Internal Reporting Officer
Confidential intake of whistleblower reports, case handling within the 3-month HinSchG deadline, retaliation monitoring. Independent from management reporting lines.
HinSchG · EU Whistleblower Directive
Talk to us about Internal Reporting Officer
Three lines and you are in our inbox. We reply within one business day.
What is the Internal Reporting Officer?
The Internal Reporting Officer (in German Beauftragter interne Meldestelle, often called whistleblowing officer) is the person designated under § 14 of the German Whistleblower Protection Act (HinSchG) to operate an internal reporting channel. The HinSchG entered into force on 02.07.2023 and transposed EU Directive 2019/1937 of 23.10.2019 into German law. It protects natural persons who, in a work-related context, obtain and report information about legal breaches. The material scope under § 2 HinSchG covers criminal offences, certain administrative offences (in particular those protecting life and health), AML, tax, consumer, environmental and data protection rules, plus sector-specific EU law such as financial services, product safety and anti-money laundering.
The appointment obligation under § 12 HinSchG covers employers with 50 or more employees. The deadline for companies with 250 or more employees was 02.07.2023; for companies between 50 and 249 employees the deadline was 17.12.2023. Regardless of headcount, § 12 Para. 3 HinSchG obliges investment services firms, exchange operators, institutions supervised under KWG and WpIG, capital management companies, insurance undertakings and crypto and payment institutions. For corporate groups, § 14 Para. 2 HinSchG allows a shared body only to private employers with as a rule 50 to 249 employees. A subsidiary that falls under § 12 HinSchG in its own right stays obliged, because entrusting a third party, the parent company included, does not discharge that duty under § 14 Para. 1 sentence 2 HinSchG.
Under § 16 HinSchG, the officer receives reports orally, in writing or in person on request, acknowledges receipt within 7 days, examines the report, takes follow-up action and provides feedback to the reporting person within 3 months. Confidentiality of identity is mandatory under § 8 HinSchG, including towards supervisors and other shareholders. The retaliation ban under § 36 HinSchG reverses the burden of proof: any disadvantage suffered after a report is presumed to be retaliation unless the employer proves the contrary. Under § 16 Para. 1 sentence 4 HinSchG the internal reporting body should process anonymous reports, while sentence 5 states expressly that there is no obligation to design the channel so that anonymous submissions are possible.
Duties of the internal reporting officer
- Operate the reporting channel under § 16 HinSchG for oral, written and in-person reports.
- Acknowledge receipt to the whistleblower within 7 days under § 17 Para. 1 No. 1 HinSchG.
- Examine plausibility, investigate the facts and take appropriate follow-up action under § 18 HinSchG.
- Provide feedback to the whistleblower on follow-up within 3 months under § 17 Para. 2 HinSchG.
- Preserve confidentiality of the whistleblower, the subjects of the report and third parties under § 8 HinSchG.
- Document every report and follow-up under § 11 HinSchG and delete the documentation three years after the procedure closes (§ 11 Para. 5 HinSchG).
- Maintain the GDPR Article 30 records of processing and, where relevant, the DPIA.
- Train staff on the existence of the channel and protection from retaliation.
- Interface with the external reporting body at the Federal Office of Justice (BfJ) under § 19 HinSchG and with BaFin in the financial sector.
- Provide an annual activity report to management covering risk analysis and recommendations.
Appointment, expertise and deadlines
The appointment obligation flows from § 12 HinSchG. Employers with 250 or more employees had to set up an internal reporting channel by 02.07.2023; employers with 50 to 249 employees by 17.12.2023. Missing the 17.12.2023 deadline can attract a fine of up to 20,000 EUR under § 40 Para. 2 No. 2 in conjunction with Para. 6 HinSchG. § 12 Para. 3 HinSchG obliges certain employers regardless of size: investment services firms and data reporting service providers under WpHG, exchange operators, institutions under KWG and WpIG, capital management companies under KAGB, insurance undertakings under VAG, plus crypto and payment institutions. Listed companies under § 264d HGB are not on that list; for them the 50-employee threshold applies. In groups, § 14 Para. 2 HinSchG allows a shared body only to private employers with as a rule 50 to 249 employees; a subsidiary obliged in its own right cannot hand the duty over, because entrusting a third party does not discharge it under § 14 Para. 1 sentence 2 HinSchG.
§ 15 Para. 2 HinSchG requires the employer to ensure that the persons entrusted with the task possess the necessary expertise (Fachkunde). The legislator's explanatory memorandum specifies knowledge of procedural law (investigation methods, evidence preservation), data protection under GDPR and the relevant substantive law (employment, compliance, AML, tax, anti-bribery). Recognised trainings are offered by TÜV, DGCS, the German Compliance Association and specialised law firms; certification is not mandatory. Under § 15 Para. 1 HinSchG the reporting body acts independently and may take on other tasks as long as no conflicts of interest arise; a dual role with HR, legal or compliance leadership therefore only holds up where escalation routes are documented. External appointment is expressly permitted under § 14 Para. 1 sentence 1 HinSchG and is the default solution in the German mid-market. The engagement is recorded in writing; under § 14 Para. 1 sentence 2 HinSchG the employer itself remains bound to take suitable measures to stop a breach.
- Employers with 50 or more employees (§ 12 HinSchG), deadlines 02.07.2023 (250+) and 17.12.2023 (50 to 249).
- Institutions under KWG and WpIG, investment services firms under WpHG, insurers under VAG, KVGs under KAGB plus crypto and payment institutions regardless of size (§ 12 Para. 3 HinSchG).
- Exchange operators and data reporting service providers regardless of size (§ 12 Para. 3 Nos. 2 and 3 HinSchG).
- Orders by the external reporting body at the Federal Office of Justice under § 19 HinSchG.
- Subsidiary obliged in its own right under § 12 HinSchG: entrusting the parent company does not discharge it (§ 14 Para. 1 sentence 2 HinSchG).
- Sector overlays: AML whistleblowing channel under § 6 Para. 5 GwG, MaRisk AT 4.4.3 for banks.
Sectors with mandatory reporting channels
- Banks, savings banks, cooperatives and investment firms
- Insurers, pension funds and asset managers
- Industrial companies with 50+ employees (machinery, chemicals, automotive)
- Capital management companies, exchange operators and data reporting service providers
- Hospitals, outpatient centres and care groups
- Public administration and municipal entities
- Education and research above 50 employees
- Group structures whose German subsidiaries are obliged in their own right
- Foundations and non-profits above 50 employees
- Crypto service providers and fintechs under MiCAR
How CIVAC supports the internal reporting officer
CIVAC operates an HinSchG-compliant reporting channel with end-to-end encryption, anonymous reporting options and structured case management. Incoming reports are auto-acknowledged within the 7-day deadline under § 17 Para. 1 No. 1 HinSchG and the 3-month feedback deadline under § 17 Para. 2 HinSchG is enforced as a mandatory field. The workspace maintains the Article 30 GDPR records automatically, documents follow-up actions in an audit-grade trail and carries out the deletion three years after a case closes under § 11 Para. 5 HinSchG. Role separation (officer, deputy, legal back-office) and a closed data room prevent unauthorised access. Group setups can host several subsidiaries without replacing the subsidiary's own duty under § 12 HinSchG. An external HinSchG officer via CIVAC can be appointed within 48 hours with the channel live.
Frequently asked questions about the HinSchG channel
This page explains the duty. If you have already decided to hand the work over, these are the services that carry it.
Need this officer role for your organisation?
Appoint our experts as your external officer or license CIVAC for your in-house team. Get in touch and we walk you through the right setup.