Who Needs a Whistleblowing Channel? The 50-Employee Rule Explained

Your organisation needs an internal whistleblowing channel if it's a private company with 50 or more employees, a public-sector entity of any size, or one of a short list of regulated businesses (financial services, transport safety, anti-money laundering, environmental protection) that must comply regardless of headcount under Directive (EU) 2019/1937. Below that, in the private sector and outside those regulated activities, there is currently no EU-wide obligation — though corporate groups and small public bodies have a specific option to share one channel instead of each building their own.

Key takeaways

• The core private-sector threshold is 50 or more employees — but how that headcount is counted (full-time equivalent vs. raw headcount, and on what reference date) is left to national law, not the Directive itself.
• Every public-sector entity must have a channel, with no minimum size, though several Member States exempt very small municipalities.
• A handful of regulated sectors (finance, anti-money laundering, transport safety, environmental compliance) must comply even with a single employee, because sector-specific EU law already required reporting mechanisms.
• Corporate groups and small municipalities can share a channel under Article 8(6) instead of each subsidiary or town hall building its own from scratch.
• Crossing the 50-employee threshold isn't instant — most transpositions give newly-covered companies a grace period, but "we just grew" stops being a valid excuse quickly.

The 50-employee threshold: how it's counted and what falls outside it

Article 8(3) of the Directive sets the baseline: private legal entities with 50 or more workers must establish an internal reporting channel. What trips up compliance teams isn't the number itself — it's the counting method. The Directive doesn't prescribe a single EU-wide formula for "50 employees," so national transpositions diverge:

• Most Member States count active headcount (including part-time staff as whole persons) on a given reference date, typically the last day of the previous calendar year.
• A few use a full-time-equivalent (FTE) calculation instead, where two half-time employees count as one.
• Temporary agency workers and genuinely self-employed contractors are usually excluded, but the line isn't always clean — a company that relies heavily on long-term contractors should get local legal advice rather than assume it's exempt.

This is one of the areas where the national transpositions differ enough to matter in practice — a workforce of 55 people spread across part-time contracts could sit above the threshold in a headcount-based country and below it in an FTE-based one.

Below 50 employees, a purely private company outside the regulated sectors below has no EU-wide obligation today. That's not necessarily permanent: Article 27 requires the European Commission to periodically assess whether the Directive's scope should be extended, so smaller companies operating in a single market for years shouldn't assume the threshold is frozen forever.

Public-sector entities: no headcount minimum

Article 8(1) draws no size line for the public sector. Municipalities, regional authorities, state-owned enterprises, universities, and other public bodies must operate an internal channel regardless of how many people they employ. In practice, Member States have used the flexibility Article 8(6) allows to soften this for the smallest local authorities — several exempt municipalities under 10,000 inhabitants, or let them pool resources instead (more on that below) — but the default rule is size-blind: being public sector is itself what triggers the obligation.

Sectors that must comply regardless of size

Article 8(4) carves out an exception that catches organisations a simple headcount check would miss. If your company falls within the EU acts listed in Parts I.B and II of the Directive's Annex — broadly, financial services, prevention of money laundering and terrorist financing, transport safety, and environmental protection — you must have an internal reporting channel even with a handful of employees. These sectors already had reporting obligations under earlier, sector-specific EU legislation, and the Directive folds them into the same baseline rather than creating a separate regime. A 12-person investment advisory firm or a small transport-safety contractor can be legally required to have exactly the same internal channel infrastructure as a 500-employee manufacturer.

Corporate groups and small municipalities: the shared-resources exception

Building a fully separate channel for every legal entity in a group is exactly the kind of overhead the Directive tries to avoid for smaller organisations. Article 8(6) lets Member States permit two categories of entity to share resources for receiving and investigating reports instead of each running its own:

• Private-sector entities with 50 to 249 workers — a holding company with four subsidiaries of 60 employees each doesn't need four independent channels; it can operate one shared intake and investigation process across the group, as long as each entity is still identifiable to the people reporting.
• Municipalities with fewer than 10,000 inhabitants (or fewer than 50 workers) and other small public-sector bodies — allowing a shared regional or intermunicipal reporting resource instead of every small town hall standing up its own.

Companies with 250 or more employees don't get this option — the Directive expects entities above that size to run their own dedicated channel. Whether your Member State actually implemented the Article 8(6) option, and exactly how it's structured, again varies by transposition — it's worth confirming locally before assuming a shared setup is available.

How Vaelo helps you cover every entity from one account

Most whistleblowing tools are built for a single legal entity, which forces corporate groups into an awkward choice: pay for a separate account per subsidiary, or force every entity to share one undifferentiated inbox that makes it impossible to tell who a report actually concerns. Vaelo is built the other way around — one account can host multiple branded, independently-configured reporting channels for each subsidiary or municipality, with reports automatically routed and case-managed per entity, while still letting a group-level compliance team share investigation resources exactly the way Article 8(6) allows. You get the cost and setup efficiency of a shared channel without losing per-entity accountability, live in minutes and with no IT project required.

Frequently asked questions

Does the 50-employee count include part-time staff? Usually yes, counted as full persons rather than fractions — but a minority of Member States use a full-time-equivalent calculation instead, so the same workforce can land on different sides of the threshold depending on the country. Check the specific national transposition rather than assuming.

Do public-sector bodies of any size need a channel? Yes, in principle — Article 8(1) sets no minimum headcount for the public sector. Some Member States exempt or offer shared-resource options to municipalities under 10,000 inhabitants, but the default obligation applies regardless of size.

Which sectors must comply even with fewer than 50 employees? Financial services, anti-money laundering and counter-terrorist-financing, transport safety, and environmental protection, per Article 8(4) and the Directive's Annex — these were already subject to reporting obligations under earlier EU sector legislation.

Can a corporate group with several subsidiaries share one whistleblowing channel? Yes, for subsidiaries with 50 to 249 employees each, Article 8(6) allows Member States to permit shared intake and investigation resources across the group instead of a fully separate channel per entity. Entities with 250 or more employees don't get this option.

What happens if my company crosses the 50-employee threshold mid-year? Most national transpositions apply the obligation from the point the threshold is durably crossed, often with a short grace period to get a channel operational rather than an instant deadline — but the specifics (reference date, grace period length) depend on local law, so confirm with your Member State's implementing legislation as soon as growth puts you near the line.