The internal reporting channel duty in Netherlands
Netherlands transposed Directive (EU) 2019/1937 with Wet bescherming klokkenluiders, formally the Wet van 14 april 2016, houdende de oprichting van een Huis voor klokkenluiders (Wet Huis voor klokkenluiders), renamed and rewritten by the Wet van 25 januari 2023 tot wijziging van de Wet Huis voor klokkenluiders en enige andere wetten ter implementatie van Richtlijn (EU) 2019/1937 van het Europees Parlement en de Raad van 23 oktober 2019 (PbEU 2019, L 305) en enige andere wijzigingen, Stb. 2023, 29 (published 3 February 2023). (Whistleblower Protection Act (Wet bescherming klokkenluiders), as amended by the implementing Act of 25 January 2023, Stb. 2023, 29). Below is what the national act itself says, with the sources, so your counsel can check every line.
2023-02-18, but only partially. The Royal Decree Stb. 2023, 52 brought most provisions into force on 18 February 2023 and deliberately excluded article 2(2)(e) and (f), article 3a(3)(e) and article 17i, which are still not in force.
At least 50 employees as a rule. Article 2(1): „De werkgever bij wie in de regel ten minste vijftig werknemers werkzaam zijn, stelt voor hen een procedure vast voor het melden van een vermoeden van een misstand binnen zijn organisatie.“ Article 2(3) disapplies the 50-employee threshold for employers falling within the scope of the Union acts named in Parts I.B and II of the Annex to the Directive. The government's official portal lists these as financial services, products and markets; prevention of money laundering and terrorist financing; civil aviation; maritime labour; port state control; and offshore oil and gas activities, those employers need a procedure regardless of headcount.
17 December 2023. The transitional provision in the Act states that article 2 as it read before the entry into force of the Act of 25 January 2023 remained applicable to private-sector employers with 50 to 249 employees until 17 December 2023, so the new-style internal reporting procedure only became compulsory for that band on that date.
Not required. The two provisions that would have regulated anonymous reporting, article 2(2)(e) and (f), were deliberately excluded from entry into force by the Royal Decree Stb. 2023, 52, because further rules by or under an algemene maatregel van bestuur are needed first. In the consolidated statute both subsections still read „[Red: dit onderdeel is nog niet in werking getreden]“. So as at September 2026 Dutch employers may accept anonymous reports but are under no statutory duty to accept or follow them up.
The competent authorities are set out in article 2c Wbk: the Autoriteit Consument en Markt, the Autoriteit Financiële Markten, the Autoriteit persoonsgegevens, De Nederlandsche Bank N.V., het Huis, the Inspectie gezondheidszorg en jeugd, the Nederlandse Zorgautoriteit, the Autoriteit Nucleaire Veiligheid en Stralingsbescherming, plus bodies designated by algemene maatregel van bestuur or ministerial regulation under art. 2c sub 9°. The NVWA was designated under that ninth limb in April 2024. Add the Nederlandse Zorgautoriteit and the ANVS; drop ILT unless separately confirmed.
There is currently no penalty in force for failing to establish an internal reporting procedure. Article 17i, which would give the Huis voor Klokkenluiders supervisory and sanctioning powers, was excluded from entry into force by Stb. 2023, 52 and remains not in force. The Huis voor Klokkenluiders states it expects to receive supervisory and sanctioning powers from end 2026 or early 2027, once the minister's bill and the implementing decree setting fine levels are complete; the intended grounds include failing to have a required internal reporting channel at 50+ employees, disadvantaging a reporter, and failing to protect a reporter's identity. Until then enforcement is civil and employment law only (nullity of detrimental measures, reinstatement and damages claims), with no administrative fine. Do not publish a euro figure for the Netherlands.
Not expressly regulated in the statute, but in practice permitted. Article 2(2)(d) requires the procedure to record which designated independent officer or officers („daartoe aangewezen onafhankelijke functionaris“) can receive reports and give them careful follow-up; the law does not require that person to be an employee, and does not prohibit an external provider. Article 8(5) of the Directive expressly permits third-party operation. Treat as allowed, but note the Dutch statute is silent rather than explicit, worth a lawyer's sign-off before making an unqualified claim on a public page.
Resource sharing: article 2(4) allows private-sector employers with 50 to 249 employees, and municipalities/public bodies under the Wet gemeenschappelijke regelingen, to share resources for receiving reports and carrying out investigations. Channels must allow reports in writing, orally by telephone or other voice messaging systems, and on request by an in-person meeting at a location within a reasonable time (article 2(2)(c)). Acknowledgement of receipt within 7 days and substantive feedback within a reasonable period of at most 3 months (article 2(2)(h)-(i)). The employer must make information about the procedure and about external reporting available to workers in writing or electronically. The Netherlands is the weakest on enforcement today, and that is changing: the sanctioning regime is expected to switch on around end 2026/early 2027, and a statutory evaluation of the Act is running in 2026. That pending switch-on is the honest commercial hook, not a current fine.
One channel for a group that operates in more than one member state
A group with entities in Netherlands and elsewhere in the EU does not get one law, it gets one per country: different rules on anonymous reports, different authorities, different deadlines and penalties. We set the channel up once and configure it per entity against each national act, from the same verified reference you are reading.