France's Sapin II (and Loi Waserman), explained

An amendment to an existing law, not a law built from scratch

The EU Whistleblowing Directive — Directive (EU) 2019/1937 — requires companies with 50 or more staff across the EU to give employees a protected, internal way to report wrongdoing; see the Directive, explained for the full baseline every member state builds on.

France already had a whistleblowing framework — Sapin II (Loi n° 2016-1691), from 2016 — years before the Directive existed. Its Article 8 already required legal entities (public and private) with 50 or more employees to run an internal reporting procedure, under a 2017 implementing decree. Rather than replace any of that when the Directive arrived, France amended Sapin II in place through what's universally referred to as Loi Waserman: an ordinary law (n° 2022-401) and a companion organic law (n° 2022-400) strengthening the Défenseur des Droits' role, both dated 21 March 2022. Loi Waserman's substantive provisions took effect on 1 September 2022, with a new implementing decree (n° 2022-1284, in force from 5 October 2022) replacing the 2017 one and setting out what an internal procedure has to look like in practice.

What Loi Waserman actually changed

Three changes matter most for a company standing up or reviewing a channel today:

• No more mandatory internal-first routing. Before Waserman, a reporter generally had to try the internal channel before going external. Waserman removed that hierarchy: a reporter can now choose freely between reporting internally, or going straight to an external authority (the Défenseur des Droits, a judicial authority, or a relevant EU body), or — in narrower circumstances — public disclosure. A company can no longer assume every report will land internally first.
• Facilitators are protected too, and more broadly than the Directive requires. The Directive protects a facilitator only where they're a natural person assisting a reporter in a work context. Waserman goes further, extending the same protection to non-profit legal entities that help someone report — a union or an NGO assisting a whistleblower is itself covered, not just the individuals inside it.
• The abuse-of-process fine doubled. Bringing an abusive or dilatory legal action against a whistleblower to silence them already carried a civil fine under the original Sapin II. Waserman raised the ceiling on that fine from €30,000 to €60,000 (Art. 13 II) — see below.

Consulting the CSE first, and who else this applies to

Two practical details worth knowing before standing up a channel in France:

• The CSE has to be consulted before the procedure is finalised. This traces back to Article 8(1) of the Directive itself, which requires member states to ensure channels are established following social-partner consultation — see what a compliant channel actually requires for that EU-wide baseline. France implements it concretely through the 2022 implementing decree, which requires consulting the Comité Social et Économique (CSE) — or the equivalent social-dialogue body for a public entity — on how the internal procedure will work, before it's put in place, not after. Skipping that step isn't a formality gap; it's a real procedural defect in how the channel was set up.
• The public sector is covered too, with one carve-out. The decree applies to public legal entities with at least 50 agents — the same headcount line as the private sector — except municipalities with fewer than 10,000 inhabitants, which fall outside the obligation entirely.

Can we just use an email address?

The rules don't rule it out. Decree 2022-1284 lets the internal procedure take reports in writing or orally (Art. 4), and requires it to guarantee the integrity and confidentiality of what's reported, including the identity of the reporter, the people named and any third party, and to block access by staff who aren't authorised (Art. 6). A dedicated address that only the designated handlers can open can meet that. A shared mailbox that administrators, archives and forwarding rules can also reach is much harder to defend. See is an email inbox a compliant whistleblowing channel? for what an inbox needs to pass, and can you use Google Forms as a whistleblowing channel? for the form-based alternative.

The penalties, and who enforces them

Article 13 of Sapin II sets two separate financial consequences, aimed at different conduct:

• Obstructing a report. Anyone who obstructs, in any way, the transmission of a report faces up to 1 year's imprisonment and a €15,000 fine (Art. 13 I). For a company rather than an individual, French criminal law's standard multiplier for legal entities applies (Code pénal, Art. 131-38): up to five times the individual maximum, so up to €75,000.
• Bringing a bad-faith case against a whistleblower. Separately, a civil fine of up to €60,000 can be imposed on anyone who brings an abusive or dilatory action against a person because of what they reported or disclosed (Art. 13 II) — on top of, not instead of, any damages the whistleblower is separately awarded.

Outside the company, the Défenseur des Droits (Defender of Rights) is the main port of call for a reporter going external. Its role isn't to investigate every report itself — where the subject matter belongs to a specialist regulator instead, it redirects the reporter there. Separately, Article 14-1 (added by Loi Waserman) lets a competent authority grant a reporter psychological support, and temporary financial assistance where reporting has seriously damaged their finances — a discretionary measure an authority can grant, not an automatic entitlement.

What this means if you're comparing FR to another member state

The headline numbers here — €15,000 and up to a year in prison — are smaller than they might sound next to Germany's up to €50,000 administrative fines, but the two aren't measuring the same thing: France's is a criminal penalty for a person who actively obstructs a report, not an administrative fine on the company for a process gap. Don't read a lower number as a lower bar — the removal of mandatory internal-first routing means a mishandled internal channel is more likely to just get bypassed here than in a jurisdiction that still expects reporters to try internally first.

Legal basis

• Article 8, Loi n° 2016-1691 (Sapin II) — the original 50-employee internal-procedure obligation.
• Article 13, Loi n° 2016-1691 (Sapin II), as amended — the obstruction penalty and the abuse-of-process civil fine.
• Loi n° 2022-401 du 21 mars 2022 ("Loi Waserman") — the amending law, including the removal of mandatory internal-first routing and the extended facilitator protection.
• Art. 131-38, Code pénal — the standard ×5 multiplier applying an individual criminal fine to a legal entity.
• Art. 8(1), Directive (EU) 2019/1937 — the EU-wide baseline requiring social-partner consultation, which France implements through the CSE consultation requirement below.
• Article 14-1, Loi n° 2016-1691, as amended — psychological support and discretionary temporary financial assistance for a reporter, granted by a competent authority.
• Décret n° 2022-1284 du 3 octobre 2022 — the implementing decree for internal reporting procedures: Art. 1 sets the public-sector scope (50-agent threshold, excluding municipalities under 10,000 inhabitants), Art. 3 requires consulting the CSE, or equivalent social-dialogue body, before finalising the procedure, Art. 4 lets the procedure take reports in writing or orally, and Art. 6 requires integrity, confidentiality and no access for unauthorised staff.