The internal reporting channel duty in Hungary
Hungary transposed Directive (EU) 2019/1937 with 2023. évi XXV. törvény a panaszokról, a közérdekű bejelentésekről, valamint a visszaélések bejelentésével összefüggő szabályokról (kihirdetve: Magyar Közlöny 2023. évi 78. szám, 2023. május 25.), as amended (most recently by Act XXXIV of 2026, in force 29 July 2026) (Act XXV of 2023 on Complaints, Public Interest Disclosures and the Rules Relating to the Reporting of Abuses (promulgated in Magyar Közlöny No. 78 of 25 May 2023), as amended (Acts LIII of 2023, VII of 2024, LXXII of 2024, LVI of 2025 and XXXIV of 2026)). Below is what the national act itself says, with the sources, so your counsel can check every line.
2023-07-24 (§ 54: the 60th day after promulgation; promulgated 25 May 2023). It replaced Act CLXV of 2013.
§ 18(1): an employer engaging at least 50 persons under a relationship aimed at employment (foglalkoztatásra irányuló jogviszony), a broader concept than employment contracts. NO THRESHOLD, whatever the headcount, under § 18(2) for: (a) employers falling within § 1(1) and (1a) of Act LIII of 2017 on the prevention and combating of money laundering and terrorist financing; (b) employers registered in Hungary carrying on offshore oil and gas activity outside the borders of the European Union as licensee or operator; (c) employers falling within Regulation (EU) No 376/2014 on the reporting, analysis and follow-up of occurrences in civil aviation; (d) operators of Hungarian- and non-Hungarian-flagged vessels in service within the territory of Hungary; (e) employers falling within Regulation (EU) 2020/1503 on European crowdfunding service providers.
2023-12-17, § 56(1): employers within Subtitle 5 engaging at least 50 but at most 249 persons must comply from 17 December 2023. § 56(2): this postponement does not apply to the no-threshold entities under § 18(2), which were bound from 24 July 2023. Employers with 250 or more were also bound from 24 July 2023. Separately, § 57: the Subtitle 6 rules for local governments, their budgetary bodies and their companies apply only from 1 January 2025.
Optional, investigation may be declined. § 22(6)(a): the investigation of a report MAY be omitted where the report was made by an unidentifiable reporter ("azonosíthatatlan bejelentő"). Hungarian law therefore does not require an employer to accept or follow up anonymous reports; the choice sits with the operator of the system. The other grounds for omitting investigation are a report by a person outside the § 20(2)-(3) circle, a repeat report of identical content by the same reporter, and disproportionality between the public or compelling private interest and the restriction of the rights of the person concerned.
Compliance with the internal-system duty is checked by the foglalkoztatás-felügyeleti hatóság (employment supervision authority) under § 29(1). External reporting runs through eleven state bodies required by § 32(1) to operate a dedicated abuse reporting system (elkülönített visszaélés-bejelentési rendszer): Európai Támogatásokat Auditáló Főigazgatóság, Gazdasági Versenyhivatal, Integritás Hatóság, Közbeszerzési Hatóság, Magyar Energetikai és Közmű-szabályozási Hivatal, Magyar Nemzeti Bank, Nemzeti Adatvédelmi és Információszabadság Hatóság, Nemzeti Média- és Hírközlési Hatóság, Országos Atomenergia Hivatal, Szabályozott Tevékenységek Felügyeleti Hatósága and Nemzeti Vagyonvisszaszerzési és Vagyonvédelmi Hivatal; the Government has designated twelve further bodies by decree (§ 32(2); Government Decree 225/2023. (VI. 8.) Korm. rendelet, in force since 24 July 2023, point l inserted from 1 January 2025): Budapest Főváros Kormányhivatala, the central public-health authority, Nemzeti Élelmiszerlánc-biztonsági Hivatal, the central pharmaceutical authority, the national waste-management authority, Magyar Államkincstár, the national environmental protection authority, the minister responsible for transport, Nemzeti Adó- és Vámhivatal, Országos Rendőr-főkapitányság, the national nature-conservation authority and Nemzeti Kereskedelmi és Fogyasztóvédelmi Hatóság, so 23 dedicated external reporting bodies in total. The alapvető jogok biztosa (Commissioner for Fundamental Rights) operates the protected electronic system for public-interest disclosures and is the aggregating reporting contact point towards the European Commission (§ 38).
THERE IS NO FINE FOR THIS SPECIFIC FAILURE, and that is expressly stated. § 29(1) makes the employment supervision authority responsible for checking compliance with the Subtitle 5 duties, and § 29(2) applies Act CXXXV of 2020 on employment-promoting services and employment supervision "with the difference that a fine (bírság) and prohibition from carrying on the activity may not be applied". The practical sanction is a warning or an order to remedy. Obstruction is punished separately and by a different route: § 206/A(2) of Act II of 2012 on administrative offences makes it a szabálysértés to obstruct or attempt to obstruct the making of a report under Act XXV of 2023, and § 206/A(1) makes retaliation against a reporter a szabálysértés; the general administrative-offence fine range under § 11(1) of Act II of 2012 is HUF 6,500 to HUF 200,000. Note that a szabálysértés in Hungary is committed by a natural person, so this liability falls on individuals, not on the company.
Yes, fully. § 19(1): the internal system may be operated by a designated impartial person or organisational unit at the employer. § 19(2): operation of the system may instead be entrusted under contract to a bejelentővédelmi ügyvéd (whistleblower protection lawyer) or another external organisation; where an external organisation is engaged, the conflict-of-interest rules applicable to the whistleblower protection lawyer and the impartiality rules of § 19(1) apply to it. § 22(4): an external lawyer or organisation may also be engaged under contract to assist in investigating reports. Hungary is for a vendor selling an operated channel.
Joint systems: § 18(3), employers engaging at least 50 but at most 249 persons may establish the internal system jointly, or with another employer entitled to do so; the same applies to § 18(2) no-threshold employers engaging at most 249. § 18(4) allows any employer to set up a system voluntarily. Timelines (§ 22): acknowledge a written report within 7 days of receipt, together with general information on the procedural and data-handling rules; investigate as soon as circumstances allow and at most within 30 days from receipt; extendable in particularly justified cases with prior notice to the reporter of the expected date and reasons, but the total for investigation and § 24 feedback may never exceed 3 months. Oral reports must be recorded in a durable, retrievable form or minuted with a copy given to the reporter for checking, correction and signature (§ 21). Reporter circle (§ 20(2)-(3)) is wide and includes former employees, job applicants, sole traders and individual firms in a contractual relationship, owners, members of management and supervisory bodies including non-executive members, staff under the supervision of contractors, subcontractors and suppliers, trainees and volunteers. § 27 requires the system to be built so that the personal data of an identity-disclosing reporter and of the person concerned are inaccessible to anyone but those entitled. § 28 permits reporting breaches of employer codes of conduct adopted under § 9(2) of the Labour Code through the same system.
One channel for a group that operates in more than one member state
A group with entities in Hungary and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.