In Germany you need a whistleblowing system if you normally employ at least 50 people [1]. Certain financial companies need one whatever their size. The Whistleblower Protection Act (HinSchG) does not say “whistleblowing system”: it says internal reporting office with reporting channels (§ 12, § 16 HinSchG).
Not legal advice
This article gives general information. It reflects the HinSchG as amended on 25 September 2026 [1]. For your own case, ask a lawyer.
Do you need a whistleblowing system? Check in 30 seconds
Financial companies include credit institutions, insurers, investment firms, asset management companies, and crypto and payment institutions. The full list is in § 12 Abs. 3.
Who counts as an employee
The law looks at the number normally employed (§ 12 Abs. 2). It does not mention full-time equivalents. Employees under § 3 Abs. 8 are:
| Who | Provision |
|---|---|
| Employees | § 3 Abs. 8 Nr. 1 |
| Trainees and others employed for vocational training | § 3 Abs. 8 Nr. 2 |
| Civil servants, judges, soldiers | § 3 Abs. 8 Nr. 3–5 |
| Persons similar to employees, including home workers | § 3 Abs. 8 Nr. 6 |
| People working in sheltered workshops for disabled people | § 3 Abs. 8 Nr. 7 |
An employer is any person or organisation that employs at least one person: companies, partnerships, associations, foundations and public authorities (§ 3 Abs. 9).
Edge cases
| Case | What applies | Provision |
|---|---|---|
| A group with several companies | The threshold applies to each company separately. A third party may take on the tasks. | § 12 Abs. 2, § 14 Abs. 1 |
| Several companies with 50 to 249 employees each | A shared office is allowed. Remedy and feedback stay with each company. | § 14 Abs. 2 |
| Federal and state government | The supreme authorities choose the units that need a reporting office. | § 12 Abs. 1 |
| Municipalities and their companies | Whether and from when is a matter of state law. | § 12 Abs. 1 |
| Fewer than 50 employees | Not obliged. Employees can still turn to an external reporting office, such as the one at the Federal Office of Justice. | § 7 Abs. 1, § 19 |
The threshold of 50 comes from EU Directive 2019/1937 (Art. 8(3)) [2]. After a risk assessment, member states may also oblige smaller companies (Art. 8(7)).
Since when, and what happens without a reporting office
| What | Since | Provision |
|---|---|---|
| Obligation from 250 employees and for financial companies | 2 July 2023 | § 12 |
| Obligation for private employers with 50 to 249 employees | 17 December 2023 | § 42 Abs. 1 |
| Fine of up to €20,000 without an internal reporting office | 1 December 2023 | § 40 Abs. 2 Nr. 2, Abs. 6; § 42 Abs. 2 |
What the reporting office must offer
- Two channels. Reports in writing and orally, in person on request (§ 16 Abs. 3).
- Access only for those responsible (§ 16 Abs. 2).
- Two deadlines. Confirm receipt within 7 days, give feedback within 3 months (§ 17).
Every duty, with a checklist, is in the HinSchG compliance guide. What a free system still costs is in Free whistleblowing system.
Set up the written channel for free
OpenWhistle is open source under GPL-3.0 and tracks both deadlines of § 17. The live demo shows the report form and the reporting office.
Open the live demo →More resources: HinSchG compliance guide · Step-by-step installation guide · Whistleblowing software providers compared 2026
Sources
- Hinweisgeberschutzgesetz (HinSchG), as amended on 25 September 2026, gesetze-im-internet.de (German). Retrieved 27 October 2026.
- Directive (EU) 2019/1937, Art. 8, EUR-Lex. Retrieved 27 October 2026.