Corporate whistleblowing: who is required to comply and what changes under Legislative Decree 24/2023

What it is and where it comes from

Whistleblowing is the system that allows employees and collaborators to confidentially report wrongdoing they become aware of in their working environment. In Italy, the matter is now governed by Legislative Decree No. 24 of 10 March 2023, which implements EU Directive 2019/1937 and replaced the previous rules (Article 54-bis of Legislative Decree 165/2001 for public employment and Law 179/2017 for the private sector), unifying the rules for both public and private sectors in a single text.

Who is required to comply

In the private sector, the obligation to set up an internal reporting channel applies to companies that employed, on average, at least 50 employees over the past year. However, the size threshold is not the only criterion: the obligation applies regardless of headcount to companies operating in regulated sectors (including financial services, anti-money laundering, and transport safety) and to companies that have adopted an Organisation, Management and Control Model under Legislative Decree 231/2001.

What the channel must guarantee

A generic email inbox is not enough. The channel must guarantee the confidentiality of the reporting person's identity, of the people involved, and of the report's content; it must be managed by an autonomous internal person or office, or entrusted to an external party with adequate guarantees of independence and competence; and it must provide feedback to the reporting person within the timeframes set by law. Responsibility for adopting adequate procedures remains with the organisation even when day-to-day management is outsourced.

The link with the 231 organisational model

For companies with a 231 Model in place, updating the organisational model to reflect the whistleblowing rules is not a separate compliance task: it has become a relevant factor for the model's effectiveness as a defence against administrative liability arising from criminal offences. A 231 Model that does not correctly incorporate the reporting channels required by Legislative Decree 24/2023 exposes the entity to a double risk — regulatory, and to the model's own standing if challenged.

What's at risk for non-compliance

ANAC (the Italian National Anti-Corruption Authority) can impose administrative fines which, according to available sources, reach up to €50,000, for failing to set up the channels, for inadequate management procedures, or where retaliation against a reporting person is established. Any retaliatory acts (demotion, dismissal, other discriminatory measures) are void by law. On the specific point of penalty amounts, we nonetheless recommend checking the decree's text currently in force, since the matter has been subject to further clarification since it came into effect.

Official sources

• Legislation — Legislative Decree No. 24 of 10 March 2023, implementing EU Directive 2019/1937 — Normattiva.it (Italian)
• ANAC — Guidelines and clarifications on whistleblowing rules (regulatory power under Art. 10, Legislative Decree 24/2023) — anticorruzione.it (Italian)
• Legislation — Legislative Decree No. 231 of 8 June 2001, regarding the exempting effect of organisational models

Thresholds, penalty amounts and procedural requirements are verified against the sources above as of the publication date: they should be re-checked for the specific case, especially for companies close to the 50-employee threshold or operating in regulated sectors. For an assessment of your situation, contact us.