The internal reporting channel duty in Luxembourg

2023-05-21 (four days after publication in the Mémorial A on 17 May 2023, the Luxembourg default rule; no derogating entry-into-force clause in the Law)

50 or more workers. Art. 6(2): private-law legal entities counting 50 workers or more, headcount computed under Articles L. 411-1 and L. 411-2 of the Labour Code, the 50-worker floor having to be reached over twelve consecutive months. Expressly "sans préjudice d'éventuels seuils moins élevés retenus dans des lois spéciales", so sectoral laws (notably financial services) can bite lower. Entities with fewer than 50 workers and municipalities under 10,000 inhabitants are exempt but may set up a channel voluntarily (Art. 6(5)). Where the sector-specific EU acts in Part II of the Directive's Annex regulate a point, those rules prevail (Art. 6(6)).

2023-12-17. Art. 28 (transitional provision): "L'établissement des canaux de signalement interne en vertu de l'article 6 devient obligatoire pour les entités du secteur privé comptant entre 50 et 249 travailleurs à partir du 17 décembre 2023." Entities with 250+ workers were bound from 21 May 2023.

Optional. The Law does not require entities to accept or follow up anonymous reports and is otherwise silent on the point. The only mention is Art. 4(2): a person who reported or publicly disclosed anonymously but is subsequently identified and suffers retaliation still enjoys the Law's protection, provided the Art. 4(1) conditions are met.

Two things are wrong. (1) A misdirected report is not routed to the Office: Art. 19(2) requires the receiving authority to transmit it confidentially to the competent authority. (2) The Office's fining power is not residual. Art. 18(3) gives the administrative fine to eleven of the twenty-two listed authorities (points 1°, 2°, 4°, 6°, 12°, 13°, 14°, 19°, 20°, 21°, 22°, CSSF, Commissariat aux assurances, AED, CNPD, the bars, notaries, Collège médical, and the professional orders). Art. 18(4) provides that where a report falls to the OTHER eleven authorities (points 3°, 5°, 7°, 8°, 9°, 10°, 11°, 15°, 16°, 17°, 18°, including the Autorité de la concurrence and the ITM), they pass it to the Office, which imposes the fine.

Administrative fine of €1,500 to €250,000 (Art. 18(5)), with the maximum doubled for a repeat offence within 5 years of the last final sanction. The band expressly covers FAILURE TO ESTABLISH internal reporting channels and procedures, Art. 18(3), point 5° and Art. 18(4), point 5°: persons "qui... n'établissent pas les canaux et les procédures pour le signalement interne et leur suivi". The same band covers obstructing or attempting to obstruct a report (point 1°), refusing or falsifying information requested by the authority (point 2°), breaching the whistleblower's confidentiality (point 3°) and refusing to remedy the established breach (point 4°). Separately, Art. 27(5) imposes a criminal fine of €1,250 to €25,000 on persons who retaliate or bring abusive proceedings against a whistleblower.

Yes, expressly. Art. 6(4): channels "peuvent être gérés en interne par une personne ou un service désigné à cet effet ou fournis en externe par un tiers". The safeguards and requirements of Art. 7(1) apply equally to third parties mandated to run the channel on behalf of a private-sector legal entity.