WeMoral maps whistleblower law gaps across all 27 EU states

WeMoral has published a free 46-page report comparing how all 27 EU member states transposed the EU whistleblower directive, highlighting major differences in fines, record retention, anonymous reporting and penalties for false reports. The study shows compliance obligations can change sharply from one country to the next, even under the same EU framework.

Why it matters: - Companies operating across the EU face uneven whistleblowing rules, even though Directive 2019/1937 set a common baseline. - The report shows the compliance burden can vary by country on fines, recordkeeping, anonymous intake and enforcement. - WeMoral says the comparison is free, public and aimed at helping employers check national requirements against primary law.

What happened: - WeMoral published a 46-page comparison of whistleblower laws across all 27 EU member states. - The report covers 33 data points per country. - The study tracks how each state transposed Directive 2019/1937 into national law. - The directive gave member states until 17 December 2021 to adopt the rules. - The report is available free of charge and requires no registration. - The company also offers the report in English, Polish, Spanish, French and German. - A video walkthrough accompanies the English edition.

The details: - Maximum fines for failing to run a whistleblowing channel range from 1,000,000 EUR in Spain to zero in six member states. - Greece sets the second-highest maximum fine at 500,000 EUR. - Portugal and Ireland cap fines at 250,000 EUR. - Luxembourg also caps fines at 250,000 EUR, and the amount doubles on a repeat offence within five years. - Nineteen member states created no criminal offense connected to whistleblowing. - Eight member states provide for prison sentences. - Twenty member states passed a new dedicated act. - Six member states amended pre-existing legislation. - Belgium used a package of eight separate legal instruments. - Twelve member states named no compliance supervisor, leaving no authority tasked with checking whether internal reporting channels exist. - Seven member states created a dedicated body with power to issue fines. - Fifteen member states set a period for keeping report records. - Twelve member states set no retention period. - Spain allows retention for up to 10 years. - Cyprus requires deletion three months after a case closes. - Germany, Estonia, Poland and Slovakia each set a three-year retention period, but each starts the clock at a different point. - Twelve member states permit anonymous reports without forcing employers to accept them. - Spain and Portugal require intake of anonymous reports. - Belgium requires anonymous intake for employers with more than 250 workers. - Bulgaria, Latvia and Malta bar anonymous reports or leave them unprotected. - Denmark, Estonia and Sweden do not mention anonymous reports in their laws. - France addresses anonymous reporting only in the financial sector. - Twelve member states impose an administrative fine for knowingly false reports. - Nine member states handle knowingly false reports through criminal law. - Six member states impose no sanction beyond loss of protection. - Spain has the highest exposure for a knowingly false report, with a ceiling of 300,000 EUR. - Twenty-two member states kept the directive's three-month limit for feedback on an internal report. - Lithuania allows feedback within 10 working days and does not allow an extension. - WeMoral says the report uses only primary legislation from each member state. - The report contains 7 charts and 18 tables. - WeMoral says the analysis is not legal advice.

Between the lines: - The report suggests the EU whistleblowing framework is harmonized in principle but fragmented in practice. - Employers with operations in multiple countries may need separate compliance processes for each national regime. - The biggest divergences appear in enforcement, anonymous reporting and record retention, where member states used the directive's flexibility differently. - Giemza said a channel that works in one member state does not automatically satisfy the next one, and that many differences only appear after reading the national statute. - Giemza also said every figure in the report links back to the article it came from, allowing compliance teams to verify it against statute.

What's next: - WeMoral's report gives compliance teams a reference point for reviewing whistleblowing procedures across the EU. - The company positions the comparison as a tool for checking national law before rollout or expansion in multiple member states. - The report's multilingual editions and video walkthrough make the findings easier to use across regions and legal teams.

The bottom line: - EU whistleblower rules start from the same directive, but the national details still vary widely enough to create real compliance risk for cross-border employers.