The internal reporting channel duty in Finland
Finland transposed Directive (EU) 2019/1937 with Laki Euroopan unionin ja kansallisen oikeuden rikkomisesta ilmoittavien henkilöiden suojelusta 20.12.2022/1171 (ilmoittajansuojelulaki) (Act on the Protection of Persons Reporting Breaches of European Union and National Law (1171/2022), the Finnish Whistleblower Protection Act). Below is what the national act itself says, with the sources, so your counsel can check every line.
2023-01-01
Organisations regularly employing at least 50 persons in an employment or public-service relationship, 10 § 1 mom.: "Seuraavien organisaatioiden, joihin työ- tai virkasuhteessa olevien henkilöiden määrä on säännöllisesti vähintään 50, on perustettava sisäinen ilmoituskanava…" (six listed categories of public and private organisations). No threshold at all for supplementary pension institutions (lisäeläkelaitos) and for pension foundations/funds with a voluntary supplementary pension department, they must have an internal channel irrespective of headcount (10 § 3 mom.). Sector-specific acts (financial sector, AML) impose channel duties independently of size.
17 December 2023 for organisations under 10 § 1 mom. points 5 and 6 (the private-sector categories) with regularly no more than 249 employees. All other covered organisations had to have the channel in place within three months of entry into force, i.e. by 1 April 2023. Voluntary internal channels already operated by organisations with fewer than 50 employees also had to meet the Act's requirements by 17 December 2023.
Optional for internal channels, and expressly excluded from the central external channel. 17 § (Nimetön ilmoittaminen): "Organisaatio voi päättää ottaa sisäisessä ilmoituskanavassa vastaan myös nimettömiä ilmoituksia", and for anonymous reports there is no duty to send an acknowledgement of receipt or to take the follow-up steps in 16 § 2 mom. 19 §: "Keskitetyssä ilmoituskanavassa ei oteta vastaan nimettömiä ilmoituksia", the Chancellor of Justice's central channel does not accept anonymous reports.
Oikeuskanslerinvirasto (Office of the Chancellor of Justice) hosts the centralised external reporting channel (18 §) and forwards reports to the sectoral competent authorities ("toimivaltaiset viranomaiset"), which handle the substance. No authority is given power to supervise or enforce the internal-channel duty.
None for failing to establish an internal channel, the Act sets no penalty, administrative fine or supervisory sanction for breaching the 10 § duty. The only criminal provision, 36 § (Rangaistussäännökset), covers two things: a reporting person who intentionally reports or discloses false information is sentenced to a fine (sakko) unless the act is minor or more severely punishable elsewhere; and breach of the confidentiality duty in 32 § is punished under Chapter 38, section 1 or 2 of the Criminal Code. Retaliation or obstruction of reporting instead gives the individual a right to compensation (hyvitys, 34 §), set by the district court in proportion to the seriousness of the act, with no statutory cap, and claimable within three years.
Yes, expressly. 11 § (Sisäisen ilmoituskanavan ulkoistaminen): "Organisaatio voi antaa sisäisen ilmoituskanavan järjestämisen ulkopuolisen palveluntuottajan tehtäväksi." The organisation remains responsible for compliance with the Act even when it has outsourced. For public-sector organisations under 10 § 1 mom. points 1, 3, the provider's staff performing the outsourced tasks are subject to the rules on criminal liability in office.
Organisations under 10 § 1 mom. points 5 and 6 with no more than 249 employees may share resources for receiving reports, verifying them and conducting investigations (12 §), while each organisation stays responsible for its own duties. A named person or persons must be designated to handle reports, able to act impartially and independently (14 §). Acknowledgement of receipt within 7 days; information on measures within 3 months of the acknowledgement. Reports must be registered and personal meetings minuted, with the reporter given the chance to check and approve the minutes (37 §). Voluntary internal channels in organisations below the threshold are fully covered by the Act (13 §). The Act has been amended (e.g. by 181/2025, in force 20 May 2025).
One channel for a group that operates in more than one member state
A group with entities in Finland and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.