Who is required to have an internal reporting channel and from when?

18 April, 2024
–
Compliance
–
MES Advocats


Who are the subjects required to have an internal reporting channel?

The Spanish Law 2/2023, 20th of February, regulating the protection of persons who report regulatory infringements and the fight against corruption (hereinafter “Law 2/2023”), which transposes Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, on the protection of persons reporting breaches of Union law, obliges different subjects to have an Internal Information System. This system is colloquially identified as an “internal reporting channel.”

The internal reporting channel constitutes an internal means that companies and public administrations must make available to third parties to report breaches of the legal system occurring in a in a professional or labour context. The management or governing body of each entity is responsible for implementing the internal reporting channel.

It involves having a tool or platform that allows for proper management of complaints received within the company and/or public administration with the guarantees imposed by Law 2/2023. It should be noted that one of the purposes of this regulation is for the internal reporting channel to be the preferred channel for reporting violations occurring within the company and/or public administration.

The obligation to have an internal reporting channel varies depending on the sector to which each entity belongs. Thus, a distinction must be made between entities in the public sector and entities in the private sector.

Entities in the private sector

Article 10.1 of Law 2/2023 establishes three types of entities required to have an internal reporting channel:

Natural or legal persons with fifty or more employees;

Regardless of the number of employees, private legal persons falling within the scope of EU acts on services, products, and financial markets; prevention of money laundering or terrorist financing; transport security; and environmental protection.

Finally, political parties, trade unions, business organizations, and foundations created by them, provided they receive or manage public funds.

Entities in the public sector

Unlike the private sector, there are no exemptions in the public sector. Therefore, any entity belonging to the public sector is required to have an internal reporting channel.

More specifically, Law 2/2023 specifies the entities obliged in the public sector:

Governmental administrations, such as the General State Administration, Autonomous Community Administrations, and Local Administrations.

Public bodies and entities linked or dependent on any public administration, as well as other associations and corporations in which public administrations and bodies participate.

Financial institutions, such as the Bank of Spain.

Public universities: Complutense University of Madrid, Pompeu Fabra University, etc.

Public law corporations: Professional Associations and Chambers of Commerce.

Public sector foundations.

Companies in which the direct or indirect participation of the aforementioned entities represents more than 50% of the share capital.

This obligation also extends to constitutional bodies, including those of constitutional relevance, and autonomous institutions analogous to the aforementioned ones. Clear examples are the Constitutional Court or the Council of Statutory Guarantees in Catalonia.

What are the deadlines for implementing the internal reporting channel?

The general deadline for implementing the internal reporting channel was three months from the entry into force of Law 2/2023. This deadline expired on June 13th, 2023.

However, the second transitory provision of Law 2/2023 extended this deadline until December 1, 2023, for private legal entities with fewer than 250 employees, as well as for municipalities with a population of fewer than 10,000 inhabitants.

In essence, any company or public administration must have the internal reporting channel in place from December 1, 2023, and if it has not yet been implemented, it is advisable to do so as soon as possible to avoid sanctions imposed by the competent state or regional authority. It should be noted that not having the internal reporting channel is classified by Law 2/2023 as a very serious offense that can result in fines ranging from €30,000 to €300,000 for individuals, and from €600,001 to €1 million for legal entities. In addition, in these cases, the Independent Whistleblower Protection Authority may even decide to publicly admonish the offender; prohibit them from receiving subsidies and other tax benefits for a maximum period of 4 years; and prohibit them from contracting with the public sector for a maximum period of 3 years.

However, the Independent Whistleblower Protection Authority, of a national nature – and which constitutes the competent administrative authority to sanction the offenses typified in Law 2/2023 – is still in the process of being established. The same conclusion is reached when looking at the regional level, except for a few autonomous communities that have already designated the competent administration in their territory to ensure compliance with Law 2/2023 (for example, Catalonia has temporarily designated the Anti-Fraud Office).

Consequently, there is still time for obligated entities that do not yet have the internal reporting channel to implement it. Do not wait any longer and implement it as soon as possible.

At MES Advocats, we offer a comprehensive service for the implementation of the internal information system, which includes a reporting channel, and complies with all obligations imposed by Law 2/2023. If you need more information or are interested in obtaining a quote, you can contact us through this link.

###


Internat reporting channel

---