Whistleblowing in Focus: Recent Developments, Emerging Issues, and Considerations for Companies (Part Two)

Introduction[1]

In this three-part series, we discuss the outlook for whistleblower programs in the United States under the new administration. Second, we review initiatives relating to whistleblower reports in other jurisdictions over the past year. Third, we address emerging issues and considerations for companies in relation to whistleblower reports.

Part 2: Global Developments

In recent years, enforcement authorities outside the United States have been more active in pursuing corporate misconduct, especially foreign corruption. While those authorities have adopted U.S.-style mechanisms such as deferred prosecution agreements, they have not followed U.S. authorities in offering incentives for whistleblower reports, although there is growing interest in the United Kingdom in exploring that option. Even without offering those incentives, enforcement authorities outside the U.S. have continued to receive an increased number of tips. New laws and guidance relating to whistleblower reporting may lead to whistleblowers making more reports internally to companies or externally to the authorities.

A. United Kingdom

In the United Kingdom, whistleblower reports to the authorities increased, new legislation expanded statutory protections for whistleblowers, and reforms to the whistleblowing framework are under consideration. In its annual report on whistleblowing, the United Kingdom’s financial services regulator, the Financial Conduct Authority (“FCA”), announced in June 2025 that the number of whistleblower reports it receives continues to rise.[2] For the period between April 2024 and March 2025, fraud allegations amounted to 6% of the total allegations made.[3] This figure may increase with the introduction of the new failure to prevent fraud offense on September 1, 2025.

Also in June 2025, reflecting the UK’s focus on sanctions enforcement, new statutory protections were established for whistleblowers who raise concerns to the treasury or government departments for trade and transport about breaches of the Sanctions and Anti-Money Laundering Act 2018, which underpins the majority of the UK’s financial sanctions regimes.[4] Such whistleblowers are entitled to compensation if they are dismissed or subject to other “detriment” by their employers.[5]

Looking ahead, the UK government is considering reforms to the UK’s whistleblowing framework for protecting whistleblowers and using whistleblower reports to assist law enforcement activities. A bill was introduced in Parliament at the end of 2024 proposing the establishment of an independent Office of the Whistleblower with responsibilities including maintaining standards for the management of whistleblowing cases, directing investigations, and ordering remedies for detriment suffered by whistleblowers.[6] The bill has been delayed, however, in its journey through Parliament and is thus unlikely to lead to imminent reforms.[7] A July 2025 update on a government-commissioned independent review of fraud offenses described “growing interest in the potential role of whistleblowing as a tool for early detection and disruption of fraud, particularly in complex and high-value cases.”[8] Further findings from the review are expected later, following which further recommendations may be made. As we explained last year, the UK Serious Fraud Office’s (“SFO”) 2024–29 strategy plan includes exploring incentives for whistleblowers, in conjunction with partners in the UK and abroad.[9] The SFO reported in its 2025–26 plan that it is working on whistleblower incentivization.[10]

B. European Union

In the European Union and within its Member States, court decisions and guidance from the authorities addressed the implementation of the EU Whistleblower Directive. In addition, French authorities reported enforcement activities based on whistleblower reports.

In March 2025, the Court of Justice of the European Union ordered five Member States to pay fines for their delay in implementing the EU Whistleblower Directive, Directive (EU) 2019/1937.[11] The Directive requires EU Member States to adopt minimum standards to guarantee whistleblower protections for reporting violations of EU laws in key policy areas.[12] The Directive addresses topics such as the obligation of legal entities in the private and public sectors to establish channels and procedures for internal reporting and follow-up, recordkeeping of reports received, confidentiality of the identity of whistleblowers and the subjects of reports, protection of whistleblowers from retaliation and support for whistleblowers, and protections for the subjects of reports including the right to be heard and to access their file.[13]

1. France

In France, the existing Sapin II Law compliance framework, which mandates comprehensive compliance programs and risk mapping for large companies, as well as whistleblower protection mechanisms, has been significantly strengthened by the implementation of the EU Whistleblower Directive in March 2022 via the so-called Waserman Law.[14]

Under French law, whistleblowers and those who assist them benefit from confidentiality and strong anti-retaliation protections, provided that the report is made in good faith and without the whistleblower receiving direct financial compensation for making the report.[15] A whistleblower is not required to have direct knowledge of the reported allegations when she makes a report based on information obtained in the context of her professional activity.[16]

In a May 2025 decision, the French Supreme Court addressed the standard for bad faith under the whistleblower protection law.[17] In that case, the plaintiff previously made a report to the French anti-corruption agency, Agence Française Anticorruption (“AFA”).[18] The plaintiff had identified to the AFA conduct that he viewed as amounting to tax fraud and misuse of company assets by one of his employer’s business partners.[19] The plaintiff filed suit after his employer dismissed him for gross misconduct.[20] The French Supreme Court affirmed an earlier judgment finding that the plaintiff’s dismissal was null and void because his bad faith had not been shown.[21] As the court explained, bad faith would only be shown if the employee knew that the reported information was false, not simply because the allegations had not been confirmed.[22]

In June 2025, the French financial prosecutor, Parquet national financier (“PNF”), entered into a form of deferred prosecution agreement (known as a Convention judiciaire d’intérêt public) resulting from an investigation triggered by a whistleblower report.[23] After a company’s former compliance officer reported to the PNF that the company and subsidiaries had engaged in corrupt practices in Asia, a preliminary investigation by the PNF confirmed unjustified payments totaling €4.2 million to third parties in Asia.[24] The agreement required the company to pay a fine of €16 million and implement a three-year compliance plan.[25]

In a July 2025 report covering its activities in 2024, the AFA announced that the number of whistleblower reports it received almost doubled from the previous year.[26] The AFA is the designated external reporting channel for allegations of corruption, influence peddling, bribery, illegal taking of interest, misappropriation of public funds, and favoritism.[27] The AFA reported a continued increase in the number of whistleblower reports it referred to the public prosecutor for probable corruption offenses.[28]

2. Italy

In November 2025, the Italian anti-corruption agency, Autorità Nazionale Anticorruzione (“ANAC”) approved its guidelines on internal reporting channels for whistleblowing (the “Guidelines”).[29] ANAC previously published guidelines on external reporting channels for whistleblowing and published the additional guidelines to promote the uniform and effective application of the whistleblower protection laws, clarifying certain aspects that had raised questions.[30]

As stated in the Guidelines, the Italian whistleblower protection law encourages whistleblowers to make reports through internal channels, on the basis that the use of internal channels will allow effective prevention and prompt investigation of violations of law by those who are more familiar with the issues.[31] In particular, the Guidelines define in detail the role and competencies of the report handler, emphasizing that the manager responsible for receiving and investigating reports must be impartial and independent, be specifically trained for the role, and understand the entity.[32] This does not mean that the report handler must necessarily be an internal function. Indeed, the Guidelines confirm that the internal reporting channel may be outsourced to an external entity, which may be a third-party service provider or a group company, including a foreign parent company. In that case, the outsourced provider manages the channel and the related communications with whistleblowers, while each entity must ensure appropriate coordination by appointing an internal coordinator. ANAC retains supervisory powers over the Italian entity even if the report handler is located abroad.[33] For corporate groups, the Guidelines also clarify that only companies with fewer than 250 employees may share a centralized channel (and each company should only have access, through dedicated sub-channels, to whistleblower reports made to that company).[34] 

The Guidelines recommend that entities already operating a whistleblowing channel for reporting violations of the compliance model under Legislative Decree No. 231/2001 adopt a single, unified internal channel to receive all whistleblower reports covered by the Italian whistleblowing framework, to avoid duplication and confusion.[35] The Guidelines also recommend targeted and regularly updated training for report handlers on whistleblowing rules, data protection, and relevant procedures, as well as general training for all personnel on who can qualify as a whistleblower, what can be reported, and the protections available.[36]

3. Germany

In a May 2025 decision, the Labor Court of Appeals of the Federal State of Hesse addressed the right to injunctive relief for violations of whistleblowers’ rights.[37] The plaintiff was a current employee who had made whistleblower reports to U.S. and German authorities between 2023 and 2024 with the support of counsel.[38] The whistleblower reports had led to fines by the U.S. Securities and Exchange Commission and the Frankfurt public prosecutor’s office to resolve investigations into alleged “greenwashing” by her employer in September 2023 and April 2025, respectively.[39] In February 2025, the plaintiff’s supervisor instructed her that she should discuss “purely technical topics in the day-to-day business of [her] work” only with her colleagues and that “to maintain the confidentiality of [their] business operations,” she should “work on these issues without the involvement of an external third party such as [her counsel] or other external persons.”[40] The plaintiff sought a preliminary injunction to suspend her supervisor’s instruction, on the basis that it prevented her from working with counsel to continue cooperating with the authorities.[41] During a court hearing, the employer’s counsel clarified that the instruction did not prevent the plaintiff from disclosing information to counsel or other external persons in relation to her cooperation with the authorities and stated that the instruction would be withdrawn to the extent it restricted the plaintiff’s cooperation with the authorities and related communications with counsel.[42] The first instance labor court rejected the plaintiff’s application for a preliminary injunction based on this partial withdrawal of the supervisor’s instruction.[43] The appellate court affirmed that decision.[44] It confirmed that injunctive relief is in principle available to protect whistleblowers’ rights.[45] The appellate court concluded, however, that while the original instruction was too broad and obstructed the whistleblower, the partial withdrawal of the instruction removed the unlawful restrictions on the plaintiff.[46]

The Labor Court of Braunschweig issued an important decision in June 2025 on the Whistleblower Protection Act.[47] The court ruled that the Whistleblower Protection Act does not apply to whistleblower reports that were made before the legislation came into force, even if the alleged reprisals occurred after the legislation’s effective date.[48] The court explained that the delay by German lawmakers in implementing the EU Whistleblower Directive was irrelevant to the applicability of the domestic legislation, and the Directive did not directly apply to the defendant before the domestic legislation came into force.[49] The decision also clarified the requirements for obtaining the protections under the new law. The whistleblower must report to the designated reporting channels, which are intended to enable the funneling of information and efficient follow-up as required by the law.[50] Whistleblower reports to supervisors and other functions that are not the designated reporting channels for the purpose of the Whistleblower Protection Act are not protected by that law.[51]

C. Hong Kong

Despite past calls for dedicated whistleblower legislation,[52]Hong Kong has not enacted a comprehensive statutory framework. Instead, whistleblower protections appear on a piecemeal basis across various ordinances covering, for example: (a) auditors reporting fraud or other misconduct in a listed company (or any of its associated companies) under the Securities and Futures Ordinance;[53] (b) reporters of suspected bribery to Hong Kong’s anti-corruption body, the Independent Commission Against Corruption (“ICAC”), under the Prevention of Bribery Ordinance;[54] and (c) persons filing money laundering reports under relevant AML legislation.[55]

The Corporate Governance Code for the Hong Kong Stock Exchange includes a provision for listed companies to establish whistleblowing policies and systems for employees and third parties “to raise concerns, in confidence and anonymity, with the audit committee.”[56] Listed companies are required to state, in their annual corporate governance report, whether they have complied with the code provisions on a “comply or explain” basis.[57] The Exchange’s Corporate Governance Guide for Boards and Directors also includes guidance relating to whistleblower reports, policies, and procedures.[58]

In 2026, the ICAC is expected to publish its Integrity Compliance Management System (“ICMS”), which is intended to provide a comprehensive framework to help listed companies “detect and prevent corruption.”[59] Among the topics covered in the ICMS is the adoption by companies of procedures relating to whistleblower reports of corruption.[60] The Stock Exchange encourages companies “to adopt the ICMS by integrating relevant procedures into their existing framework of risk management and internal controls.”[61]

Conclusion

In the past year, authorities and market regulators around the world have continued efforts to encourage whistleblower reporting, including through legislation protecting whistleblowers and guidance to companies on best practices for internal whistleblowing systems. While enforcement authorities outside the U.S. have signaled that they may increasingly rely on whistleblower tips to combat corporate misconduct, like their U.S. counterparts they also recognize the value of companies receiving internal whistleblower reports that companies can use to proactively detect and address misconduct. In the next and final publication of this series, we will discuss initiatives focusing specifically on whistleblowers in the artificial intelligence industry and highlight, in light of recent developments, areas for companies to focus on in reviewing their policies, procedures, and practices relating to whistleblower reports.

---

[1] With thanks to Long Dang, Christian Grasinger, Keara Schmeiser, Alex Bado, Frances Carpenter, Giulia Checcacci, Elise Goebel, Jan-Frederik Keustermans, Paola Maria Onorato, Lennart Osten, Fabrice Vollborn, and Adam Clark (Prac. Dev. Leader for Asia) for their support in research and drafting Part 2 of the series.

[2] The FCA received 1,131 new whistleblower reports from April 2024 to March 2025, compared to 1,124 from 2023 to 2024, 1,086 from 2022 to 2023, 1,041 from 2021 to 2022, and 1,046 from 2020 to 2021. Financial Conduct Authority, Prescribed Persons Annual Report 2024/25, available at https://www.fca.org.uk/data/prescribed-persons-annual-report-2024-25#lf-chapter-id-allegations-in-whistleblowing-reports [“FCA 2024/25 Whistleblowing Report”]; Financial Conduct Authority, Prescribed Persons Annual Report, 2023/24, available at https://www.fca.org.uk/data/prescribed-persons-annual-report-2023-24.

[3] See FCA 2024/25 Whistleblowing Report, supra note 2.

[4] The Public Interest Disclosure (Prescribed Persons) (Amendment) Order 2025, amending the Public Interest Disclosure (Prescribed Persons) Order 2014, 2025 No. 604, art. 2, available at https://www.legislation.gov.uk/uksi/2025/604/article/2/made.

[5] Public Interest Disclosure Act 1998, c. 23 § 2.

[6] Office of the Whistleblower Bill 2024–26, HC Bill, available at https://bills.parliament.uk/bills/3914; HC Deb (18 Dec. 2024) (759) cols. 386–88, available at https://hansard.parliament.uk/commons/2024-12-18/debates/F3399642-C26A-464A-A72C-003754523A93/OfficeOfTheWhistleblower.

[7] See Office of the Whistleblower Bill 2024–26, HC Bill, available at https://bills.parliament.uk/bills/3914/stages.

[8] Home Office, Independent Review of Disclosure and Fraud Offences: update July 2025, available at https://www.gov.uk/government/publications/independent-review-of-disclosure-and-fraud-offences-part-2-updates/independent-review-of-disclosure-and-fraud-offences-update-july-2025.

[9] Cleary Gottlieb, Whistleblowing in Focus: Recent Developments, Emerging Issues, and Considerations for Companies. Part Two: Global Developments (Jan. 17, 2025), available at https://www.clearyenforcementwatch.com/2025/01/whistleblowing-in-focus-recent-developments-emerging-issues-and-considerations-for-companies-part-two-global-developments/#_ftnref12.

[10] Serious Fraud Office, Business Plan 2025–26 (Apr. 3, 2025) at 7, available at https://assets.publishing.service.gov.uk/media/67ee4e86199d1cd55b48c6e8/SFO_2025-26__Business_Plan.pdf; see also FCA 2024/25 Whistleblowing Report, supra note 2 (referencing work the FCA has done with other UK agencies, international partners, and industry partners to “understand the potential impact and implications” of offering incentives to whistleblowers).

[11] The Member States in question are Germany, the Czech Republic, Hungary, Luxembourg, and Estonia. The court previously ordered Poland to pay a fine for its delayed implementation of the Directive. SeeCourt of Justice of the European Union, Failure to Fulfill Obligations: Five Member States are Ordered to Pay Financial Penalties for Failing to Transpose the Whistleblowers Directive (Mar. 6, 2025), available at https://curia.europa.eu/jcms/upload/docs/application/pdf/2025-03/cp250029en.pdf.

[12] Directive (EU) 2019/1937, available at https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng. The policy areas are public procurement, financial services, products and markets, anti-money laundering and terrorist financing, product safety and compliance, transport safety and protection of the environment, radiation protection and nuclear safety, food and feed safety, animal health and welfare, public health, consumer protection, privacy and personal data protection, security of network and information systems, and breaches affecting the financial interests of the EU or relating to the internal market. Id. art. 2.

[13] Id. arts. 8–9, 16, 18–22.

[14] Law No. 2016-1691 of Dec. 9, 2016, on transparency, anti-corruption and economic modernization (“Sapin II Law”), ch. II, “Protection of Whistleblowers”, as modified by Law No. 2022-401 of Mar. 21, 2022, aimed at improving the protection of whistleblowers (the “Waserman Law”), available at https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/2026-01-14.

[15] Waserman Law, art. 1, amending Sapin II Law, art. 6.

[16] Id.

[17] See Cour de cassation [Cass.] [supreme court for judicial matters] soc., May 6, 2025, No. 23-15.641, available at https://www.courdecassation.fr/en/decision/6819a1f1ea7b3f881e0af48f. The good faith requirement of Article L. 1132-3-3 of the French Labor Code, in the version applicable to the facts of the case, remains unchanged following the implementation of Directive (EU) 2019/1937 into French law via the Waserman Law.

[18] See id.

[19] Id.

[20] Id.

[21] Id.

[22] Id.

[23] Ministère de la Justice, CJIP entre le Procureur de la République financier [CJIP between the Financial Prosecutor] (June 16, 2025), available at https://www.agence-francaise-anticorruption.gouv.fr/files/250616_CJIP%20sign%C3%A9e.pdf.

[24] Id.

[25] Id.

[26] AFA, Annual Activity Report for 2024 (July 2025) at 60, available at https://www.agence-francaise-anticorruption.gouv.fr/files/AFA_RA_2024_Web_4.pdf [“AFA 2024 Report”].

[27] Sapin II Law, ch. I, “The French Anti-Corruption Agency”, art. 1, supra note 14.

[28] The AFA referred 17 whistleblower reports received in 2024 to the public prosecutor, compared with 11 in 2023 and 2 in 2022. AFA 2024 Report, supra note 26, at 65; AFA, Annual Activity Report for 2023 (July 2024) at 43, available at https://www.agence-francaise-anticorruption.gouv.fr/files/EN_RA_2023_Web.pdf.

[29] ANAC, Linee guida N° 1: Linee guida in materia di whistleblowing sui canali interni di segnalazione [Guideline No. 1: Guidelines on whistleblowing via internal reporting channels] (Nov. 26, 2025), available at https://www.anticorruzione.it/-/del.n.478-26.11.2025.llgg.wb.

[30] See id. at 6.

[31] Id. at 7–8.

[32] Id. at 14–16.

[33] The Guidelines advise that arrangements with external entities require contracts addressing the management of reports, the powers and responsibilities of the external entities, and personal data protection issues. Id. at 19, 42–44.

[34] The Guidelines suggest that arrangements to share a centralized channel require contracts addressing topics such as operating procedures, measures taken to maintain confidentiality, and personal data protection issues. Id. at 19–20, 40–42.

[35] Id. at 36.

[36] Id. at 32–33.

[37] Hessisches Landesarbeitsgericht 10. Kammer [Hessian Regional Labor Court, 10th Chamber], May 30, 2025, 10 GLa 337/25, available at https://www.rv.hessenrecht.hessen.de/bshe/document/LARE250000910.

[38] Id.

[39] Id.

[40] Id.

[41] Id.

[42] Id.

[43] Arbeitsgericht Frankfurt am Main, 15. Kammer [Frankfurt District Labor Court, 15th Chamber], Mar. 26, 2025, 15 Ga 24/25.

[44] Hessisches Landesarbeitsgericht, 10. Kammer [Hessian Regional Labor Court, 10th Chamber], May 30, 2025, 10 GLa 337/25, available at https://www.rv.hessenrecht.hessen.de/bshe/document/LARE250000910.

[45] Id.

[46] Id.

[47] Arbeitsgericht Braunschweig [Braunschweig Labor Court], June 24, 2025, 6 Ca 303/24 (appeal pending), available at https://voris.wolterskluwer-online.de/browse/document/25d5226b-40c9-4c91-9863-38cd6ef9afdf.

[48] Id.

[49] Id.

[50] Id.

[51] Id.

[52] Legislative Council Meeting, Motion on “Legislating for the protection of whistle-blowers”, (Oct. 31, 2018), available at https://www.legco.gov.hk/yr18-19/english/hc/papers/hc20181019cb3-41-e.pdf.

[53] Securities and Futures Ordinance, (2012) Cap. 571, § 381, available at https://www.elegislation.gov.hk/hk/cap571.

[54] Prevention of Bribery Ordinance, (2025) Cap. 201, § 30A, available at https://www.elegislation.gov.hk/hk/cap201.

[55] E.g., Drug Trafficking (Recovery of Proceeds) Ordinance, (2019) Cap. 405, § 26, available at https://www.elegislation.gov.hk/hk/cap405?xpid=ID_14384031 60417_002; Organized and Serious Crimes Ordinance, (2025) Cap. 455, § 26, available at https://www.elegislation.gov.hk/hk/cap455?xpid=ID_1438403216343_002.

[56] Hong Kong Exchanges and Clearing Ltd., Corporate Governance Code (Appendix C1 of the Main Board Listing Rules) at 27, available at https://en-rules.hkex.com.hk/sites/default/files/net_file_store/HKEX4476_3828_VER37460.pdf.

[57] Id. at 2.

[58] Hong Kong Exchanges and Clearing Ltd., Corporate Governance Guide for Boards and Directors (May 2025) at 21, 46, 48, 50, 52–55, available at https://www.hkex.com.hk/-/media/HKEX-Market/Listing/Rules-and-Guidance/Corporate-Governance-Practices/Updated_CG_Guide_2025.pdf.

[59] Id. at 50.

[60] Id. at 51.

[61] Id. at 50.