Whistleblowing channel in Spain: what Law 2/2023 requires and how to comply in 2026

Since December 2023, every company in Spain with fifty or more employees has had to run a whistleblowing channel. For two years many solved it with an email inbox and a policy on the intranet, because nobody checked. That changed in 2026: the Independent Whistleblower Protection Authority is now operational, takes notice of each channel’s officer through its e-office and can impose fines of up to one million euros.

This article explains exactly what Law 2/2023 requires, which companies it applies to, which deadlines run once a report arrives, what a company risks without a channel and how to set one up without turning it into a project. With the article of the law behind every statement.

In short. The obligation applies to companies with 50 or more employees and, whatever their size, to those in sectors such as financial services or anti-money laundering. The channel must accept anonymous reports, acknowledge receipt within 7 calendar days and answer within 3 months (extendable to 6 in complex cases). The company appoints a System Officer and notifies the Authority within 10 working days. Not having a channel is a very serious infringement: €600,001 to €1,000,000 for the company.

---

What a whistleblowing channel is

A whistleblowing channel (the law calls it an internal reporting channel) is the route through which anybody connected to a company can report an irregularity they came across at work, with the guarantee that their identity stays confidential and that they will suffer no retaliation for it.

Law 2/2023 of 20 February, which transposes the EU Whistleblowing Directive 2019/1937 into Spanish law, does not ask for an inbox. It asks for a complete internal reporting system with four parts:

• The channel, through which reports arrive in writing, orally or both (article 7).
• The System Officer, an individual appointed by the board who runs the system independently (article 8).
• The handling procedure, approved by the same board, with its deadlines and guarantees (article 9).
• The register of the reports received and the investigations they led to (article 26).

An email address read by the HR department covers half of the first part and none of the other three.

---

Which companies must have a whistleblowing channel

Article 10 of the law sets out three cases in the private sector:

Who	Since when	Legal basis
Companies with 50 or more employees	13 June 2023 for those with more than 249; 1 December 2023 for those with 50 to 249	Art. 10.1.a and second transitional provision
Companies in financial services, anti-money laundering, transport safety and the environment, with any number of employees	From entry into force, under their specific rules	Art. 10.1.b
Political parties, trade unions, business organisations and their foundations, if they receive or manage public funds	From entry into force	Art. 10.1.c

The law refers to employees under contract, so headcount is counted in people, not full-time equivalents. A company with 30 full-time and 25 part-time staff has 55 employees under contract.

Below 50 it is not mandatory, but it is advisable, and the law allows for it: a company that is not obliged can set up its own system provided it meets the same requirements (article 10.2). The practical reason is simple: what is reported inside can be fixed before it reaches the labour inspectorate, a court or the press.

---

What can be reported through the channel

The law protects reports about (article 2):

• Breaches of EU law in areas such as public procurement, financial services, money laundering, product and transport safety, the environment, public health, data protection or competition.
• Criminal offences and serious or very serious administrative infringements, in every case those causing a financial loss to the tax authority or social security.
• Breaches of employment law on health and safety at work.

In practice, what reaches an internal channel is very recognisable: workplace or sexual harassment, discrimination, fraud or corruption, safety risks, breaches of working hours or pay, misuse of personal data, conflicts of interest or retaliation against somebody who reported before.

A company can open the channel to other complaints too, for example about a team’s climate, but those reports fall outside the law’s special protection (article 7.4).

---

The requirements the channel must meet

These are the minimums the law sets. If one is missing, the company does not have an internal reporting system on the terms required, which is exactly what article 63 penalises.

1. Open to every protected person: staff, self-employed people working for the company, shareholders, board members, contractors’ and suppliers’ staff, volunteers, interns, candidates and former employees (article 3).
2. In writing or orally and, if the person asks, in a face-to-face meeting within seven days at most (article 7.2).
3. With an anonymous option: internal channels must accept and process anonymous reports (article 7.3).
4. Confidential and secure, with no unauthorised access to the identity of the reporter or of third parties mentioned (article 5.2.b). Access to the data is limited to the System Officer and a few listed roles (article 32.1).
5. With information on external channels: the reporter must know they can also go to the Authority or to the competent regional authority (articles 7.2 and 9.2.b).
6. Set up after consulting the workers’ legal representatives (article 5.1).
7. With a policy and a procedure approved by the board. The Authority recommends keeping them as separate documents and making the policy easy to find (Recommendation 1/2026).

Running the channel can be outsourced to a third party that guarantees independence, confidentiality and data protection (article 6). What cannot be outsourced is the responsibility: the System Officer still belongs to the company.

---

Deadlines: acknowledgement, investigation and answer

Once a report arrives, deadlines start running that leave no room for interpretation:

What	Deadline	Legal basis
Acknowledgement to the reporter	7 calendar days from receipt	Art. 9.2.c
Face-to-face meeting, if requested	7 days at most	Art. 7.2
Answer on the investigation	3 months from receipt (or from when the acknowledgement fell due, if none was sent), extendable by another 3 in especially complex cases	Art. 9.2.d
Deletion of the data if no investigation is opened	3 months after receipt	Art. 32.4
Retention in the register	As long as necessary and proportionate, never more than 10 years	Art. 26.2
Notice of the appointment or removal of the System Officer	10 working days	Art. 8.3

If the facts could amount to a crime, the information goes to the public prosecutor straight away (article 9.2.j). And the person named in the report has the right to be told what they are accused of and to be heard, without ever learning who reported it.

---

The System Officer and the Authority

The board appoints an individual as System Officer. In the private sector it must be a manager of the company who holds the post independently, without taking instructions and with the resources needed (article 8). If a committee is chosen instead, it delegates the running of the system to one of its members.

The appointment and the removal are notified to the Independent Whistleblower Protection Authority (or to the competent regional authority) within ten working days. In practice this now has a date and a form:

• The Authority has been fully operational since September 2025.
• In January 2026 it published its Recommendation 1/2026 on what an internal reporting system should look like.
• Since 9 February 2026 its e-office accepts the notice of the System Officer, with the document proving the appointment. Companies that already had a channel were given two months, until 10 April, to file it.
• Since 22 September 2026 the e-office lives at a new address, proteccioninformante.sede.gob.es, and the old one keeps working during the transition.

With the officer on file, the Authority knows which companies have a channel and which do not. That is why 2026 is the year in which not having one stops going unnoticed.

---

Anonymity, confidentiality and protection from retaliation

These are two different guarantees that are often confused. Confidentiality protects somebody who reports under their name: the company knows who they are, but only the System Officer and whoever handles the case may know it. Anonymity goes further: the company does not know who they are, and the channel must let the report be followed and the reporter be talked to without breaking it.

The law forbids any retaliation against a good-faith reporter, including threats and attempts (article 36): dismissal, not renewing a temporary contract, demotion, substantial changes to working conditions, negative appraisals, blacklisting or reputational harm.

And it reverses the burden of proof: if the reporter reasonably shows that they reported and suffered harm, it is presumed to be retaliation, and the company has to prove the measure had justified reasons unrelated to the report (article 38.4).

---

Fines for not having a whistleblowing channel

The law grades infringements and sets the fines in article 65:

Infringement	Company (legal person)	Individual
Minor	Up to €100,000	€1,001 to €10,000
Serious	€100,001 to €600,000	€10,001 to €30,000
Very serious	€600,001 to €1,000,000	€30,001 to €300,000

These, among others, are very serious (article 63.1):

• Not having an internal reporting system on the terms the law requires.
• Taking retaliation against a reporter.
• Revealing or trying to reveal the identity of somebody who chose anonymity, even if it does not succeed.
• Obstructing reports or preventing, frustrating or slowing down their follow-up.

On top of the fine, for very serious infringements the Authority can order a public reprimand, a ban on subsidies or tax benefits for four years and a ban on public contracts for three. Fines of €600,001 or more on companies may be published in the Official State Gazette.

---

The most common mistakes

1. An email address as the channel. An inbox is not anonymous, the wrong person can read it, it does not flag deadlines and it keeps no register. It is the most common way of believing you comply without complying.

2. An officer who is not independent. If whoever runs the channel is routinely part of the conflicts that reach it, the independence article 8 asks for does not exist.

3. Reports reaching the team manager. Somebody reporting something in their department does not want their boss to read it. A channel where line managers see their team’s reports discourages exactly the reports the law wants to protect.

4. Deadlines nobody watches. Seven days to acknowledge receipt slip by if nobody sees them running. And a late acknowledgement is a breach even when the investigation is flawless.

5. Keeping everything forever. What is not investigated is deleted after three months, and the register cannot keep data for more than ten years.

6. A hidden channel. If staff do not know it exists or cannot find it, it does not do its job. The Authority insists that the policy be easy to find and well publicised.

---

How to comply, step by step

1. Consult the workers’ legal representatives before setting it up.
2. Approve the policy and the procedure at board level, as separate documents.
3. Appoint the System Officer and notify the Authority through its e-office within ten working days, with the appointment document.
4. Launch the channel: with an anonymous option, a follow-up code, a conversation with the reporter and the external channels in plain sight.
5. Make it known: on the website, in every new starter’s induction and somewhere anybody can find without asking.
6. Keep the register of every report, with its dates, its stages and how it was closed.
7. Track the deadlines for acknowledgement and answer on every case, and delete what is not investigated.

---

How Quantummycos solves it

In Quantummycos the whistleblowing channel is one more module of the same app where staff clock in and request their holidays, so there is nobody to register and nothing to explain: everybody has it in their menu and in the mobile app.

• Truly anonymous, if they wish. With the anonymous option no name, user or submission time is stored, and the report leaves no trace in the activity log. The reporter gets a follow-up code shown only once: the company keeps only a fingerprint that cannot be turned back into the code.
• Follow-up and conversation without revealing anybody. With the code the reporter sees which stage the report is at, reads the answer and talks to whoever handles it. The handler appears as the channel’s management, never by name.
• The legal deadlines, in view. Every case shows when the acknowledgement and the answer fall due, the deadline can be extended once in complex cases and the list filters what is overdue.
• A case file for every report. Case number, date received, each stage with its date, internal notes only the channel’s managers see, and how it was closed: facts not proven, measures taken or referred to the public prosecutor. It is the basis of the register.
• Only whoever runs it can see it. Reports are seen by the company’s administrators. A department manager does not see their team’s, not even the named ones, and the app’s AI assistant does not read them.
• The external channel, always at hand, with the link to the Authority’s channel, as the law requires.

What no tool can do for the company is just as clear: appoint the System Officer, approve the policy and the procedure, consult the workers’ representatives and notify the Authority. The module is the channel where all of that is then applied.

The whistleblowing channel is part of the Enterprise plan. You can see how the module works or open the app and try it with your team.

---

Keep reading

• 10 key features in HR software in Spain, where the whistleblowing channel is one of the obligations worth having solved.
• How to spot HR bottlenecks in a growing company, because several new obligations arrive together at 50 people.
• Employee onboarding and offboarding in Spain 2026, the best moment to tell every new starter the channel exists.
• Whistleblowing channel, in the HR dictionary, the definition in one sentence.

Sources

• Law 2/2023 of 20 February on the protection of persons who report regulatory breaches and on the fight against corruption (BOE), articles 2, 3, 5 to 10, 26, 32, 36, 38, 63 and 65.
• Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law (EUR-Lex).
• Independent Whistleblower Protection Authority, its Recommendation 1/2026 on internal reporting systems and the form to notify the System Officer.
• Resolution of 9 September 2026 changing the address of the Authority’s e-office (BOE).

This article is for information only and is not legal advice. The law and the Authority’s guidance evolve: always check the consolidated text in force in the BOE and speak to your adviser. Last reviewed: September 2026.