Whistleblowing channels in Spain: a compliance guide for foreign companies operating in Spain

Whistleblowing, the act of exposing illicit or unethical practices within an organisation, is a cornerstone of corporate governance. Spain, in line with European Union (EU) directives, has advanced policies and laws to protect whistleblowers and foster ethical business conduct.

EU Directive 2019/1937 mandated all EU member states to establish secure and confidential channels for whistleblowing. This directive marked a significant shift in European and Spanish law, providing extensive protections against retaliation and anonymity for whistleblowers. The directive was enacted into law in Spain by Ley 2/2023, effective 20 February 2023.

The law affects any company operating in Spain, even if its corporate domicile is not in Spain. This includes companies operating through commercial branches, agents, and even companies providing services without permanent establishment. Any such company with 50 or more employees must establish internal reporting channels such as hotlines or online systems for employees to report misconduct.

Reports can be internally filed and processed or, alternatively, a whistleblower can report the illegal conduct directly to an external authority like the Spanish Anti-Fraud Office or the CNMV (Spanish Securities Market Commission).

Furthermore, the law assures whistleblowers’ anonymity during investigations, only revealing their identity with their explicit consent. This offers a secure environment for employees to report concerns without fear of retaliation.

The Spanish legal framework condemns any retaliation against whistleblowers, including dismissal, demotion, or any form of disadvantage. In case of retaliation, whistleblowers have the right to seek restitution, and companies could face significant penalties.

The deadline for companies to establish these internal reporting channels was 13 June 2023 for companies with over 250 employees, and companies with between 50 and 249 employees must be compliant by 17 December 2023. Those failing to comply may be subject to fines ranging from EUR 600,000 to EUR 1 million.

In conclusion, foreign companies operating in Spain should have effective whistleblowing channels that comply with both Spanish and EU regulations. Such companies will thus illustrate their commitment to ethical business practices, and also protect their employees and the company itself from potential legal and financial risks.

Understanding and manoeuvring the Spanish whistleblowing landscape is vital for any foreign business with a Spanish subsidiary. Encouraging a transparent, compliant, and ethical work culture can foster trust, enhance employee morale, and mitigate potential risks.