The internal reporting channel duty in France
France transposed Directive (EU) 2019/1937 with Add: as amended by Décret n° 2026-311 du 24 avril 2026 portant modification du décret n° 2022-1284 (JORF 24 April 2026), in force 1 July 2026. The 2022 wording is not the current consolidated text. (Law No. 2022-401 of 21 March 2022 to improve the protection of whistleblowers, amending Law No. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life ("Sapin II"). Implementing text: Decree No. 2022-1284 of 3 October 2022 on procedures for collecting and handling whistleblower reports and setting the list of external authorities. Supplemented by Organic Law No. 2022-400 of 21 March 2022 strengthening the role of the Defender of Rights in whistleblowing.). Below is what the national act itself says, with the sources, so your counsel can check every line.
2022-09-01 (Law No. 2022-401, first day of the sixth month after promulgation). Decree No. 2022-1284 in force 2022-10-05 (day after its publication, Art. 18).
The 50-employee duty is Art. 8, I, B, 3°. The pooling option is the closing sentence of Art. 8, I, B ("Les entités mentionnées au 3° du présent B employant moins de deux cent cinquante salariés peuvent mettre en commun leurs procédures"). Art. 8, II is the external-reporting paragraph, not the threshold.
No separate deadline, France did not use the Directive's 17 December 2023 derogation. The duty applied to every private entity with 50+ employees from 1 September 2022, and the procedure had to comply with Decree No. 2022-1284 from 5 October 2022. Neither the Law nor the Decree contains any provision deferring the obligation for 50-249 employee entities.
Optional. Neither the Law nor Decree No. 2022-1284 obliges an employer to accept or follow up anonymous reports. Art. 4 of the Decree only requires the internal procedure to state "les suites données aux signalements anonymes" (the follow-up given to anonymous reports), and exempts anonymous reports from the eligibility check ("sauf si le signalement est anonyme"). An anonymous whistleblower later identified retains the law's protection.
The annexe is no longer the October 2022 list. Décret n° 2026-311 du 24 avril 2026 replaced heading 2 of the annexe ("Services, produits et marchés financiers et prévention du blanchiment de capitaux et du financement du terrorisme") and added Tracfin alongside the AMF and the ACPR, with effect from 1 July 2026.
For obstructing a report: Art. 13, I of Law No. 2016-1691, "Toute personne qui fait obstacle, de quelque façon que ce soit, à la transmission d'un signalement... est punie d'un an d'emprisonnement et de 15 000 € d'amende" (one year's imprisonment and a €15,000 fine). Art. 13, II raises the civil fine to €60,000 for abusive or dilatory proceedings brought against a whistleblower. For failing TO ESTABLISH an internal reporting procedure: the Law and the Decree set no penalty for that specific failure, there is no fine and no administrative sanction attached to it. Exposure is indirect (works-council/employee litigation, and the separate Sapin II anti-corruption programme regime enforced by the AFA).
Yes. Art. 7, I of Decree No. 2022-1284: the channel may be operated on the entity's behalf externally by "un tiers, qui peut être une personne physique ou une entité de droit privé ou publique", subject to the same confidentiality, impartiality and competence requirements as an internal handler.
Buyer-relevant points: (1) Entities with fewer than 250 employees may pool their procedures (Art. 8, II of Law No. 2016-1691; Art. 7, II of Decree No. 2022-1284), pooling covers the reception channel and the assessment of allegations, but each entity keeps its own duties to preserve confidentiality, give feedback and remedy the breach. Group-level sharing is therefore possible but never transfers responsibility. (2) The internal procedure must be adopted after consulting the CSE (works council); it is not a unilateral IT decision. (3) Deadlines: written acknowledgement of receipt within 7 working days; feedback on measures within 3 months. (4) Material scope is wider than the Directive: crimes, offences, threats or harm to the general interest, breaches of international commitments and of French law, not only EU law. (5) No express statutory language requirement, but the procedure must be publicised by any means ensuring accessibility to staff, so a French-language interface is the practical requirement. (6) Internal reporting is not a precondition, a whistleblower may go straight to an external authority.
One channel for a group that operates in more than one member state
A group with entities in France and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.