The deadline for implementing the EU’s Whistleblowing Directive has been and gone and Member States at various stages implementing it. So, given there will inevitably be variations between jurisdictions, how should multinational businesses with a presence across different EU countries address that issue given that a ‘one-size-fits-all approach’ to whistleblowing reporting is not going to work. We will come to that shortly.

Since 17 December companies with 50 or more workers are meant to have in place appropriate reporting channels and procedures, depending on where they operate. They’ve had two years to do that but few have made any meaningful progress, and some have not even started. The Directive aims to provide common minimum standards of protection across the EU to whistleblowers who raise breaches of EU law with their employer and the scope of the protection is very wide, as you might expect. It includes reports about public procurement matters, financial services, products and markets, money laundering, the environment, personal data, IT systems, the list goes on.

The UK has, of course, left the EU and the government has said the UK will not be updating its domestic laws. Nonetheless, multinational firms with UK headquarters will either have to reflect the changes in their global whistleblowing policy, or choose to adopt a jurisdiction-by-jurisdiction approach. The European Commission has indicated, in clear terms, that this will preclude reliance on a central...