Spain's Ley 2/2023, explained

A law that reaches further than the Directive itself

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

Spain transposed the Directive through Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción — a title that translates roughly to "the law protecting people who report regulatory infringements and fighting corruption." Published in the BOE on 21 February 2023, it took effect 20 days later, on 13 March 2023. Where it earns its own guide is that its scope isn't limited to breaches of EU law the way the Directive's own baseline is: Article 2.1.b extends the same protected-reporting framework to acts or omissions that could amount to a serious or very serious criminal or administrative infraction under purely domestic Spanish law — corruption and public-integrity matters well outside what Brussels required member states to cover. A report doesn't have to touch EU law at all to qualify for protection here.

The same 50-employee line, a later date for smaller companies

Article 10.1.a sets the same threshold as the Directive's own floor: private-sector entities with 50 or more employees are obligated to run an internal reporting system (see the 50-employee threshold, explained for how that line works generally). The compliance date split by size, though: entities with 250 or more employees had to have their channel ready by 13 June 2023 — three months from the law's entry into force. Entities with 50 to 249 employees got the extended runway the Directive itself allows member states to grant (Art. 26(2)), running to 1 December 2023 — a couple of weeks earlier than the equivalent German deadline of 17 December 2023, but the same underlying idea: smaller companies got extra time to stand a channel up.

Anonymous reporting: required, not just permitted

This is the sharpest contrast with Germany's approach. Article 7.3 states that internal channels "permitirán incluso la presentación y posterior tramitación de comunicaciones anónimas" — they shall permit the submission and processing of anonymous communications, not merely "should." Article 17.1 repeats the same requirement for how a report can be made. Where Germany's HinSchG treats anonymous reporting as encouraged but optional, Spain settles the Art. 6(2) question the Directive leaves open to each member state by making it mandatory: a Spanish company can't stand up a channel that only accepts identified reports and call it compliant. Provoxis doesn't treat this as a Spain-specific setting to switch on — anonymous reporting is always available to every reporter regardless of jurisdiction, see anonymous vs identified reporting, explained for how that works mechanically — but it's worth knowing that in Spain, it isn't optional even in principle.

Can we just use an email address?

Ley 2/2023 doesn't rule email out: Article 7.2 allows written reports by post or by electronic means. Two other requirements make it hard to rely on. Article 7.3 requires internal channels to accept anonymous reports, and the only way to report anonymously by email is for the reporter to create a separate, untraceable account first. Article 5.2 requires the whole system to be designed and run securely, so the reporter's identity stays confidential. An email address can be one way into the system, but on its own it's a weak answer to the anonymity requirement. See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

Consulting worker representatives before the channel is built

Article 5.1 makes the company's governing body responsible for standing up the internal system "previa consulta con la representación legal de las personas trabajadoras" — following prior consultation with workers' legal representation. This is Spain's implementation of Article 8(1) of the Directive itself, which requires member states to ensure internal channels are established following consultation with social partners where national law provides for it (see what a compliant channel actually requires for that EU-wide baseline) — the same underlying obligation that runs through works-council consultation in Germany and CSE consultation in France, each implemented through that country's own existing worker-representation structures rather than a new Ley 2/2023-specific body.

Where a violation costs you — three tiers, two sets of caps

Título IX sets out the infraction and penalty regime. Article 63 sorts violations into three tiers — leves (minor), graves (serious), and muy graves (very serious) — and Article 65 sets a separate fine scale for individuals and for legal entities:

• Individuals: €1,001–€10,000 for a leve infraction, €10,001–€30,000 for a grave one, and €30,001–€300,000 for a muy grave one.
• Legal entities: up to €100,000 for a leve infraction, €100,001–€600,000 for a grave one, and €600,001–€1,000,000 for a muy grave one — the company-level ceiling that gives this article its headline number.

For the most serious tier, a company can also face accessory sanctions on top of the fine: public reprimand (amonestación pública), loss of eligibility for public subsidies, and exclusion from public-sector contracts for up to three years under the Ley de Contratos del Sector Público. That last one matters beyond the fine itself — Ley 2/2023 also amended the public procurement law's own list of contracting prohibitions to add a final, very-serious sanction under this law as a standalone ground for exclusion.

A national authority that took two and a half years to open its doors

Título VIII creates the Autoridad Independiente de Protección del Informante (A.A.I.) as Spain's external channel — Article 42 sets out its legal nature as an independent public-law entity, and Article 43 gives it the power to manage external reports, take protective measures for reporters, and run sanctioning procedures under this law. The gap worth knowing about: the law creating the A.A.I. took effect in March 2023, but the authority itself didn't actually start operating until 1 September 2025, per Orden PJC/908/2025 — roughly two and a half years later. Its organisational statute was only approved by Real Decreto 1101/2024 in October 2024. Companies weren't left completely without external recourse in the interim (existing bodies like the Fiscalía and sector regulators still took reports), but the dedicated national whistleblower authority the law promised simply didn't exist yet for most of that period — a genuinely unusual gap by comparison with Germany's Bundesamt für Justiz or France's Défenseur des Droits, both of which were functioning institutions from day one of their respective laws.

Regional authorities can take over where a report stays local

Spain's autonomous communities can run their own equivalent external channel instead of routing through the national A.A.I. Article 24 makes a regionally designated authority competent for reports confined to that region's own public sector, its autonomous institutions, or private entities whose reported non-compliance has effects limited to that community's territory; Disposición adicional segunda lets a region instead sign an agreement letting the A.A.I. handle it on their behalf. Catalonia already had a body positioned to take this on — the Oficina Antifraude de Catalunya, given the A.A.I.-equivalent role for Catalan matters — and other communities, including Madrid, have moved to set up their own. For a company operating in a single region, that means the "competent authority" for an external report may not be the national A.A.I. at all.

How this compares to Germany's HinSchG

The headline fine numbers look similar at first glance — Spain's €1,000,000 company-level ceiling sits well above Germany's up to €500,000 for the equivalent worst case — but the more practically important difference isn't the number, it's the anonymous-reporting question. Germany leaves it as a "should"; Spain makes it a "shall." A channel design that's fully compliant in Germany without accepting anonymous reports would fall short of Article 7.3 the moment the same company operates in Spain.

Legal basis

• Ley 2/2023, de 20 de febrero (BOE-A-2023-4513) — the full text; entry into force 20 days after its 21 February 2023 BOE publication.
• Art. 2.1.b, Ley 2/2023 — the material scope extending to domestic criminal/administrative infractions, not just EU-law breaches.
• Art. 10.1.a, Ley 2/2023 — the 50-employee threshold for private-sector obligated entities.
• Art. 7.3 and Art. 17.1, Ley 2/2023 — internal channels must permit anonymous communications.
• Art. 5.2 and Art. 7.2, Ley 2/2023 — the internal system designed and run securely to protect the reporter's identity; written reports by post or electronic means, and oral reports.
• Art. 5.1, Ley 2/2023 — prior consultation with workers' legal representation before the internal system is implemented.
• Art. 63 and Art. 65, Ley 2/2023 (Título IX) — the leve/grave/muy grave infraction tiers and their corresponding fine ranges for individuals and legal entities.
• Art. 71.1.b, Ley de Contratos del Sector Público, as amended by Ley 2/2023 — very-serious infractions under this law as a standalone ground for public-contracting exclusion.
• Art. 42 and Art. 43, Ley 2/2023 (Título VIII) — the A.A.I.'s legal nature and functions.
• Orden PJC/908/2025, de 8 de agosto (BOE-A-2025-16764) — fixing 1 September 2025 as the A.A.I.'s operational start date.
• Real Decreto 1101/2024, de 29 de octubre (BOE-A-2024-22298) — approving the A.A.I.'s organisational statute.
• Art. 24 and Disposición adicional segunda, Ley 2/2023 — regional authorities' competence over region-confined reports, and the agreement mechanism letting a region defer to the A.A.I. instead.
• Art. 26(2), Directive (EU) 2019/1937 — the extended transposition deadline Spain's own 50–249-employee timeline follows.