Whistleblowing: who must have a reporting channel

"Are we required to have a whistleblowing channel?" It is one of the first questions directors, HR teams and advisers ask when they hear about the EU Directive and Italy's Legislative Decree 24/2023. The answer depends on a few factors: the average number of workers, whether a 231 model has been adopted, the sector of activity and whether the organisation is public or private.

In this guide we look at who falls under the obligation in Italy, how to think about the 50-worker threshold, what happens to those below it, what the compliance deadlines were and what penalties apply. If you want to refresh the basics first, start with what whistleblowing is and what Legislative Decree 24/2023 requires.

Who must have a reporting channel

Legislative Decree 24/2023 identifies four groups that must set up an internal reporting channel. Belonging to just one of these groups is enough for the obligation to apply.

The most common case is a private company that exceeds the 50-worker threshold. But it is not the only one: a small company that has adopted a 231 model or operates in one of the sensitive sectors must also set up the channel, even with few employees.

A practical example

Take three companies. The first has an average of 70 workers: it is required. The second has 20 but has adopted a 231 model: it is required too. The third has 20 workers, no 231 model and does not operate in sensitive sectors: it is not required, but it can still choose to set up the channel.

How to calculate the average number of workers

The threshold does not refer to the number of employees on a specific day, but to the average number of workers over the last year. In general terms, this means looking at how the headcount has changed over the year, not just at today's snapshot.

To get your bearings, you can follow a few steps:

1. Collect headcount data for the last year, month by month.
2. Check which types of employment relationship count in your case.
3. Calculate the average and compare it with the 50-worker threshold.
4. Repeat the check periodically, because the headcount can change over time.

The calculation can get complex with seasonal or part-time contracts or a very variable workforce. In doubtful cases it is best to consult an employment adviser or lawyer, who can assess the company's specific situation.

What happens below 50 employees

A private entity with an average of fewer than 50 workers, no 231 model and outside the sensitive sectors is not required to set up the internal channel provided for by Legislative Decree 24/2023.

This does not prevent it from setting one up voluntarily. Some companies do so to offer employees and contractors a safe way to raise concerns, or because customers or partners require it. In these cases it helps to choose a tool from the start that lets you handle reports in an orderly, confidential way.

When to repeat the check

• When the headcount grows and approaches 50 workers.
• When the company adopts a 231 organisational model.
• When the company starts operating in one of the sensitive sectors.

Compliance deadlines

Legislative Decree 24/2023 set two compliance deadlines for private entities:

• 15 July 2023 for entities with 250 or more employees;
• 17 December 2023 for entities with 50 to 249 employees.

These deadlines have now passed: anyone covered by the obligation should already have an active channel. If your company has not yet done so, or has only recently crossed the threshold, now is the time to act.

ANAC penalties

ANAC can impose administrative fines of €10,000 to €50,000. Penalised situations include:

• failing to set up reporting channels;
• adopting non-compliant procedures;
• failing to verify the reports received.

Having a channel "on paper" is not enough: you need an adequate procedure and effective handling of reports, with acknowledgement within 7 days and feedback within 3 months.

What to do now: 5 steps

1. Check whether you are required: look at the average number of workers, 231 model, sector and type of organisation.
2. Choose the channel manager: an internal person or office, or an independent and trained external party.
3. Write the procedure: who can report, how, within what timeframes reports are handled and how data is processed.
4. Inform the trade union representatives: in Italy the internal channel is set up after informing the trade union representatives or organisations.
5. Activate the tool: choose a platform that allows written reports and manages the timeframes. To find your way, read how to choose whistleblowing software.

With Whisper whistleblowing software you can set up an online reporting channel with ready-made procedure and privacy notice templates.

Quick checklist

• Have I calculated the average number of workers over the last year?
• Has the company adopted a 231 organisational model?
• Does the company operate in financial services, transport safety or environmental protection?
• Is the organisation a public administration?
• Have I kept a record of the check, so I can repeat it and show it in future?

If the answer is yes to even one of the first four questions, the company is covered by the obligation and must set up the internal channel.

F.A.Q. - Frequently asked questions

General information only, not legal advice: check your situation with a professional and consult the latest ANAC Guidelines.