Whistleblower Laws by Country
Global Standards for Transparency and Protection
Laws and Legislation
Whistleblower legislation has become a cornerstone of corporate governance, ethical conduct, and regulatory compliance. From financial fraud and corruption to workplace misconduct, laws protecting whistleblowers help organizations prevent wrongdoing and maintain trust with employees, stakeholders, and the public. While every country has unique requirements, the trend is clear: governments are tightening regulations, expanding protections, and enforcing compliance more aggressively than ever. Organizations operating across borders must adopt global strategies to remain compliant and build a culture of integrity.
Explore how laws differ across jurisdictions. Our country-by-country database provides up-to-date details on:
-
Scope of Protection: Who is covered under the law
-
Reporting Requirements: Internal vs. external channels
-
Retaliation Protections: What safeguards exist
-
Penalties for Non-Compliance
Global WBS Mapping
This is a practical, high-level map of whistleblowing/“WBS” (whistleblowing system) requirements around the world. We’ve grouped countries by what’s mandated, what’s sectoral or partial, what’s proposed / pending, and where there’s no general mandate.
Legend
Mandated = broad, legal obligation on most employers (often ≥50 employees) to run internal reporting channels.
Sectoral / Partial = required only for listed firms or regulated sectors, or limited to public bodies.
Proposed / Pending = formal bill or government process signals likely change.
No general mandate = no broad employer requirement in force (there may still be protections or sector rules).
| Country / Region | Status | Who must have a WBS | Core legal basis / notes |
|---|---|---|---|
| EU Member States (27) | Mandated | Private & public entities with ≥50 employees; many municipalities (≥10k) | EU Whistleblower Directive 2019/1937 requires internal channels; national transpositions now in force across the bloc. |
| Poland | Mandated (new) | Employers with ≥50 workers and certain sectors regardless of size | Whistleblower Protection Act (14 Jun 2024), in force 25 Sep 2024; requires internal systems. |
| Germany | Mandated | Employers with ≥50 employees | Hinweisgeberschutzgesetz (HinSchG), in force 2 Jul 2023; internal reporting office required, fines for breaches. |
| Ireland | Mandated | Employers with ≥50 employees | Protected Disclosures (Amendment) Act 2022; statutory guidance confirms internal channels duty. |
| France | Mandated | Generally ≥50 employees (public & private) | Sapin II as amended by the “Waserman” law strengthened internal channel obligations. |
| Italy | Mandated | ≥50 employees and 231-model entities | Legislative Decree 24/2023 (EU transposition) requires internal channels. |
| Spain | Mandated | ≥50 employees (and certain entities) | Law 2/2023 on whistleblowing systems and protection. |
| Netherlands | Mandated | ≥50 employees | Wet bescherming klokkenluiders (2023) updates obligations for internal channels. |
| Denmark | Mandated | ≥50 employees (public & private) | Whistleblower Protection Act implementing the EU Directive. |
| Luxembourg | Mandated | ≥50 employees; local authorities ≥10k | Law of 16 May 2023; staged deadlines for 50–249 headcount. |
| Sweden | Mandated | ≥50 employees | 2021:890 Act implementing EU Directive (internal channels). |
| Norway (EEA) | Mandated | ≥5 employees must have written procedures | Working Environment Act Ch. 2A: duty to establish internal whistleblowing routines. |
| Japan | Mandated / size-based | ≥300 employees must set up a system & a manager; smaller firms have “best-efforts” duties | 2020 amendments to the Whistleblower Protection Act, effective 2022, plus CAA guidelines. |
| United States | Sectoral / partial | Listed companies must have confidential audit-committee procedures; multiple agency programs (SEC/CFTC/IRS, etc.) | SOX §301/Rule 10A-3 (audit-committee procedures) + Dodd-Frank SEC whistleblower program; no general employer-wide WBS mandate. |
| United Kingdom | Sectoral / partial; reform signalled | FCA/PRA-regulated firms have whistleblowing rules; no universal mandate across employers | PIDA framework; FCA SYSC 18; Govt review published 2025; Office of the Whistleblower Bill introduced by an MP (private member’s bill). |
| Singapore | Sectoral / listed | SGX-listed issuers must maintain a whistleblowing policy; MAS guidance for FIs | SGX Listing framework (from 2022) hard-codes policy disclosure; MAS IAC Guidelines for financial institutions. |
| Hong Kong (SAR) | Sectoral / listed | HKEX-listed issuers must maintain a whistleblowing policy & system | Corporate Governance Code changes effective 1 Jan 2022 require a policy/system for issuers. |
| Canada | Sectoral / partial | Federally regulated FIs (FRFIs) and banks must have whistleblowing procedures; federal public sector has its own regime | FCAC whistleblowing guideline under the Bank Act; OSFI Integrity & Security expectations. |
| Australia | Partial; reform pending | Public companies, large proprietary companies, and superannuation trustees must have a whistleblower policy (not a universal WBS mandate). A federal Whistleblower Protection Authority bill is before a Senate committee (2025). | Corporations Act + ASIC RG 270 on policies; WPA Bill 2025 (No. 2) under inquiry; strong civil-society backing. (ASIC, Parliament of Australia, The Australia Institute) |
| New Zealand | Public-sector mandate | Public sector must have procedures; private sector encouraged but not mandated | Protected Disclosures (Protection of Whistleblowers) Act 2022; govt guidance for agencies. |
| Brazil | Partial (procurement / integrity) | Companies bidding/contracting with federal government above thresholds need integrity programs incl. reporting channels | Decree 11,129/2022 (Clean Company Act regulations) links hotlines to integrity programs in public procurement. |
| UAE (DIFC/ADGM free zones) | Sectoral | Regulated financial firms must maintain whistleblowing arrangements | DFSA/FSRA rulebooks and guidance require internal channels for regulated entities. |
| Switzerland | No general mandate | No broad employer obligation; reforms stalled | Parliament rejected comprehensive federal whistleblowing bill; status remains fragmented. |
EU Member States (27)
Status: Mandated
Who must have a WBS: Private & public entities with ≥50 employees; many municipalities (≥10k)
Core legal basis / notes: EU Whistleblower Directive 2019/1937 requires internal channels; national transpositions now in force across the bloc.
Poland
Status: Mandated (new)
Who must have a WBS: Employers with ≥50 workers and certain sectors regardless of size
Core legal basis / notes: Whistleblower Protection Act (14 Jun 2024), in force 25 Sep 2024; requires internal systems.
Germany
Status: Mandated
Who must have a WBS: Employers with ≥50 employees
Core legal basis / notes: Hinweisgeberschutzgesetz (HinSchG), in force 2 Jul 2023; internal reporting office required, fines for breaches.
Ireland
Status: Mandated
Who must have a WBS: Employers with ≥50 employees
Core legal basis / notes: Protected Disclosures (Amendment) Act 2022; statutory guidance confirms internal channels duty.
France
Status: Mandated
Who must have a WBS: Generally ≥50 employees (public & private)
Core legal basis / notes: Sapin II as amended by the “Waserman” law strengthened internal channel obligations.
Italy
Status: Mandated
Who must have a WBS: ≥50 employees and 231-model entities
Core legal basis / notes: Legislative Decree 24/2023 (EU transposition) requires internal channels.
Spain
Status: Mandated
Who must have a WBS: ≥50 employees (and certain entities)
Core legal basis / notes: Law 2/2023 on whistleblowing systems and protection.
Netherlands
Status: Mandated
Who must have a WBS: ≥50 employees
Core legal basis / notes: Wet bescherming klokkenluiders (2023) updates obligations for internal channels.
Denmark
Status: Mandated
Who must have a WBS: ≥50 employees (public & private)
Core legal basis / notes: Whistleblower Protection Act implementing the EU Directive.
Luxembourg
Status: Mandated
Who must have a WBS: ≥50 employees; local authorities ≥10k
Core legal basis / notes: Law of 16 May 2023; staged deadlines for 50–249 headcount.
Sweden
Status: Mandated
Who must have a WBS: ≥50 employees
Core legal basis / notes: 2021:890 Act implementing EU Directive (internal channels).
Norway (EEA)
Status: Mandated
Who must have a WBS: ≥5 employees must have written procedures
Core legal basis / notes: Working Environment Act Ch. 2A: duty to establish internal whistleblowing routines.
Japan
Status: Mandated / size-based
Who must have a WBS: ≥300 employees must set up a system & a manager; smaller firms have “best-efforts” duties
Core legal basis / notes: 2020 amendments to the Whistleblower Protection Act, effective 2022, plus CAA guidelines.
United States
Status: Sectoral / partial
Who must have a WBS: Listed companies must have confidential audit-committee procedures; multiple agency programs (SEC/CFTC/IRS, etc.)
Core legal basis / notes: SOX §301/Rule 10A-3 (audit-committee procedures) + Dodd-Frank SEC whistleblower program; no general employer-wide WBS mandate.
United Kingdom
Status: Sectoral / partial; reform signalled
Who must have a WBS: FCA/PRA-regulated firms have whistleblowing rules; no universal mandate across employers
Core legal basis / notes: PIDA framework; FCA SYSC 18; Govt review published 2025; Office of the Whistleblower Bill introduced by an MP (private member’s bill).
Singapore
Status: Sectoral / listed
Who must have a WBS: SGX-listed issuers must maintain a whistleblowing policy; MAS guidance for FIs
Core legal basis / notes: SGX Listing framework (from 2022) hard-codes policy disclosure; MAS IAC Guidelines for financial institutions.
Hong Kong (SAR)
Status: Sectoral / listed
Who must have a WBS: HKEX-listed issuers must maintain a whistleblowing policy & system
Core legal basis / notes: Corporate Governance Code changes effective 1 Jan 2022 require a policy/system for issuers.
Canada
Status: Sectoral / partial
Who must have a WBS: Federally regulated FIs (FRFIs) and banks must have whistleblowing procedures; federal public sector has its own regime
Core legal basis / notes: FCAC whistleblowing guideline under the Bank Act; OSFI Integrity & Security expectations.
Australia
Status: Partial; reform pending
Who must have a WBS: Public companies, large proprietary companies, and superannuation trustees must have a whistleblower policy (not a universal WBS mandate). A federal Whistleblower Protection Authority bill is before a Senate committee (2025).
Core legal basis / notes: Corporations Act + ASIC RG 270 on policies; WPA Bill 2025 (No. 2) under inquiry; strong civil-society backing.
(ASIC,
Parliament of Australia,
The Australia Institute)
New Zealand
Status: Public-sector mandate
Who must have a WBS: Public sector must have procedures; private sector encouraged but not mandated
Core legal basis / notes: Protected Disclosures (Protection of Whistleblowers) Act 2022; govt guidance for agencies.
Brazil
Status: Partial (procurement / integrity)
Who must have a WBS: Companies bidding/contracting with federal government above thresholds need integrity programs incl. reporting channels
Core legal basis / notes: Decree 11,129/2022 (Clean Company Act regulations) links hotlines to integrity programs in public procurement.
UAE (DIFC/ADGM free zones)
Status: Sectoral
Who must have a WBS: Regulated financial firms must maintain whistleblowing arrangements
Core legal basis / notes: DFSA/FSRA rulebooks and guidance require internal channels for regulated entities.
Switzerland
Status: No general mandate
Who must have a WBS: No broad employer obligation; reforms stalled
Core legal basis / notes: Parliament rejected comprehensive federal whistleblowing bill; status remains fragmented.
This table focuses on employer obligations to run internal channels. Many jurisdictions also have external reporting bodies (authorities/ombudsmen) and strong anti-retaliation laws even if internal WBS are not universally mandatory.
Global WBS Audits and Certifications
