The internal reporting channel duty in Cyprus

2022-02-04 (published in the Official Gazette of the Republic of Cyprus on 4 February 2022)

Private sector legal persons with fifty (50) or more employees (Art. 8(2)(a)(i)). The proviso to that subparagraph states expressly that this threshold does not apply to legal persons falling within the scope of the EU acts referred to in Part I, paragraph B and Part II of the Annex - financial services, products and markets, AML/CFT, transport safety, offshore oil and gas operations, environmental protection - which are covered regardless of headcount. All public sector legal persons are covered (Art. 8(2)(a)(ii)), except local authorities with fewer than 5,000 inhabitants or fewer than 25 employees.

17 December 2023. Art. 42: "Νομικό πρόσωπο του ιδιωτικού τομέα με πενήντα (50) έως διακόσιους σαράντα εννέα (249) εργαζομένους καθιερώνει τους δίαυλους και διαδικασίες για εσωτερική αναφορά, όπως προβλέπεται στο άρθρο 8 μέχρι τις 17 Δεκεμβρίου 2023" - a private sector legal person with 50 to 249 employees establishes the internal reporting channels and procedures under Art. 8 by 17 December 2023. Entities with 250+ employees were covered from 4 February 2022.

Not required to be accepted or followed up. Art. 2 defines "αναφορά" (report) as the provision of information, orally or in writing, "επωνύμως ή ανωνύμως" - named or anonymously - so an anonymous submission falls within the Law's concept of a report; but the Law imposes no duty on entities to accept, register or investigate anonymous reports. Protection presupposes an identified reporter: an anonymous reporter is protected only where they are subsequently identified and suffer retaliation (proviso to Art. 6(1) for Union law breaches, and to Art. 33(1) for national law breaches).

The domain reference is dead: mjpo.gov.cy does not resolve, and www.mjpo.gov.cy does not respond over HTTPS (Cyprus ministry content has moved under gov.cy). Remove the domain, or replace it with a link that actually resolves and that you have opened. The rest of the authority field (Art. 2 functional definition of "αρμόδια αρχή", Art. 12 duty on each competent authority to set up its own independent and autonomous external channel, designation by Council of Ministers decree) is confirmed correct against the consolidated Law.

There is no penalty in Law 6(I)/2022 for failing to establish an internal reporting channel. This is a genuine gap in the Cypriot regime, not an omission in this research: the Law's only offences are in Part IV. Art. 39(1) makes it a criminal offence for a natural person to obstruct or attempt to obstruct the submission of a report, to retaliate against a protected person, to initiate malicious proceedings against them, or to breach the duty of confidentiality as to the reporter's identity - punishable by imprisonment not exceeding three (3) years or a fine not exceeding EUR 30,000 or both. Art. 39(2) applies the same maximum to knowingly false reports or public disclosures. Art. 40(3): where a legal person is found guilty under Art. 40(1) or (2), it is liable to a fine not exceeding EUR 30,000. Failure to take remedial measures under Art. 20(3) is treated as an aggravating factor (Art. 40(4)).

Yes, expressly. Art. 8(4): the reporting channels "δύναται να αποτελούν αντικείμενο εσωτερικής διαχείρισης από πρόσωπο ή υπηρεσία που έχει ορισθεί για τον σκοπό αυτό ή να παρέχονται εξωτερικά από τρίτο πρόσωπο" - may be managed internally by a person or service designated for that purpose, or be provided externally by a third person. Art. 8(5) applies the safeguards and requirements of Art. 9(1) to entrusted third parties operating the channel on behalf of a private sector legal person. Cyprus is the most explicitly outsourcing-friendly of the six.