The Whistleblowing Decree one month after the entry into force of the obligation to adopt internal reporting channels, 26 January 2024
The Legislative Decree No. 24/2023 ('Whistleblowing Decree') required SMEs to adopt internal reporting channels by 17 December 2023. One month after the entry into force of this obligation, although there are still no official figures, many Italian SMEs seem not to have yet complied to the provisions of the Decree.
Below there is an overview of the main topics covered by the Whistleblowing Decree, with particular reference to its obligations, their recipients, as well as the benefits/risks arising from compliance or non-compliance with its provisions.
Recipients of the Decree
All the following private sector entities are required to comply with the provisions of the Whistleblowing Decree. In particular:
- for large companies (at least 250 employees), the compliance obligation became effective on 15 July 2023;
- for SMEs (between 50 and 249 employees), the compliance obligation became effective on 17 December 2023;
- for companies that have adopted an organisational management model pursuant to the Legislative Decree No. 231/2001, the deadline for compliance varies depending on the number of employees.
Obligations under the Whistleblowing Decree
With reference to the obligations provided, the companies involved are required to:
- set up an internal channel enabling whistleblowers to submit, in complete confidentiality, written and/or oral reports of unlawful conduct;
- identify adequately trained internal/external resources for handling whistleblowers' reports;
- adopt and formalise appropriate procedures for handling the reports;
- inform the users of this channel of the prerequisites for sending reports and the related handling procedures.
Report handling procedure
The necessary steps for the best handling of whistleblowers’ reports include: (i) proper documentation of the report; (ii) submission to the whistleblower of an acknowledgement of receipt of the report within the next 7 days; (iii) proper investigation on the case; (iv) submission of a feedback to the whistleblower within 3 months from the submission of the acknowledgment of receipt; (v) keeping the documentation for the time necessary to handle the report (maximum term: 5 years).
A precise formalisation of each of the above steps can make the procedures easier to manage and monitor.
The prerequisites for reporting
The prerequisites for making a report are varied and manifold, ranging from bribery to harassment and discrimination, from money laundering and the financing of terrorism to the protection of the environment and health and safety in the workplace. In addition, the Whistleblowing Decree also includes final provisions aimed at extending its scope to other administrative, accounting, civil or criminal offences.
Benefits
The advantages and benefits that derive from the adoption of these internal whistleblowing systems have an impact on the prevention and prompt contrast of illicit activities.
This, of course, ensures greater respect for corporate ethical principles, promoting within the company a transparent corporate culture.
Moreover, it should certainly not be overlooked that the Whistleblowing Decree has also provided the whistleblowers with protective measures, prohibiting any form of retaliation against them.
However, whistleblowers’ protection is mitigated by a series of sanctions aimed at preventing and repressing any abuses deriving from bad faith reporting.
Risks and sanctions
The main risks related to the failure to set up an internal reporting channel include administrative sanctions ranging from 10,000 to 50,000 EUR. In addition, where no internal reporting channel has been set up, the whistleblower will also have the option of submitting her/his report to the ANAC (National Anti-Bribery Authority).
Another circumstance allowing the whistleblower to externally forward her/his report to the ANAC is the failure to promptly respond to a report previously submitted through the internal channel.
In the event of non-compliance, therefore, prompt action may help in the imposition of lower sanctions or in preventing external reports potentially bearing greater risks.