The internal reporting channel duty in Italy

2023-03-30 (fifteenth day after publication in the Gazzetta Ufficiale of 15 March 2023). Its provisions took effect on 2023-07-15 under Art. 24(1).

Three independent triggers under Art. 2(1)(q), any one of which makes an entity a "soggetto del settore privato": (1) it employed, in the last year, an average of at least fifty employees on open-ended or fixed-term contracts; (2) REGARDLESS OF HEADCOUNT, it falls within the scope of the EU acts in Parts I.B and II of the Annex (financial services, products and markets, AML/CFT, transport safety, environmental protection); (3) REGARDLESS OF HEADCOUNT, it falls within the scope of Legislative Decree 231/2001 and has adopted an organisation and management model (Modello 231) under that decree. Trigger (3) is an Italy-specific extension with no equivalent in the Directive and catches many companies well below 50 employees.

2023-12-17. Art. 24(2): for private-sector entities that employed in the last year an average of UP TO 249 employees, the duty to set up the internal reporting channel took effect on 17 December 2023; until then the previous Art. 6(2-bis)(a)-(b) of Legislative Decree 231/2001 continued to apply. Private entities above 249 employees, and those caught by triggers (2) and (3) of the threshold, were bound from 15 July 2023.

Optional. The Decree does not require entities to accept or follow up anonymous reports. Art. 16(4) only preserves protection for an anonymous reporter who is subsequently identified and suffers retaliation. ANAC's guidance on the management of internal reporting channels (Delibera No. 478 of 26 November 2025; the earlier Delibera No. 311 of 12 July 2023, as amended by Delibera No. 479 of 26 November 2025, concerns the external channel) provides that handling anonymous reports through internal channels is a discretionary organisational choice which the entity must settle expressly in its own internal reporting procedure; where the entity does handle them, they are treated as ordinary reports.

Autorità Nazionale Anticorruzione (ANAC). It operates the external reporting channel (Art. 7), carries out the follow-up (Art. 8), handles retaliation complaints, and is the sole body empowered to impose the administrative fines under Art. 21.

The amounts and the triggers are verbatim correct (Art. 21(1)(a), (b), (c) and Art. 21(2)). But Art. 21(1) opens "l'ANAC applica AL RESPONSABILE le seguenti sanzioni amministrative pecuniarie", the statute names the responsible party as the addressee of the fine, not the entity. The addressee is contested in Italian practice.

Yes, expressly. Art. 4(2): management of the reporting channel is entrusted either to an internal person or dedicated autonomous office with specifically trained staff, "ovvero è affidata a un soggetto esterno, anch'esso autonomo e con personale specificamente formato". Art. 5 then places the full set of duties (acknowledgement within 7 days, dialogue with the reporter, diligent follow-up, feedback within 3 months, publishing channel information) on whoever manages the channel, including the external provider, so an operated channel can cover more than mere intake here.