Anonymous whistleblowing in EU: from mandatory to banned

Anonymous whistleblowing rules by EU country run from mandatory to banned. One law, Directive 2019/1937, was meant to set a single standard. It did not. Whether a worker can report without giving a name now depends on the country. Three countries make a company accept anonymous reports. Three others bar or exclude them. We read all 27 national laws for our 2026 report on the EU Whistleblower Directive. Here is where each country stands.

How do EU countries treat anonymous reports?

The Directive left anonymity to national law. That one choice split the EU more than any other rule we measured. There are eight positions across 27 states, but three camps hold most of them. Twelve states permit anonymous reports yet force no one to accept them. This is what the Directive itself does. Three states go further and make it a duty. Three more shut the door. They either bar such reports or leave the reporter with no protection.

The rest sit in smaller groups. Cyprus, Greece and Italy do not cover anonymity at all. They protect only the reporter who is named later. Denmark, Estonia and Sweden never use the word in the law. France allows it in general but requires it only in finance. The Netherlands wrote a rule for it and never put it in force. Finland takes anonymous reports on its internal channel, but its external body refuses them. So a Finnish reporter who wants to stay anonymous cannot take the case higher.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 15.

"3 of 27 member states force companies to accept anonymous reports; three others bar or exclude them."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

The table below puts every state in its camp. Each line says what the rule means for a reporter.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 15.

Which countries require anonymous reporting?

Only three make it a duty. Spain and Portugal require anonymous intake in both the internal and the external channel. Portugal goes furthest. There, failing to provide the anonymous channel is a serious offence. Belgium sets the duty for private employers with more than 250 workers, and lets smaller ones off. For the detail, see the Spanish, Portuguese and Belgian whistleblower laws.

Which countries bar or exclude anonymous reports?

Three states close the route. Bulgaria will not open a case on an anonymous report and asks for a name and a signature on the form. Latvia has no anonymous route at all. Instead, it masks the reporter's identity in the file. Malta leaves anonymous reporters unprotected, but the reporting officer or the external Unit may still act on the report. Even in these three, a reporter who files anonymously and is named later keeps the Directive's protection. The Bulgarian, Latvian and Maltese whistleblower laws set out each position.

For a group that runs one channel across borders, these three states set the hard edge. A shared form that takes anonymous reports works in Spain and Portugal. In Bulgaria the same form has to collect a name before a case can start. Building one process that fits a mandate state and a bar state at once is the hard part.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 15.

What "permitted but not required" means for anonymous reports

Twelve states sit in the largest camp, and permitted does not mean welcomed. Germany says a firm should act on an anonymous report, but has no duty to allow one. Ireland lets a company refuse anonymous reports. If it accepts them, it must publish the terms and run the full process. Czechia permits them, yet its own standard form still asks for a name and date of birth. Slovenia lets the confidential person turn the report down. Hungary lets the case be dropped when the reporter cannot be named. So a worker in a permit state can usually file anonymously. Whether anything happens next depends on the employer.

What anonymous-reporting rules mean for a cross-border channel

A company must follow the law of every country it works in, so the strictest rule wins. If your footprint includes Spain or Portugal, your channel has to accept anonymous reports. If it includes Bulgaria, the same channel has to take a named report to open a case there. The simplest answer is one channel. Accept anonymous reports everywhere, and treat the few states that need a name as a local step. That beats running 27 separate designs. Picking that channel is a practical choice. We compare the options in the best whistleblowing channel and whistleblowing software versus email.

Make anonymity the default

Anonymous intake is not a box to tick in three countries and ignore in the rest. It is the feature that decides whether a worker trusts the channel enough to use it. A report that never arrives protects no one. That is why WeMoral takes anonymous reports by default. It keeps the option to collect a name where a country asks for one. The same channel then works from Lisbon to Sofia. Set anonymity as the default, add the local exceptions, and you are done. The full picture sits in the 2026 transposition report. It runs country by country, with the deadlines, retention rules and penalties next to the anonymity rules. Read your countries' rows before you finalise the form.