The whistleblowing channel at a law firm: which firms must have one and how it must work under Law 2/2023

Firms often advise their clients on how to set up a whistleblowing channel. But some of them must also have their own. Law 2/2023 of 20 February, regulating the protection of people who report regulatory infringements and the fight against corruption, makes no distinction between a factory and a law firm: what counts is the number of workers.

Which firms are obliged

Article 10.1 lists the private-sector entities that must have an internal reporting system:

• Letter a): private-sector individuals or legal entities with 50 or more workers.
• Letter b): legal entities in certain sectors regulated by EU law, such as financial services, products and markets, or the prevention of money laundering, regardless of the number of workers.
• Letter c): political parties, trade unions, employers' organisations and their foundations, if they receive or manage public funds.

In a firm, the first letter to check is a). Those that carry out activities subject to anti-money laundering rules, which we explain in the guide to anti-money laundering at law firms, should analyse with their adviser whether letter b) may apply to them.

System requirements (Article 5)

• Its implementation is the responsibility of the management or governing body, after consulting workers' representatives.
• It must guarantee the confidentiality of the whistleblower's identity.
• It must allow reports in writing, verbally or both.
• It must have a system officer, a policy that is made known and a management procedure.

Internal or external management (Article 6)

The system can be managed within the firm or entrusted to an external third party, who handles receipt of the reports. The third party must offer guarantees of independence, confidentiality, data protection and secrecy of communications. Outsourcing it does not reduce the law's guarantees or shift responsibility for the system to anyone other than the officer in charge.

The system officer (Article 8)

• Appointed by the management or governing body.
• Their appointment and removal must be notified to the Independent Authority for Whistleblower Protection within ten working days.
• Must act independently and without receiving instructions.
• In the private sector, the law provides that, as a general rule, it be a manager of the entity.

The Independent Authority has its Statute, approved by Royal Decree 1101/2024 of 29 October.

Procedure deadlines (Article 9.2)

A whistleblowing channel inside a law firm

A firm handles client information protected by professional secrecy. The design of the channel must take this into account:

1. Define the scope. The system is for reporting infringements within the organisation. It is wise to explain in the policy how reports that refer to client matters are handled.
2. Choose the officer well. They must have real independence from the partners who run the areas concerned.
3. Protect the data. Access to reports must be limited to those who handle them.
4. Document the deadlines. The acknowledgement at seven days and the response within three months must be recorded.
5. Train staff, including associates and support personnel.

The whistleblowing channel is part of a set of obligations of the firm as an employer, together with those on pay transparency. More internal organisation guides in Big law firms and lateral moves.