Whistleblowing fines by EU country: from zero to one million euros

Whistleblowing fines by EU country run from nothing at all to 1,000,000 EUR. The size of the fine says little about how seriously a country treats the law. It depends almost entirely on which national law a company falls under. The same failure can cost wildly different amounts. No reporting channel, or a leaked identity, might bring a seven-figure fine in one member state and no fine at all in the country next door. We measured every number for our 2026 report on how all 27 member states brought in the Whistleblower Directive. Here is what the enforcement side looks like.

How big are whistleblowing fines across the EU?

Spain tops the scale. A very serious breach under its law can cost a company up to 1,000,000 EUR. Greece comes next at 500,000 EUR. Then three states sit at 250,000 EUR: Portugal, Ireland and Luxembourg. Luxembourg's ceiling doubles to 500,000 EUR if the same firm breaks the rules again within five years. From there the numbers drop fast. Croatia, Estonia and Slovakia share a 100,000 EUR band, and the scale ends at Romania, near 7,900 EUR.

At the other end, the fine disappears. Ten member states set no fixed fine on companies. Hungary bars one outright. Austria and Lithuania can fine only people, not the company. The Netherlands wrote a penalty rule but never put it into force. Sweden uses an open-ended injunction backed by a penalty payment instead. Denmark and Finland leave the amount to a court. A blank cell here still leaves risk. It just sits elsewhere: a court-set criminal fine, the liability of the manager in charge, or an injunction.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 34. Czech, Bulgarian and Romanian amounts converted at fixed reference rates.

"1,000,000 EUR is Spain's maximum fine for a non-compliant entity, and six member states set none at all."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

The table below sets the company fine next to the other risk a firm controls directly: whether a manager who retaliates or blocks a report can go to prison for it. What a reporter risks for a false report is a separate question. We cover that in whistleblower retaliation penalties under the EU Directive.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 34.

Which countries can jail a manager over whistleblowing breaches?

The Directive asks for penalties that are effective, proportionate and act as a deterrent. It does not ask for a criminal offence, and most states chose not to create one. Nineteen of the 27 use only administrative penalties. Denmark and Finland sit just inside that group. Both set a court-decided criminal fine, but neither adds a prison term.

"19 of 27 member states created no criminal offence around whistleblowing; eight threaten prison."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

The eight that did go criminal raise the stakes, because prison falls on a named manager in person. Belgium, Cyprus and Poland reach three years. Ireland and France reach two. Greece allows prison without naming a limit, and Malta reaches one year. Luxembourg runs the pattern in reverse. Its prison term targets the reporter who lies, while the employer who retaliates faces only a fine.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 35. The other 19 states create no criminal offence.

Who enforces the whistleblowing rules?

A fine is only real if someone can impose it. This is where enforcement thins out. The Directive told states to name authorities for external reports. It said almost nothing about who polices the internal-channel duties. So the answer to a basic question, who checks that a company built a channel at all, varies widely.

Source: WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 32.

Seven states built a dedicated body that can fine directly. They include Italy's ANAC, Spain's Independent Authority and Luxembourg's Office des signalements. Another ten gave the job to an existing regulator. Five split it between bodies. Two, Germany and Sweden, name a supervisor in the law but never say who it is. Twelve name no supervisor at all: six leave it to the courts, and six name nobody. So in nearly half the EU, no regulator actively checks whether your channel exists. The check comes only when a report, or a lawsuit, forces the question.

"12 states have no compliance supervisor at all, so nobody checks whether internal channels exist."
WeMoral, 2026 Report on Whistleblower Directive Transposition Across the EU, p. 4

What EU whistleblowing fines mean for cross-border companies

For a group with staff in more than one member state, the low-fine countries offer no comfort. A company must follow the law of every country it works in. So the number that counts is the highest fine anywhere in your footprint, plus the toughest criminal regime you touch. Take a firm in Spain, Ireland and Poland. It has to plan for a million-euro fine, a criminal conviction, and up to three years' prison for a manager, even if its head office sits in a state with no fine at all. One channel that meets the strictest rule you face, run the same way everywhere, is cheaper than 27 versions of a policy. The cost of not implementing a whistleblowing policy is easiest to see through this cross-border lens.

Every figure above lands on the company. What a reporter risks for a knowingly false report is a separate scale, set out in our post on penalties for false whistleblower reports by EU country.

Read the fine map, then close it

The spread of penalties shows how unevenly one directive landed across 27 legal systems. Chasing the softest country is the wrong instinct anyway, because a cross-border employer answers to the hardest regime it touches. The better move is to measure your risk against that regime and make the channel routine to run. Every figure above, plus the deadlines, the anonymity rules and the retention periods behind them, sits country by country in the full 2026 transposition report. Open it, find your countries, and turn the row into a policy.