Key takeaways
- The Act of 28 November 2022 requires an internal reporting channel for any private-sector entity employing at least 50 workers, and with no size threshold for entities in the financial sector.
- Entities with 250 workers or more had to be compliant from the entry into force, on 15 February 2023; those with 50 to 249 workers had until 17 December 2023.
- Protection covers a broad circle: workers, former workers, applicants, self-employed persons, shareholders, directors, volunteers, trainees and people who facilitate a report.
- Any detrimental measure taken against a whistleblower after their report is presumed to be retaliation, with no legal time limit: it is up to the employer to prove otherwise.
A Belgian SME that crosses the 50-worker threshold has a legal obligation it often overlooks: organising a channel to receive internal reports, and protecting the person who makes one against any retaliatory measure. Whistleblower protection stems from the Act of 28 November 2022, which transposes European Directive 2019/1937 into Belgian law and has applied to the private sector since 15 February 2023. This article details who is concerned, what the law concretely requires and on what timeline, and what a company risks in case of non-compliance.
What the Act of 28 November 2022 says
The text, published in the Belgian Official Gazette on 15 December 2022, protects any person who reports a breach of European Union law or national law found within a private-sector legal entity. It transposes Directive (EU) 2019/1937 of the European Parliament and of the Council, and complements an equivalent scheme already applicable to the federal public sector.
Who must organise an internal reporting channel, and since when
The obligation applies to any private-sector legal entity employing at least 50 workers, regardless of its form (SRL, SA, ASBL in particular). The compliance timeline distinguished two company sizes.
- 1
Entry into force of the Act
15 February 2023The Act of 28 November 2022 enters into force; entities with 250 workers or more must have an operational internal channel from this date.
- 2
Deadline for entities with 50 to 249 workers
17 December 2023Additional period granted by the Act to intermediate-sized entities to set up their internal channel and reporting procedure.
- 3
Financial sector: no additional period
15 February 2023Entities supervised by the FSMA or the National Bank of Belgium, as well as those covered by anti-money-laundering legislation, must be compliant from 15 February 2023, regardless of size.
Who is protected as a whistleblower
The Act adopts a broad definition of the protected person, not only the employee who reports a fact witnessed in their own department.
Categories of protected persons
Current employees
Including statutory staff and members of staff in the broad sense of the entity.
Former employees and job applicants
Protection applies if the information was obtained during the recruitment process or an employment relationship that has since ended.
Self-employed persons, shareholders and directors
As soon as they obtained the information in a professional context linked to the entity.
Volunteers, trainees and subcontractors
Any person who works under the supervision and direction of the entity, whether paid or not.
Facilitators and persons connected to the person making the report
A colleague or relative of the person making the report, themselves exposed to a risk of retaliation, is also protected.
The common condition for all these categories remains having obtained the information in a professional context: an outside rumour unrelated to the entity's activity does not trigger protection.
Internal channel, external channel, public disclosure: the whistleblower's choice
The whistleblower is not required to report internally first before being able to approach an external authority: the Act leaves the choice of channel to them, depending on their trust in the internal handling of the report and the nature of the facts.
| Internal channel | External channel | |
|---|---|---|
| Who manages it | a manager designated by the entity, in full independence | the Federal Ombudsman by default, or the competent sectoral authority (FSMA, National Bank of Belgium) |
| Prior condition | none, the choice of channel belongs to the whistleblower | none, accessible without going through the internal channel first |
| Confidentiality of identity | ||
| Acknowledgement of receipt | within seven days | within seven days |
Public disclosure, for example through the press, remains a last resort: it is only protected if an external report has gone unaddressed within the set time limit, or in the event of an imminent and manifest danger to the public interest.
Bring your corporate governance into compliance
Monsiegesocial supports directors of Belgian SMEs on the governance and compliance obligations that come with growing their company.
Protection against retaliation
The core of the scheme is not the sanctioning of the company targeted by the report, but the protection of the person making it. The Act explicitly prohibits any detrimental measure taken in reaction to a report: dismissal, demotion, suspension of appraisal, disciplinary measure or sidelining, among others.
The Act also criminally sanctions hindering or attempting to hinder a report, retaliating against a protected person, bringing abusive proceedings against them, or breaching the obligation of confidentiality over their identity. An SME therefore has an interest in training its report managers on this framework before the first case, rather than discovering these obligations through a dispute.
What an SME must concretely put in place
Advantages
- A credible internal channel (dedicated line, secure mailbox or online tool) designates an independent manager who acknowledges receipt of the report and follows up on it.
- A written procedure communicated to staff avoids improvisation on the day a report actually arrives.
Disadvantages
- The absence of a formalised procedure does not stop an employee from reporting directly externally, which deprives the company of the chance to handle the matter internally first.
- A poorly protected channel, where the identity of the person making the report circulates beyond the designated manager, exposes the company to the criminal dimension of the Act, regardless of the merits of the report.
