Whistleblowing: the reporting channel, managed outside the company
Legislative Decree 24/2023 requires a large share of companies to have an internal channel for reporting wrongdoing, which protects the identity of the whistleblower and is managed by someone autonomous. We provide the channel, take on the role of external manager and prepare the documents needed.
Who is required
In the private sector, the following must set up an internal channel:
companies that in the last year employed on average at least 50 employees, on fixed-term or permanent contracts;
below that threshold, those operating in the sectors regulated by the European acts referred to in the decree (financial services, prevention of money laundering and terrorist financing, transport safety, environmental protection);
below that threshold, those that have adopted a 231 organisational model; in this case reports normally concern conduct relevant under Legislative Decree 231/2001 and breaches of the model.
The obligation has applied since 15 July 2023 for companies with more than 249 employees and since 17 December 2023 for those with between 50 and 249.
What is needed
A written channel and an oral one, plus a face-to-face meeting when the whistleblower requests it. For the written channel, the ANAC Guidelines indicate a dedicated IT platform as preferable; ordinary email and PEC are not considered adequate to protect the identity of the whistleblower.
Confidentiality of the identity of the whistleblower, of the persons involved and of the content, including by means of encryption.
An autonomous and trained manager: a dedicated person or internal office, or an external party. The Guidelines also ask that it be decided in advance how to handle conflicts of interest, for example with a substitute.
Consultation with the trade union representatives before activating the channel: they must be heard, but their opinion is not binding.
Clear information on how, to whom and under what conditions to report, displayed in the workplace and published on the website.
Up to 249 employees, the decree also allows the channel and its management to be shared between several companies.
The path of a report, from receipt to feedback.
Timing and fines
Step
Deadline
Acknowledgement of receipt to the whistleblower
Within 7 days of receipt
Feedback on the outcome or on the status of the checks
Within 3 months of the acknowledgement of receipt
ANAC can impose fines from €10,000 to €50,000 when the channel has not been set up, when procedures are missing or not compliant, when the reports received are not checked, as well as for retaliation, obstruction of reporting and breaches of confidentiality.
Service
Our service
The company publishes the link to the channel on its website; anyone who wants to report does so from there, in writing or by asking for an oral contact. Reports reach us as the designated external manager, not someone inside the company.
Each company’s reports are kept separate and are encrypted with the company’s own key, stored outside the platform. Cases are followed in Prometeo, with the acknowledgement and feedback deadlines kept under control.
When we also work with the same company as CISO, the handling of reports is entrusted to a separate external professional, with a substitute already designated, to keep the roles apart.
Written reporting platform and oral channel, with a meeting on request
Appointment as external manager of reports, with a substitute in case of conflict of interest
Whistleblowing procedure and information text for the website and the workplace
Privacy notice, data protection impact assessment (DPIA) and appointments
Note for the trade union representatives
Coordination with the 231 model and the Supervisory Body, where present
Training for staff and for those who receive reports
Method
How to start
For a company that does not have the channel, or has entrusted it to an email inbox, a few steps are enough. If the channel already exists, we start from a check of what is in place against the decree and the ANAC Guidelines.
Check: obligation, scope of reports, any 231 model
Documents: procedure, privacy notices, DPIA, note to the trade unions
Activation: channel configured, keys handed over, link on the website
Training: staff and top management
Management: receipt, acknowledgement within 7 days, checks, feedback within 3 months
Sources
Legislative Decree no. 24 of 10 March 2023, Articles 2, 4, 5, 13, 14, 21 and 24; ANAC Guidelines no. 1/2025 on internal reporting channels, approved by resolution no. 478 of 26 November 2025.
The channel is already mandatory
Tell us how many employees you have and whether you have a 231 model. We will tell you whether the obligation applies to you and how to activate the channel.
