Legal Obligations

All private sector entities with more than 50 employees (on average over the past year) must establish internal reporting channels and procedures for reporting and follow-up.

Private sector entities with fewer than 50 employees are indeed not required to set up an internal channel unless they have sector-specific obligations (such as specific financial sector obligations or sector-specific obligations to prevent and combat money laundering and terrorist financing). Nonetheless, these entities may establish reporting mechanisms on a voluntary basis and in accordance with Article 7 of the Law of 16 May 2023.

All public sector entities with more than 50 workers must establish internal reporting channels and procedures for internal reporting and its follow-up:

The State

The State constitutes a single legal entity and is composed of its ministries and administrations. Internal reporting channels are organised at the level of each ministry and, where appropriate, within certain administrations depending on their specific characteristics.

 In his circular letter dated 23 May 2024, the Minister of the Civil Service states that ‘in accordance with the decision of the Council of Government of 15 April 2024, ministries are called upon to set up internal reporting channels by appointing one or more reporting delegates, who will be competent for the ministerial department and the administrations that depend on them’. Ministries are therefore expected to establish internal reporting channels in accordance with the guidelines set out in the annex to the above mentioned circular letter.

Municipalities with more than 10 000 inhabitants

All municipalities with more than 10 000 inhabitants must have an internal reporting channel, in particular the municipalities of:

• Bettembourg
• Dudelange
• Differdange
• Esch-sur-Alzette
• Ettelbruck
• Hesperange
• Kaerjeng
• Kayl
• Luxembourg city
• Mamer
• Mersch
• Pétange
• Sanem
• Schifflange
• Strassen

 Municipalities with less than 10 000 inhabitants do not have to establish internal reporting channels but are free to voluntarily set up such channels and procedures in accordance with Article 7 of the Law of 16 May 2023.

Public institutions and other entities with separate legal personality from the State and municipalities

Public institutions and other entities with a separate legal personality employing more than 50 agents must establish an internal reporting channel.

Public sector legal entities with fewer than 50 employees are not required to establish internal reporting channels. They may, however, choose to set up such channels and procedures voluntarily, in accordance with Article 7 of the Law of 16 May 2023. In the municipal sector, municipal unions, social services, and civil hospices fall under this obligation only if they employ more than 50 workers.

Internal reporting and follow-up procedures include the appointment of an impartial person or department responsible for following up whistleblower reports.

This person or service will maintain communication with the whistleblower and, if necessary, ask for further information and provide feedback.

The safeguard measures and requirements referred to in Article 7(1) of the Law of 16 May 2023 also apply to third parties mandated to manage the reporting channel on behalf of a legal entity in the private sector, including:

• the establishment of secure channels guaranteeing the confidentiality of reports,
• the acknowledgement of receipt within 7 days,
• the designation of an impartial service for follow-up,
• feedback within 3 months and,
• the provision of information on reporting procedures to the competent authorities.

Internal reporting channels may be managed externally by a third party if the confidentiality of the reporting person, the content of the report and of the processing of the report is respected. 

The follow-up of an internal reports is only mandatory for alerts whose author is identified or identifiable. Following up on a report is thus also mandatory if the person, using a pseudonym, is identifiable. The Office for Whistleblowers recommends that all reports, including those made ‘anonymously’, be properly followed up.

The management of channels and procedures for internal reporting and its follow-up entails, in principle, a new data processing operation for which an update of the processing register and the information notice relating to the processing of personal data is necessary.

Article 8-3 of the Law of 12 November 2004 on the fight against money laundering and the financing of terrorism, introduced by the Law of 25 March 2020, as amended.

• Article 58-1 of the Law of 5 April 1993 on the financial sector, as amended;
• Article 8-3 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, which was introduced by the Law of 25 March 2020, as amended;
• Article 58-10 of the Law of 10 November 2009 on payment services, as amended, allowing the CSSF to set up effective mechanisms to encourage reporting of breaches of Regulation (EU) 2015/847 to the CSSF;
• Article 149b of the Law of 17 December 2010 relating to undertakings for collective investment, as amended;
• Article 23 of Council Regulation (EU) No 1024/2013 of 15 October 2013 (SSM Regulation);
• Title 3 (Articles 36 to 38) of the SSM Framework Regulation;
• Article 36(7) of the Law of 23 July 2016 concerning the audit profession, as amended;
•  Article 8 and Annex of the Law of 23 December 2016 on market abuse, as amended;
• Article 46 of the Law of 30 May 2018 on markets in financial instruments, as amended;
•  Article 271-1 et seq. of the Labour Code, introduced by the Law of 13 February 2011 strengthening the means against corruption, as amended;
• Article 4 of the Law of 6 June 2018 on central securities depositories and implementing Regulation (EU) No 909/2014;
• Article 10 of the Law of 16 July 2019 on prospectuses for securities.

Article 4(o) of the amended Law of 7 December 2015 on the insurance sector.