Internal reporting office without a threshold: the nine categories in § 12 (3) HinSchG

Key takeaways

• § 12 (3) HinSchG opens with the words: Abweichend von Absatz 2 gilt die Pflicht nach Absatz 1 Satz 1 unabhängig von der Zahl der Beschäftigten.
• The catalogue has nine items, predominantly from the banking, securities, insurance and crypto sectors.
• Each item refers to a supervisory definition in a different statute; classification follows the licensing position, not self-description.
• The test starts with the catalogue and only then moves to headcount.
• In a group the test runs per company, because § 12 (2) HinSchG ties counting to the word jeweils, meaning in each case.

The sentence that suspends the arithmetic

§ 12 (2) HinSchG reads: Die Pflicht nach Absatz 1 Satz 1 gilt nur für Beschäftigungsgeber mit jeweils in der Regel mindestens 50 Beschäftigten. That figure is the known quantity, and it sorts the market: anyone below it counts as not affected.

§ 12 (3) HinSchG puts four words in front of that sorting which suspend it for part of the addressees. The paragraph opens: Abweichend von Absatz 2 gilt die Pflicht nach Absatz 1 Satz 1 unabhängig von der Zahl der Beschäftigten. A list of nine items follows.

For the companies concerned this is not a nuance. A payment institution with twelve employees is subject to the same duty as an industrial group: at least one office for internal reports, set up and operated.

The nine items

§ 12 (3) HinSchG names, in order:

1. 1investment services enterprises within the meaning of § 2 (10) of the Securities Trading Act,
2. 2data reporting services providers within the meaning of § 2 (40) of the Securities Trading Act,
3. 3stock exchange operators within the meaning of the Stock Exchange Act,
4. 4institutions within the meaning of § 1 (1b) of the Banking Act and institutions within the meaning of § 2 (1) of the Investment Firm Act,
5. 5counterparties within the meaning of Article 3 no. 2 of Regulation (EU) 2015/2365,
6. 6capital management companies under § 17 (1) of the Capital Investment Code,
7. 7undertakings under § 1 (1) of the Insurance Supervision Act, excluding undertakings operating under §§ 61 to 66a of that Act with their seat in another Member State of the European Union or another contracting state of the Agreement on the European Economic Area,
8. 8institutions within the meaning of § 2 (4) of the Crypto Markets Supervision Act, and
9. 9institutions within the meaning of § 1 (3) of the Payment Services Supervision Act.

The seventh item deserves particular attention, because it is the only one carrying an exception. It covers undertakings under § 1 (1) of the Insurance Supervision Act, excluding those operating under §§ 61 to 66a of that Act with their seat in another EU Member State or another EEA contracting state.

Every item points at a definition elsewhere

The catalogue does not describe activities; it refers to terms defined in other statutes. The test therefore does not happen inside the Whistleblower Protection Act but in the supervisory law it invokes. That is the actual work, and it is counter-intuitive in several places.

• Whether a company is an institution within the meaning of § 1 (1b) of the Banking Act is decided by its supervisory classification and licensing position, not by its company name or its description in the commercial register.
• Whether a company is a capital management company under § 17 (1) of the Capital Investment Code turns on the management of investment funds, an activity that is also carried on with a very small headcount.
• Whether a provider is an institution within the meaning of § 2 (4) of the Crypto Markets Supervision Act turns on the crypto asset services it provides; this item captures a class of company that did not exist when some compliance manuals were written.
• Whether a payment service provider is an institution within the meaning of § 1 (3) of the Payment Services Supervision Act follows its authorisation under that Act and not the size of its business.
• Item 5 does not point at German law at all but directly at a European definition, Article 3 no. 2 of Regulation (EU) 2015/2365.

The reversed test order

From the relationship between paragraph 2 and paragraph 3 follows a test order that runs against common practice. Common practice is: count first, then decide. Correct is: check the catalogue first, then count.

The reason lies in the word abweichend, notwithstanding. Paragraph 3 is an exception to paragraph 2, not an addition to it. Where paragraph 3 applies, headcount is irrelevant to whether the duty exists, and establishing it answers nothing. Anyone proceeding the other way round reaches the wrong result for every small catalogue company, by means of arithmetic that is correct in itself.

That is why the question does not belong in HR but in the legal or supervisory function. Headcount is a personnel fact; membership of the catalogue is a supervisory classification.

Groups: the test runs per company

§ 12 (2) HinSchG ties counting to the word jeweils: the duty applies to employers with, in each case, normally at least 50 employees. Counting therefore runs per employer and not across a group. The catalogue in paragraph 3 operates on the same level: the items describe undertakings, not groups.

In mixed structures that produces a result which looks like it needs explaining and is correct. A holding company with one regulated subsidiary of twenty employees and three unregulated sister companies of thirty each has exactly one duty to operate an internal reporting office, and it falls on the smallest of the four.

For implementation that does not mean four channels have to be built. § 14 (1) HinSchG expressly permits a third party to be entrusted with the tasks of an internal reporting office, and a group can award that task centrally for the company under the duty. What does not work is discharging the duty by having a different group company operate a reporting office while the company under the duty has none.

In context

§ 12 (3) HinSchG is not a marginal provision but a question of which function owns the analysis. It moves the applicability test out of personnel statistics and into supervisory law, making it a task that has to be answered cleanly once and then asked again on every change of licence, shareholding and business model.

In practice a short, dated finding per company carries it: which item applies, which does not, on what basis, checked when. Where no item applies, counting under § 12 (2) HinSchG governs. Where one applies, counting is unnecessary and the duty is settled.

CIVAC is not a law firm and provides no legal services within the meaning of the German Legal Services Act (Rechtsdienstleistungsgesetz). This article sets out the wording and describes how the duty can be organised. The legal assessment of your individual case belongs to your legal department or your external counsel.

FAQ

Who must operate an internal reporting office regardless of headcount?

§ 12 (3) HinSchG names nine categories: investment services enterprises under § 2 (10) of the Securities Trading Act, data reporting services providers under § 2 (40) of that Act, stock exchange operators under the Stock Exchange Act, institutions under § 1 (1b) of the Banking Act and institutions under § 2 (1) of the Investment Firm Act, counterparties under Article 3 no. 2 of Regulation (EU) 2015/2365, capital management companies under § 17 (1) of the Capital Investment Code, undertakings under § 1 (1) of the Insurance Supervision Act with the exception stated there, institutions under § 2 (4) of the Crypto Markets Supervision Act, and institutions under § 1 (3) of the Payment Services Supervision Act.

Does the 50 employee threshold not apply to these companies at all?

Not for the question of whether the duty exists. § 12 (3) HinSchG opens with the words: Abweichend von Absatz 2 gilt die Pflicht nach Absatz 1 Satz 1 unabhängig von der Zahl der Beschäftigten. The figure retains significance for other questions, for example for the shared office under § 14 (2) HinSchG, which the Act opens to private employers with normally 50 to 249 employees.

How do you test whether one of the nine items applies?

Not in the Whistleblower Protection Act but in the statute it invokes. Each item refers to a definition elsewhere, for instance to § 1 (1b) of the Banking Act, to § 17 (1) of the Capital Investment Code or to Article 3 no. 2 of Regulation (EU) 2015/2365. What governs is the supervisory classification and the licensing position, not the company's self-description. The test therefore belongs in the legal or supervisory function rather than in personnel statistics.

How is counting done within a group?

Per company. § 12 (2) HinSchG speaks of employers with, in each case, normally at least 50 employees, and the word jeweils ties counting to the individual employer. The catalogue in § 12 (3) HinSchG likewise describes undertakings and not groups. A group may entrust the tasks of the internal reporting office centrally to a third party under § 14 (1) HinSchG, but it cannot discharge the duty of the company concerned by having another company operate a reporting office.

Does anything else change for catalogue companies?

§ 12 (3) HinSchG changes whether the duty exists, not what it contains. The same organisational forms under § 14 HinSchG apply, and the same requirement of independence and necessary expertise under § 15 HinSchG, as for any other employer under the duty.