On 16 July 2026, the French Anti-Corruption Agency (AFA) published a practical guide on internal whistleblowing mechanisms[1] , an essential tool for the compliance programs of organizations subject to the French Sapin 2 Law.
In the guide’s foreword, the Agency’s Director notes that despite a solid and precise legal framework, internal whistleblowing systems within organizations struggle to function effectively and fall short of expectations in terms of their effectiveness.
The AFA made the same observation upon the publication of its 2025 activity report, in which it noted that, with regard to integrity-related reports, there was a disparity between a decline in internal reports and a sharp increase in external reports, which were received and processed directly by the AFA[2] .
It should be noted from the outset that while the guide covers the French Sapin 2 framework (which has a very broad scope), it focuses more specifically on the whistleblowing system for integrity violations, which is the AFA’s core area of expertise. The published figures show that the overall number of internal reports is on the rise, driven in particular by the HR sector, which accounts for the majority of reports[3] .
It is, however, against this backdrop that the AFA has chosen to publish a practical guide on internal whistleblowing mechanisms within organizations. The stated objective of this guide is not to provide details on the applicable law—which is sufficiently clear—but rather to reiterate the essential principles underlying whistleblowing mechanisms and to ensure their long-term viability.
Throughout this guide, the AFA provides practical recommendations, particularly to encourage internal whistleblowing—which serves as a means of risk management for the organizations concerned—and to manage such reports effectively. It also offers advice on training and raising employee awareness to ensure the system’s continued effectiveness.
Thus, on the one hand, this AFA practical guide outlines the regulatory requirements that constitute the minimum foundation that any internal whistleblowing system must guarantee (I).
On the other hand, this guide does not overlook the practical application of the whistleblowing system for large companies, taking into account the requirements of other specific regulations, by adopting a cross-functional approach to this compliance tool (II).
I. The practical guide outlines the minimum safeguards associated with companies’ internal whistleblowing systems
As previously stated, and given the AFA’s substantive jurisdiction, the guide focuses on reports concerning breaches of integrity. The covert nature of these offenses thus places whistleblowing at the center of organizations’ priorities for detecting prohibited conduct. The AFA notes that the French Waserman Law of March 21, 2022 expanded the definition of a whistleblower, notably by removing the requirement that the individual act without personal interest[4].
The requirements set forth below constitute a minimum standard that every organization is required to meet, regardless of the risk areas its system is designed to cover.
A. Requirements Regarding the Implementation of the Whistleblower System
The internal procedure serves as the user guide for the internal whistleblowing system; particular care must be taken in drafting it. Beyond the requirements set forth in the implementing decree of the French Waserman Law [5], the AFA recommends in its practical guide that the following elements be highlighted: the purpose of the procedure, the scope of the system, the reporting channels, the handling of reports, the safeguards associated with the system, and finally, potential coordination with other systems.
This procedure for collecting reports must designate the individuals or departments responsible for handling them. The designated individuals or departments must be sufficiently competent and have the authority and resources necessary to fulfill their duties. The management of reports may also be outsourced to a third party, provided that the same safeguards are in place.
While, in principle, each legal entity has its own whistleblowing system, the guide notes that organizations with fewer than 250 employees may pool their whistleblowing systems with other entities of comparable size.
With regard to corporate groups, the guide gives companies full discretion to opt for a centralized whistleblowing system—which has the advantage of ensuring a consistent level of response and protecting against potential pressure from local management—or for a decentralized system, which also has the advantage of being more easily recognized by employees. A combination of the two approaches may also prove appropriate depending on the organization and corporate culture. In this case, the division of responsibilities must be clearly defined, particularly in the reporting procedure.
Finally, the guide also gives companies full discretion to choose the channels for receiving reports, but emphasizes that the channel must be accessible to all, clear, and secure. It can take various forms, such as a digital platform, a specific email address, a dedicated phone line, or even a one-on-one meeting with the designated contact person. Measures to ensure the anonymity of whistleblowers must be planned in advance when selecting the reporting channel. The channel must allow for ongoing communication with the reporter, even when the reporter does not identify themselves.
B. Requirements Regarding the Handling of Reports
Upon receipt of a report, it must be processed within the legal timeframes: 7 days to acknowledge receipt of the report and 3 months to provide a report on any measures taken to address the situation.
The 3-month period must allow the company first to assess the admissibility of the report and then to verify the truth of the allegations. Investigations may thus be conducted, either by reviewing documents or by launching an internal investigation. On this point, the AFA guide refers to its practical guide developed in collaboration with the French PNF on internal anti-corruption investigations[6]. The internal investigation is a formalized process, guided by established practice and case law in the absence of a dedicated legal framework to date. This investigation may be outsourced, particularly by engaging an investigative attorney.
C. Considerations Regarding the Protection of Stakeholders
Protecting the whistleblower is fundamental, not only to comply with the legal framework but, above all, to encourage people to report concerns through a system they can trust. This protection must be effective from the moment the report is filed, through the absence of retaliatory measures for any report made in good faith and the respect for anonymity if the person has requested it. It then extends throughout the investigation phase to avoid any risk of pressure on the person or of their identification. Protection must be guaranteed in the same manner even if the alleged facts are not substantiated following the investigation.
The whistleblowing system must also ensure that the identity of the person named in the report remains confidential; the investigation must also respect the presumption of innocence. The person involved must therefore be informed at an appropriate stage of the handling of the report.
The publication of this guide, however, comes amid a wide range of potential violations that may be covered by a whistleblowing system and a growing number of specialized authorities in these areas, such as the publication of the framework decision by the French Defender of Rights (Défenseur des Droits) on 5 February 2025[7] and the launch by Tracfin in July 2026 of a public reporting hotline as part of the fight against money laundering and terrorist financing[8] .
While the publication of this practical guide by the AFA is welcome, the coordination of the various obligations based on the types of violations covered by a whistleblowing system remains a priority issue for companies—an issue that is not addressed by these various authorities.
II. The practical coordination of the various regulatory requirements is a priority for companies
The lack of clarity and a comprehensive understanding of the whistleblowing system can create legal uncertainty for companies. Indeed, depending on revenue and headcount thresholds, companies must incorporate new areas of risk into their internal whistleblowing systems. In reality, the fundamentals of the whistleblowing system are not affected by these specific regulations; they simply require the inclusion of new risk areas.
In companies with more than 50 employees, the French Sapin 2 Law, as amended by the French Waserman Law[9] (and as clarified by the implementing decree for the latter), which incorporates the European Directive on the protection of whistleblowers[10], lays the foundation for the whistleblowing system. Its scope of application is very broad (information concerning a crime, a misdemeanor, a threat, or harm to the public interest, a violation or an attempt to conceal a violation of an international commitment duly ratified or approved by France, a unilateral act by an international organization based on such a commitment, European Union law, or a law or regulation).
In organizations subject under Article 17 of the French Sapin 2 Act to the implementation of a plan to prevent corruption and influence peddling[11]—notably companies with more than 500 employees and generating more than €100 million in annual revenue—a specific whistleblowing mechanism must address breaches of integrity. As part of the overall corruption prevention plan, the whistleblowing mechanism is thus subject to ex post review, either by the AFA during an audit conducted under its authority, or by a prosecuting authority, particularly in the context of negotiating a CJIP (Judicial Public Interest Agreement) or an additional compliance penalty.
Finally, in companies subject to the French Duty of Vigilance Act [12], with more than 5,000 employees and headquartered in France, the whistleblowing system must address the existence or occurrence of risks of human rights and environmental violations. What makes the duty of care approach unique is that, due to the diversity of stakeholders who may be exposed to risks, companies have had to open their whistleblowing systems to external parties, so that anyone in the world can file a report. This represents a major shift, as the very concept of a whistleblowing system has been pushed to its maximum level of openness. The clarifications provided by case law regarding the application of these regulations have also disrupted the systems already in place within companies. Indeed, French law requires that the whistleblowing system be established in consultation with the representative labor unions within the company. However, it was not until a ruling by the Paris Court of Appeal on 17 June 2025, in the La Poste litigation [13], that the concept of consultation and the intent of the law were clarified by the court. Given that the majority of companies have adopted a single whistleblowing system covering all areas of risk of violations, some (subject to the Duty of Vigilance regulation) may have failed to meet the required consultation obligation—which, admittedly, pertains solely to violations of human rights and environmental rights. The AFA guide, in fact, recommends that these companies adopt a single whistleblowing mechanism: [14]. The question therefore arises regarding ex post consultation on their internal whistleblowing mechanism to comply with the law’s requirements.
It is clear that while the foundation of the system remains the same (conditions for implementation, associated safeguards, handling of reports, etc.), the regulations regarding the Duty of Vigilance have fundamentally altered its functions.
In this context, the following recommendation can be made: Companies already subject to Article 17 of the French Sapin 2 Law and approaching the thresholds of the Duty of Vigilance Act would be well advised to organize a consultation—in accordance with the definition established by case law—on their entire whistleblowing system, regardless of the scope of risks it covers, as a proactive measure.
In any case, large companies must adopt a cross-functional approach to compliance by establishing, where multiple reporting mechanisms exist, single reporting channels (provided that, as the AFA emphasizes, such a common mechanism is “clearly identified as also allowing for the reporting of breaches of integrity”). Regardless of the subject matter of the report, this system serves as a tool for detecting violations to which the company will respond in the same manner, notably through an internal investigation or audit. The effectiveness and sustainability of the internal whistleblowing system are thus essential to the company’s ethical culture; without them, the organization would be somewhat blind to certain behaviors and unable to address them.
The internal whistleblowing system is one of the tools that must be continuously promoted within organizations; employee training and awareness ensure the system’s sustainability and help strike a balance between the number of internal reports and those made to external. Employees’ trust in the internal whistleblowing system will thus enable organizations to exercise greater internal control over their risks.
