The internal reporting channel duty in Germany

2023-07-02 (section 41 entered into force earlier, on 3 June 2023)

At least 50 employees as a rule. Section 12(2): „Die Pflicht nach Absatz 1 Satz 1 gilt nur für Beschäftigungsgeber mit jeweils in der Regel mindestens 50 Beschäftigten.“ Section 12(3) removes the threshold entirely for nine categories of financial-sector entities, which must have a channel regardless of headcount: investment services firms and data reporting service providers (WpHG), stock exchange operators (BörsG), CRR institutions and investment institutions (KWG, WpIG), SFTR counterparties, capital management companies (KAGB), insurance undertakings (VAG), crypto-markets institutions (KMAG) and payment institutions (ZAG).

17 December 2023. Section 42(1): private employers with as a rule 50 to 249 employees only had to set up their internal reporting offices from 17 December 2023; this deferral expressly did not apply to the section 12(3) financial-sector entities. Separately, section 42(2) provides that the fine provision for failing to set up a channel (section 40(2) no. 2) applies only from 1 December 2023.

Optional. Section 16(1) sentences 4 and 5: „Die interne Meldestelle sollte auch anonym eingehende Meldungen bearbeiten. Es besteht allerdings keine Verpflichtung, die Meldekanäle so zu gestalten, dass sie die Abgabe anonymer Meldungen ermöglichen.“ So the internal reporting office SHOULD process anonymous reports that reach it, but there is no obligation to design the channel so that anonymous submission is possible. The wording is a 'sollte' (should), not a binding duty, and no fine attaches to it.

Externe Meldestelle des Bundes at the Bundesamt für Justiz (section 19), organisationally separated from the rest of the BfJ. Sector external channels: BaFin (section 21) and Bundeskartellamt (section 22). The Länder may set up their own external reporting offices for their public sector.

Failure to establish and operate an internal reporting office is an administrative offence: section 40(2) no. 2 (breach of section 12(1) sentence 1), punishable under section 40(6) with a fine of up to EUR 20,000. Note it only became enforceable on 1 December 2023 (section 42(2)). By comparison, obstructing a report or the related communication (section 7(2)) and taking reprisals (section 36(1)) carry up to EUR 50,000, and for those offences section 30(2) sentence 3 OWiG applies, which raises the maximum for legal persons tenfold (to EUR 500,000), that multiplier expressly does not apply to the section 12 failure. Intentional or reckless breach of confidentiality: up to EUR 50,000; negligent: up to EUR 10,000.

Yes, expressly. Section 14(1): an internal reporting office may be set up by entrusting an employee, a unit of several employees, or a third party („ein Dritter“) with its tasks. Entrusting a third party does not relieve the employer of its own duty to take suitable measures to stop a violation.