The internal reporting channel duty in Czechia
Czechia transposed Directive (EU) 2019/1937 with Zákon č. 171/2023 Sb., o ochraně oznamovatelů (zákon ze dne 2. června 2023), vyhlášen ve Sbírce zákonů v částce 86/2023 dne 20. června 2023; doprovodný změnový zákon č. 172/2023 Sb. (Act No. 171/2023 Coll., on the Protection of Whistleblowers, of 2 June 2023, promulgated in the Collection of Laws, issue 86/2023, on 20 June 2023; accompanying amending Act No. 172/2023 Coll.). Below is what the national act itself says, with the sources, so your counsel can check every line.
2023-08-01 (§ 30: the first day of the second calendar month following promulgation)
§ 8(1)(b): an employer employing at least 50 employees as at 1 January of the relevant calendar year, UNLESS it is an obliged person under the AML Act. NO THRESHOLD for: public contracting authorities under the Public Procurement Act (§ 8(1)(a)), except municipalities with fewer than 10,000 inhabitants and certain non-industrial public-interest legal persons averaging fewer than 50 employees; public authorities administering corporate income tax or budget-discipline levies (§ 8(1)(c)); bodies and persons active in civil aviation, maritime transport under §§ 12i, 12o or 13d of the Maritime Navigation Act, and offshore oil and gas (§ 8(1)(d)); and a listed set of financial-sector employers (§ 8(1)(e)), certain capital-market persons under § 135(1) of the Capital Market Undertakings Act, persons under § 534(a)-(d) of the Investment Companies and Investment Funds Act, central counterparties and trade repositories under EMIR, tied agents authorised to intermediate consumer housing credit, insurance and reinsurance undertakings, insurance and reinsurance intermediaries, and Czech-seated occupational pension institutions. AML obliged persons are carved out of Act 171/2023 because § 21(6)(b) of Act No. 253/2008 Coll. (as amended by Act No. 172/2023 Coll. from 1 August 2023) separately requires them to operate an internal reporting system regardless of headcount, and that system must permit anonymous reporting.
2023-12-15, § 29: obliged entities other than public contracting authorities employing at least 50 and fewer than 250 employees on the date the Act took effect had to introduce the internal reporting system by 15 December 2023. Note this is TWO DAYS EARLIER than the directive's 17 December 2023. Employers with 250+ employees and public contracting authorities were bound from 1 August 2023.
Not required, and this is the most striking Czech deviation. The Act does not contain the word "anonymous" at all. § 2(2) defines a report as containing the reporter's name, surname and date of birth, or other data from which their identity can be inferred (unless the identity is already known to the competent person), so an anonymous submission is not a "report" within the Act. An obliged entity may voluntarily accept and handle anonymous reports. § 4(3): where a submission lacks identifying data, protection under the Act arises from the moment the reporter's identity becomes known to someone who can subject them to retaliation. Exception: AML obliged persons must permit anonymous reporting under § 21(6)(b) of Act No. 253/2008 Coll.
Ministerstvo spravedlnosti (Ministry of Justice), operates the external reporting system at oznamovatel.justice.cz and, under § 28, hears offences under the Act except those heard by the labour inspection bodies under the Labour Inspection Act. For AML breaches, external reports go instead to the Finanční analytický úřad (Financial Analytical Office) or the competent professional chamber under § 34a of Act No. 253/2008 Coll.
Failure to designate the competent person (§ 26(1)(b)) or failure to ensure the whistleblower can submit a report through the internal system (§ 26(1)(c)): fine up to CZK 1,000,000 (§ 26(3)), roughly EUR 40,000. Failure to publish the prescribed information in a way allowing remote access (§ 26(1)(d)): fine up to CZK 400,000 (§ 26(2)). Failure to comply with a remedial measure (§ 26(1)(j)): up to CZK 400,000. Obstruction is a separate offence: § 27(1), whoever prevents another from making a report commits an offence punishable by a fine up to CZK 100,000 (§ 27(6)). Retaliation: up to CZK 1,000,000 (§ 27(2) and (7)). These amounts are unchanged in the current consolidated version effective 15 February 2025.
It is express black-letter statute, not a commentator's reading, and it is stricter than described. § 21(6)(b) of Act No. 253/2008 Coll. reads: "vnitřní oznamovací systém podle zákona o ochraně oznamovatelů, který umožňuje anonymně podat oznámení...; vnitřní oznamovací systém nemůže být veden třetí osobou; vnitřní oznamovací systém může povinná osoba sdílet pouze s vázaným zástupcem podle § 2 odst. 4". So an AML obliged person (a) may not entrust operation of its internal reporting system to any third party at all, the § 8(2) freedom in Act 171/2023 does not reach it, because § 8(1)(b) and (e) carve AML obliged persons out of that Act, and (b) may share the system only with a tied agent under § 2(4) of the AML Act.
WEBSITE OBLIGATION, unusual and directly relevant to a public-facing product: § 9(2)(b) requires the obliged entity to publish, in a manner allowing remote access (in practice on its website), (1) the methods of reporting through the internal system and to the Ministry, (2) the identification of the competent person together with a telephone number and an email address or other delivery address, and (3) whether the entity excludes acceptance of reports from persons who do not perform work or similar activity for it. Failure to publish is expressly an offence (§ 26(1)(d)), so in Czechia absence of published channel information on the website is a verifiable breach. Scope narrowing: § 9(2)(a) lets the obliged entity exclude reports from persons who do not perform work or similar activity for it (e.g. suppliers' staff, shareholders, applicants), but only if it says so in the published information. Material scope is broader than the directive: § 2(1) covers conduct with the marks of a criminal offence, or of an administrative offence carrying an upper fine limit of at least CZK 100,000, or breaching the Act itself, in addition to the listed EU-law areas. Timelines: acknowledge within 7 days; notify the reporter of the assessment result within 30 days, extendable twice by 30 days, maximum 90 days.
One channel for a group that operates in more than one member state
A group with entities in Czechia and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.