Run a whistleblowing channel once you have 50 workers

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Directive (EU) 2019/1937 sets the duty, and each country's law adds details. Financial services firms need a channel at any size. Accept reports in writing, by voice or both. Only the named handlers may see who reported. Name one impartial person or team to follow up and stay in touch with the reporter. Without a receipt, the 3 months run from the end of the 7 days. Keep a record of every report, and delete it after the period your national law sets. Also publish how to report to the authorities. Companies with 50 to 249 workers may share resources to receive and investigate reports. In Sweden the law is lag (2021:890), and chapter 5 section 2 counts the workers at the start of each calendar year. Count workers in the facts file. Compute the dates the way the reporting clocks do.

Examples

JavaScript example

const RECEIPT_DAYS = 7;
const FEEDBACK_MONTHS = 3;

const addDays = (date, days) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate() + days));
const addMonths = (date, months) => new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + months, date.getUTCDate()));

export function reportDeadlines(receivedAt, receiptSentAt = null) {
  const receiptDue = addDays(receivedAt, RECEIPT_DAYS);
  return { receiptDue, feedbackDue: addMonths(receiptSentAt ?? receiptDue, FEEDBACK_MONTHS) };
}

Python example

from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

RECEIPT_DAYS = 7
FEEDBACK_MONTHS = 3

def report_deadlines(received: date, receipt_sent: date | None = None) -> dict[str, date]:
    receipt_due = received + timedelta(days=RECEIPT_DAYS)
    return {"receipt_due": receipt_due,
            "feedback_due": (receipt_sent or receipt_due) + relativedelta(months=FEEDBACK_MONTHS)}

How to check

With 50 or more workers in one EU country, the register check needs a whistleblowing entry with a channel and a handler. A unit test opens a report on 1 March 2027. The receipt is due 8 March 2027, and feedback is due 8 June 2027. A daily job fails on any report past either date.

Sources

• Whistleblower Directive (EU) 2019/1937, Articles 8, 9 and 18
• Lag (2021:890) om skydd för personer som rapporterar om missförhållanden

Related rules

• CMP-2 Derive scope from recorded facts in Compliance and governance
• CMP-21 Start every reporting clock from one moment in Compliance and governance