The Whistleblower Protection Act is not the only German law that requires a confidential reporting channel. Anti-money-laundering law, the Supply Chain Act and supervisory law for banks, insurers and fund managers require one too, in some cases regardless of headcount. With preeco | whistleblower you receive all of these reports in one system.
Under Section 12 HinSchG, every employer with usually at least 50 employees needs an internal reporting office. In the financial sector the duty applies regardless of headcount. Entities obliged under the Anti-Money Laundering Act (GwG) need a confidential reporting procedure under Section 6(5) GwG, and companies with at least 1,000 employees in Germany need a complaints procedure open to external persons under Section 8 of the Supply Chain Act (LkSG). The legal bases at a glance:
From usually 50 employees an internal reporting office is mandatory (Section 12(1) and (2) HinSchG).
Regardless of headcount the duty applies to investment services firms, data reporting services providers, stock exchange operators, credit and financial services institutions, investment firms, counterparties under the SFTR, asset management companies, insurance undertakings, crypto-asset institutions, and payment and e-money institutions (Section 12(3) HinSchG).
Internal channels must allow reports orally or in text form, orally by telephone or another form of voice transmission (Section 16(3) HinSchG). The channel may also be opened to people in professional contact with the company, such as suppliers and service providers (Section 16(1) HinSchG).
Anyone obliged under Section 2 GwG must make arrangements under Section 6(5) GwG so that employees can report breaches of anti-money-laundering rules with their identity kept confidential. There is no headcount threshold; the arrangements scale with the type and size of the business. For estate agents and dealers in goods, risk management applies only to certain transactions (Section 4(4) and (5) GwG).
Companies with usually at least 1,000 employees in Germany need a complaints procedure for human rights and environmental risks under Section 8 LkSG. It is open not only to the company's own staff but to anyone, including workers at suppliers, and must keep their identity confidential. The government bill amending the LkSG (Bundestag printed paper 21/2474) drops the reporting duty but leaves the complaints procedure unchanged; a missing procedure remains subject to fines.
On top of the HinSchG, supervisory laws require a process through which employees can report breaches with their identity kept confidential: credit institutions under Section 25a(1) KWG, investment firms under Section 13 WpIG, insurers under Section 23(6) VAG, asset management companies under Section 28(1) KAGB and stock exchange operators under Section 5(8) BörsG.
Article 87 of the AI Act (Regulation (EU) 2024/1689) applies the EU Whistleblower Directive to reports of infringements of the regulation. Since 29 July 2026 the HinSchG explicitly lists AI Act infringements in its material scope (Section 2(1) no. 10 HinSchG). This creates no separate duty to set up a channel: whoever already has to run a reporting office now also receives reports about the use of AI through it.
After the Omnibus amendment (Directive (EU) 2026/470), the CSDDD applies from 26 July 2029 to companies with more than 5,000 employees and more than EUR 1.5 billion worldwide net turnover. It then requires a notification mechanism through which reports can be made anonymously or confidentially (Art. 14(5)). Germany has not yet transposed the directive; until then the LkSG applies.
All the German laws above require the reporting person's identity to stay confidential. None of them requires anonymous channels: under Section 16(1) HinSchG the reporting office should process anonymous reports, but there is no duty to design the channel for them. In practice, being able to report anonymously lowers the barrier considerably. preeco | whistleblower therefore offers it as an option: whistleblowers decide whether to give their name and stay reachable through a protected two-way dialogue even when anonymous. The software does not even write system log files that could point to whistleblowers.
Set up scopes for reports under the HinSchG, complaints under the LkSG, reports on the AI Act or on data protection. The assigned legal framework determines deadlines, areas and the questions of the plausibility check. You can create your own scopes, for example for money-laundering reports.
The reporting form is reachable through a public web address or QR code, including for supplier workers, service providers and customers. Reports arrive in writing or as a voice message recorded in the browser, in up to 26 languages.
The software monitors the 7-day acknowledgement and the 3-month feedback automatically and warns before a deadline expires. Every step is documented traceably, for internal audit as well as for the supervisor.
Cloud and private cloud data are stored encrypted in ISO 27001-certified data centres in Germany. For the highest data sovereignty requirements you run preeco | whistleblower on-premises. Multi-tenant for groups, ombudspersons and compliance service providers.
FAQ
Under the HinSchG only if they belong to the financial sector, for example as a credit or payment institution, insurer, investment services firm or asset management company (Section 12(3) HinSchG). Independently of that, entities obliged under the GwG must keep a confidential procedure for reporting breaches of anti-money-laundering rules under Section 6(5) GwG, scaled to the type and size of the business.
No. Article 87 of the AI Act extends the protection of the EU Whistleblower Directive to reports of infringements of the regulation, and since 29 July 2026 Section 2(1) no. 10 HinSchG names these infringements explicitly. The duty to run a reporting office still follows from Section 12 HinSchG. Anyone running one should be able to capture reports about the use of AI specifically, in preeco | whistleblower through a dedicated scope with the AI Act as its legal framework.
Yes, as long as the procedure meets the requirements of both laws: the LkSG complaints procedure must be accessible to all potential parties, including external persons, have public rules of procedure and keep identities confidential (Section 8 LkSG). In preeco | whistleblower you separate the two through scopes with their own legal framework, deadlines and checklist.
Not under German law. The HinSchG says the reporting office should also process anonymous reports but does not require the channel to be designed for them (Section 16(1) HinSchG). The GwG, LkSG and supervisory law require confidentiality of identity. Only the CSDDD will require very large companies to offer a mechanism for anonymous or confidential reports from 2029. preeco | whistleblower offers anonymous reporting as an option.
Supervisory laws require their own reporting process for breaches of supervisory law, for insurers explicitly "in accordance with the Whistleblower Protection Act" (Section 23(6) VAG). One system can cover both if it keeps the supervisory breach types as separate categories. How to set this up organisationally is a question for your legal counsel and your compliance function.
You have to receive reports under several laws? In a free consultation we show you how to cover HinSchG, LkSG, GwG and the AI Act in one reporting office with preeco | whistleblower.
Book a consultation