Does Our Subsidiary Need Its Own Whistleblowing Channel?

The EU Whistleblowing Directive 2019/1937 sets the framework that now applies across all EU member states (and has influenced non-EU jurisdictions). Article 8 establishes the obligation clearly: organisations with 50 or more employees must put in place an internal reporting channel for workers to report breaches of EU law.

The operative word is "organisation." In law, this means the legal entity itself, not the corporate group.

If your subsidiary is registered as its own legal entity in a member state, employs 50 or more staff, and falls within the scope of the Directive (which covers most commercial sectors), it must have its own channel. This is not optional or subject to parental exemption.

Here is where many organisations stumble. Article 8 does allow organisations with 50 to 249 employees to share certain compliance resources, but this is often misread as permission to share a single hotline or reporting channel.

It is not.

The Directive permits these mid-sized organisations to pool resources for investigation, record-keeping, and follow-up—but each legal entity must still operate its own intake point. They can consolidate the backend; they cannot consolidate the front door.

Why? Because workers need to know exactly whom they are reporting to. A subsidiary employee must be able to report through a channel they recognise as belonging to their own employer. A shared hotline muddles accountability and can actually reduce reporting rates, as workers worry about whether their report will reach the right investigator.

Under Article 8, failure to establish an internal channel does not exempt a worker from protection. Instead, it typically means workers default to external channels: national authorities, regulators, or public disclosure. This removes your organisation's opportunity to investigate and remedy issues internally—often the better outcome for everyone.

Moreover, if a regulator or labour authority discovers that a 50+ legal entity lacked a proper channel, it becomes difficult to argue good faith. The Directive has been in force since December 2019; transposition deadlines in most member states passed in 2021 and 2022. Ignorance is not a convincing defence.

The consequences vary by national transposition—some member states impose fines, others pursue directors personally—but in all cases, reputational damage and loss of worker trust follow quickly.

If your subsidiary does establish its own channel, two other legal requirements kick in immediately.

Article 9 requires that you acknowledge receipt of any report within seven working days. This is binding. A worker who reports a safety breach or financial misconduct is entitled to know, in writing, that you have received their report and have logged it.

You must also provide written feedback on the outcome of your investigation within three months, unless a longer period is justified by the complexity or scope of the investigation. This feedback must be proportionate and, where possible, explain the action taken or reasons for taking no action.

These timelines are foundational to worker trust. A channel that sits silent is worse than no channel at all.

The Directive sets a floor. Each member state has transposed Article 8 into national law, and in some cases gone further or created sector-specific rules.

The UK, for instance, requires organisations to establish a channel under the Prevent Abuse and Whistleblowing Policy (implemented via the Employment Rights Act amendments), with its own timelines and escalation routes.

Germany has the Whistleblower Protection Act, which aligns broadly with the Directive but adds data protection strictures.

France's Sapin 2 law predates the Directive and is more prescriptive in some respects.

In every case, your subsidiary must comply with the national law of the jurisdiction in which it is incorporated and operates. If it operates across multiple member states, it must meet the most stringent standard that applies.