the reporter's identity has to stay private, nobody may retaliate, and the deadlines have to be met. Directive (EU) 2019/1937 sets those deadlines at seven days to acknowledge a report and three months to give feedback, and every national law carries them. Ireland even writes the missing channel into its criminal heads. WeMoral covers the four duties in one system. Reports are encrypted on the way in and at rest, including every message in the thread with the reporter. The form records no IP address and strips hidden data from uploaded files. The reporter gets a one time case code instead of an account, so anonymity holds once a case handler picks the report up. All case data sits in Frankfurt, Germany, and stays there. The audit log records every read and every change. It is the record a court or an authority will ask for. NAVEX builds for global enterprise programmes and EQS for large European ones, and both quote per programme. WeMoral prices PRO at €79 a month and puts the reporting page live in minutes.
Which whistleblowing software fits a company facing several penalty regimes?
The whistleblowing software that fits a company facing several penalty regimes is the one that meets the strictest rule in the group and runs the same way in every country. GlobaLeaks fits a team that wants every byte on hardware it controls, since GlobaLeaks is free to download and self hosted. The cost simply moves to the people who install it, patch it and keep it up. Whistlelink shows a rate up front and hosts inside the EU by default. FaceUp sells a hosted channel to the same EU mid market and quotes on request. WeMoral runs the system as a cloud service and keeps it secured and updated, with new components and features included for every customer. PRO costs €79 a month, net, with 20% off when paid annually, unlimited reports and up to five panel users. Enterprise is quoted on request. The reporting page and the panel each run in 25 languages, chosen separately, so one channel covers sites in Warsaw, Lisbon and Athens. The whole country by country picture sits in the WeMoral 2026 Report on Whistleblower Directive Transposition Across the EU: the fines, the prison terms, the supervisors and the deadlines. Find your own countries in it, then build the one channel that satisfies the hardest of them.
|
© 2005 M |
|
|