Whistleblowing: Germany's HinSchG and the legal position in Switzerland

Short answer: In Germany, employers with, as a rule, at least 50 employees must set up an internal reporting channel; certain financial services and investment firms must do so regardless of size (Section 12 of the Whistleblower Protection Act, Hinweisgeberschutzgesetz or HinSchG). The internal reporting office acknowledges receipt of a report within seven days and gives feedback on follow-up action within three months (Section 17 HinSchG); failing to set up or operate a reporting office can lead to a fine of up to EUR 20,000. Switzerland, by contrast, has no general whistleblowing law for the private sector; whether a report was permissible is decided by the courts case by case on the basis of the employee's duty of loyalty.

This article is for heads of compliance, general counsel and HR leaders with entities in Germany and Switzerland. It covers when whistleblowing obligations in Germany apply, the legal position in Switzerland, how to handle reports within the deadlines and how much capacity case handling requires.

Germany: obligations under the Whistleblower Protection Act

The HinSchG implements the EU Whistleblowing Directive (EU) 2019/1937 and has applied since 2 July 2023 (Federal Law Gazette 2023 I No. 140). It requires employers with, as a rule, 50 or more employees to operate an internal reporting office; companies with 50 to 249 employees had until 17 December 2023 to set one up (Section 42 HinSchG).

Reporting channels

• Employees and agency workers assigned to the company must be able to report breaches through the channels; the channel may also be opened to other people in professional contact with the company (Section 16(1) HinSchG).
• Reports must be possible orally or in text form. On request, a face-to-face meeting must be offered within a reasonable time, or by video with consent (Section 16(3) HinSchG).
• The reporting office should also process anonymous reports; there is no obligation to set up channels that allow anonymous reporting (Section 16(1) HinSchG).
• Only the responsible staff and those supporting them may access incoming reports (Section 16(2) HinSchG).

Organisation

• The reporting office can be one person, a unit or an appointed third party. The duty to remedy breaches stays with the company (Section 14(1) HinSchG).
• Several private employers with 50 to 249 employees may run a joint office; follow-up action and feedback remain the responsibility of each individual employer (Section 14(2) HinSchG).
• Whistleblowers may choose between internal and external reporting. Companies should encourage internal reporting and explain the procedure clearly, without making external reporting harder (Section 7 HinSchG). The federal external reporting office is located at the Federal Office of Justice (Section 19 HinSchG).

Protection and sanctions

Retaliation against whistleblowers is prohibited. If a person suffers a professional disadvantage after a report, it is presumed to be retaliation, and the company has to prove otherwise (Section 36 HinSchG). Failing to set up or operate a reporting office can lead to a fine of up to EUR 20,000, and obstructing reports or retaliation to a fine of up to EUR 50,000 (Section 40 HinSchG). For legal entities, the maximum can be multiplied by ten under Section 30(2) sentence 3 of the Administrative Offences Act (OWiG).

Switzerland: no general law – what applies anyway

Switzerland has no general whistleblowing law for the private sector. A revision of the Code of Obligations to protect employees who report irregularities finally failed in the 2020 spring session, when the National Council rejected it for the second time. There is still no general whistleblowing law for the private sector (status: October 2026).

• Case by case instead of procedural rules: courts assess whether a report was permissible case by case, based on the employee's duty of loyalty. There are no statutory deadlines for acknowledgement or feedback.
• Financial sector supervision: the Swiss Financial Market Supervisory Authority FINMA accepts reports of possible breaches of financial market law. Employees, mandated persons and governing bodies of supervised institutions report via a secure whistleblowing platform operated by a third party; disclosing personal details is voluntary. FINMA points out that, under case law, insiders should generally report internally first.
• Groups with German entities: the HinSchG applies to a German subsidiary with, as a rule, at least 50 employees regardless of where the parent company is based. Whether a central reporting office of the Swiss group qualifies as an appointed third party under Section 14(1) HinSchG is not expressly regulated in the Act; the group should obtain legal clarification before setting it up. The duty to remedy breaches always remains with the German entity (Section 14(1) HinSchG).

Without a legal obligation, the company decides itself whether to run an internal reporting system. A voluntary system can be part of the compliance management system and bring risks to light earlier; how the building blocks fit together is described in building or refreshing a compliance management system. Companies introducing such a system can follow the German standards on deadlines and documentation so that the whole group works in the same way.

Handling reports: deadlines, documentation, follow-up

An internal reporting office in Germany must acknowledge every report within seven days, assess and document it, and give feedback within three months of the acknowledgement. A fixed process helps to meet these deadlines even at peak times.

1. Record the report: keep it permanently retrievable and confidential. Phone calls may only be recorded or transcribed verbatim with consent; otherwise a summary is made (Section 11(1) and (2) HinSchG).
2. Acknowledge receipt: within seven days (Section 17 HinSchG).
3. Check scope and substance: is the matter within scope, is the report plausible, what risks are involved?
4. Choose follow-up action: internal investigation, referral to another competent body, closure for lack of evidence, or handover to an internal investigation unit or an authority (Section 18 HinSchG).
5. Give feedback: within three months of acknowledgement, inform the whistleblower of planned and completed follow-up action (Section 17 HinSchG).
6. Close and delete: delete the documentation three years after the procedure ends, unless longer retention is necessary and proportionate (Section 11(5) HinSchG).

When a report leads to an internal investigation, the workload shifts from the reporting office to investigation teams. Which support fits then is covered in internal investigations: which support suits which task.

Capacity for case handling

The workload of a reporting office fluctuates strongly: most reports are assessed quickly, while a few trigger investigations with interviews, data review and employment law measures. It can be planned as a base load plus a reserve for peaks.

Example (assumption): base load and peaks

A company with 2,000 employees in Germany receives 40 reports a year. It allows eight hours per report for intake, assessment, documentation and feedback, which is 320 hours. Four reports lead to an internal investigation of 80 hours each, another 320 hours. The base load is therefore just over 0.4 FTE. If several investigations run at the same time, this capacity is no longer enough and the three-month deadline comes under pressure.

Typical roles are a person responsible for the reporting office, compliance officers for assessment and documentation, lawyers for investigations and employment law, and data protection support where needed. Alpinum Solutions provides such professionals through staff leasing and freelancing, part-time or full-time, as individuals or as teams; the company directs the work. Interim professionals support assessment, documentation and investigations, and the company decides how they fit into the reporting office. Agency workers can also report through the client company's channels themselves (Section 16(1) HinSchG).

Limits and risks

• People with conflicts of interest should not handle cases; confidentiality must also apply within the company's own organisation.
• Responsibility for follow-up action stays with the company, even if a third party operates the reporting office.
• Switzerland has no statutory guard rails. Internal rules should therefore state clearly who handles reports and how whistleblowers are protected.
• Alpinum is not a law firm and does not provide legal advice. Whether a report or a measure is legally permissible should be clarified with the legal department or external advisers.

Frequently asked questions about internal reporting channels and whistleblowing

From how many employees is a reporting office mandatory?

In Germany, employers with, as a rule, at least 50 employees must set up an internal reporting office (Section 12 HinSchG). Certain financial services and investment firms are obliged regardless of size. For companies with 50 to 249 employees the duty has applied since 17 December 2023. In Switzerland there is no general statutory duty.

Can the reporting office be outsourced?

Yes. Under Section 14(1) HinSchG a company may appoint a third party, such as a law firm or a specialised provider, to perform the tasks of the internal reporting office. The duty to remedy breaches, however, stays with the company. Companies with 50 to 249 employees may also run a joint office with other employers (Section 14(2) HinSchG).

Do anonymous reports have to be processed?

The HinSchG provides that the internal reporting office should also process anonymous reports. There is no obligation to design channels that allow anonymous reporting (Section 16(1) HinSchG). Companies that offer anonymous channels need a way to ask follow-up questions and give feedback without revealing the whistleblower's identity.

Is a reporting office mandatory in Switzerland?

No, there is no general statutory duty for the private sector. The revision of the Code of Obligations on whistleblowing failed in the National Council in 2020. Whether an employee's report was permissible is assessed by the courts case by case based on the duty of loyalty. Swiss groups with German entities of 50 or more employees must, however, comply with the HinSchG for those entities.

Which deadlines apply to handling a report?

In Germany the internal reporting office acknowledges receipt within seven days and gives feedback on planned and completed follow-up action within three months of the acknowledgement (Section 17 HinSchG). The documentation is deleted three years after the procedure ends, unless longer retention is necessary (Section 11 HinSchG).

Next step

If your reporting office needs additional support or a report leads to an internal investigation, talk to us about your requirements. Selected profiles are usually available within 48 hours; the start date is agreed jointly by the company and Alpinum.

• Litigation, investigations and eDiscovery with interim professionals
• Interim compliance: compliance officers for vacancies and projects
• Internal investigations: which support suits which task
• Discuss your requirements

Last updated: 30 October 2026.