HinSchG Updates 2024–2026: What Has Actually Changed?

Scope Germany — note for Austria: This update overview concerns exclusively the German HinSchG. In Austria, the Austrian Whistleblower Protection Act (HinweisgeberInnenschutzgesetz, HSchG) applies instead; the threshold for setting up a system, the deadlines, the external body and the range of penalties are set out in the section Austria: the HSchG in comparison. The HinSchGOWiZustV and the EU infringement proceedings on the transposition of Directive (EU) 2019/1937 in Germany have no counterpart in Austria.

The six points at a glance: status and legal source

Of the six points in this overview, one is a statutory instrument that has entered into force, one is an EU infringement procedure that has since been closed, two concern the level of fines and their limitation periods, and two are clarifications on the wording of the HinSchG as it currently stands. The status column reflects the procedural position and the state of the law as at 17 August 2026; the source column names the provision in which you can look the point up yourself.

Points 2 and 3 are the ones with a noticeable organisational effect; points 1, 4, 5 and 6 answer points of detail on wording, the level of fines and limitation periods.

1. Anonymous reports: a "should" recommendation, not an obligation

Contrary to what is sometimes claimed in compliance publications, the HinSchG as it currently stands contains no obligation to enable or to handle anonymous reports. § 16(1) sentences 4 and 5 HinSchG merely provides: "The internal reporting channel should also process reports received anonymously." — the official wording is therefore a "should" recommendation, not an obligation. Nor is there any obligation to design the reporting channels in such a way that anonymous reports can be submitted. The transitional provision in § 42 HinSchG likewise contains neither the cut-off date of 1 January 2025 nor any anonymity requirement — the widely quoted date of 1 January 2025 comes from an earlier legislative draft that did not become law. Practical recommendation: an anonymous intake and return channel (for example an anonymous web form plus an anonymous chat thread) is best practice and increases use of the system, but in law it remains voluntary.

What § 42 HinSchG governs instead: the transitional provision concerns exclusively two other dates — the deadline for employers with 50 to 249 employees to set up a channel (17 December 2023) and the applicability of the fine provision in § 40(2) no. 2 HinSchG (1 December 2023). Anyone who has the date of 1 January 2025 in a procedural policy, a training slide or a supplier questionnaire should therefore replace it rather than merely qualify it: an incorrect date in your own procedural policy shows up in an audit as a deviation from your own rules.

The underlying logic of the channels: § 16(3) sentence 1 HinSchG requires reports to be possible orally or in text form — the employer (Beschäftigungsgeber) has a choice in this respect. If the oral channel is chosen, it must be possible by telephone or by another means of voice transmission (sentence 2). The only mandatory addition is an in-person meeting at the request of the whistleblower within a reasonable time (sentence 3), and with their consent also by video and audio transmission (sentence 4). Within this scheme, anonymity is a voluntary additional service — three parallel channels are a widespread practice standard, but not a statutory obligation. Practical recommendation (not a legal obligation): anyone who promises anonymous handling should test the return channel end-to-end once a year and document the result.

2. HinSchGOWiZustV — Federal Office of Justice competent (in force since 15 April 2025)

The Regulation on Competence for Regulatory Offences under the Whistleblower Protection Act (Hinweisgeberschutzgesetz-Ordnungswidrigkeiten-Zuständigkeitsverordnung, HinSchGOWiZustV) is dated 9 April 2025 (date of signature), was promulgated in BGBl. 2025 I Nr. 111, issued on 14 April 2025, and, pursuant to § 2 of the Regulation ("This Regulation shall enter into force on the day after its promulgation"), has been in force since 15 April 2025. § 1 HinSchGOWiZustV transfers competence for the prosecution and punishment of regulatory offences under § 40 HinSchG to the Federal Office of Justice (BfJ) — but only in so far as the implementation of the Act falls to the Federal Ministry of Justice or to an authority within its portfolio. It does not follow from this that the BfJ has a "central" competence for fines covering all HinSchG breaches without exception; outside that portfolio, the general rules on competence continue to apply (§ 36 OWiG, where applicable Land authorities). Practical consequence: breaches of § 12 (reporting channel not established), § 8 (confidentiality) or § 36 (reprisals) are punished in a bundled manner within the BfJ's area of competence.

Which offences are covered: under § 40(2) to (4) HinSchG, a regulatory offence is committed, among other things, by anyone who obstructs a report, fails to establish and operate an internal reporting channel, takes a reprisal or fails to maintain confidentiality. The Regulation governs the prosecution and punishment of these regulatory offences; which maximum fine applies to which offence, and when it becomes time-barred, is set out in § 40 HinSchG and § 31(2) OWiG (points 4 and 5).

Not to be confused: the federal external reporting channel is also established at the Federal Office of Justice (§ 19(1) HinSchG). It is organisationally separate from the rest of the office's area of competence and is always responsible in so far as no special external reporting channel — such as BaFin under § 21 or the Federal Cartel Office under § 22 HinSchG — is responsible (§ 19(4) HinSchG). The reporting route and the fining authority are therefore two different addresses at the same office. Practical recommendation (not a legal obligation): describe the two separately in the staff information under § 13 HinSchG so that the reporting routes remain clear.

3. § 14 HinSchG and the EU Whistleblowing Directive — no infringement proceedings pending against Germany

The infringement proceedings INFR(2022)0052 brought against Germany concerned the late transposition of the EU Whistleblowing Directive 2019/1937; they ended with the judgment of the CJEU in Case C-149/23 of 6 March 2025 (lump sum of EUR 34 million) and were closed on 4 June 2026. No further proceedings — in particular no conformity proceedings on § 14 HinSchG and on the group outsourcing solution (parent or sister company as the internal reporting channel for subsidiaries) — are pending against Germany; as at 17 August 2026, § 14 HinSchG applies unchanged. As a practical recommendation (not a legal obligation), group compliance officers should nevertheless use hybrid models (the subsidiary's own reporting channel plus the group body as a third party) rather than pure group outsourcing.

The point of reference in the Directive is Art. 8: under Art. 8(1) of Directive (EU) 2019/1937, legal entities in the private and public sector must establish internal reporting channels and procedures; under Art. 8(3), this obligation applies to legal entities in the private sector with 50 or more workers. It is this link to the individual legal entity on which the criticism of the German transposition is based. German law ties the obligation to establish a channel to the employer: § 12(1) sentence 1 HinSchG obliges employers to ensure that at least one internal reporting channel is established and operated; under § 12(2) HinSchG, this applies to employers with, as a rule, at least 50 employees each.

What § 14 HinSchG supports — and what it does not: under § 14(1) sentence 1 HinSchG, the tasks of the internal reporting channel may be assigned to a third party; the group solution is derived from this option, which equally supports outsourcing to a law firm or to an ombudsperson. § 14(1) sentence 2 HinSchG, however, keeps the employer itself under the obligation to take appropriate measures to remedy a breach. Outsourcing therefore shifts the handling, not the responsibility for remedial action. When testing the threshold for each legal entity, § 12(3) HinSchG must also be observed: for the employers listed there — among others investment services firms, stock exchange operators, institutions under the German Banking Act and the German Investment Firm Act, capital management companies, insurance undertakings as well as crypto and payment services institutions — the obligation to establish a channel applies irrespective of the number of employees. A small finance or insurance subsidiary may therefore be obliged to establish a channel even though it does not reach the 50-employee threshold.

Practical recommendation (not a legal obligation): check the status of any EU proceedings on whistleblower protection with the European Commission before taking a set-up decision, and record the result with a date in the compliance documentation. The individual models are compared in the article HinSchG group reporting channel.

4. § 40 — levels of fines under the statutory text

Under § 40(6) sentence 1 HinSchG, the maximum fine per natural person is EUR 50,000 for obstructing a report (§ 7(2)), reprisals (§ 36) and intentional or reckless breach of confidentiality (§ 8(1)). The tenfold multiplier for legal persons under § 30(2) sentence 3 OWiG applies to these cases — giving a maximum of EUR 500,000 for companies. Fine where no reporting channel has been established (§ 40(2) no. 2 in conjunction with § 12): EUR 20,000 — and that also applies to legal persons, because § 40(6) sentence 2 HinSchG expressly orders the tenfold multiplier under § 30(2) sentence 3 OWiG only for § 40(2) nos. 1 and 3 and (3) and (4), not for the missing reporting channel. Negligent breach of confidentiality: EUR 10,000 (natural persons). Source: § 40 HinSchG, gesetze-im-internet.de/hinschg.

What this means for risk assessment: the highest amounts are attached not to the existence of the reporting channel but to its operation — to the prohibition on obstruction (§ 7(2) HinSchG), to the prohibition on reprisals (§ 36(1) HinSchG, which also covers threats and attempts) and to the confidentiality of identity (§ 8(1) HinSchG, which protects not only the whistleblower but also the persons concerned by a report and the other persons named in it). Anyone who checks only the establishment of the channel is checking the cheaper part of the risk. For the prohibition on reprisals, § 36(2) HinSchG additionally shifts the burden of proof: if a whistleblower suffers a detriment in connection with their professional activity and asserts that they suffered it as a result of a report, the detriment is presumed to be a reprisal — the party causing the detriment must then prove that it was based on sufficiently justified grounds or was not based on the report. The Regional Labour Court of Lower Saxony confirmed the two-stage test for this in its judgment of 11 November 2024 (7 SLa 306/24). Practical recommendation (not a legal obligation): document the evidence of independence for a personnel measure from the period before the measure.

Alongside the fine there is the civil-law claim: anyone who breaches the prohibition on reprisals must compensate the whistleblower for the resulting damage (§ 37 HinSchG). The breach does not give rise to a claim to the establishment of an employment or training relationship or to professional advancement (§ 37(2) HinSchG). § 38 HinSchG operates in the opposite direction: the whistleblower is obliged to compensate for damage arising from an intentional or grossly negligent report or disclosure of incorrect information. The framework itself is not negotiable — agreements that restrict the rights of whistleblowers or other protected persons are void under § 39 HinSchG.

5. Limitation period for fines: 3 years, 2 years in cases of negligence

The limitation period for prosecution follows § 31(2) OWiG and is graduated according to the maximum fine threatened: 3 years for offences carrying more than EUR 15,000 (§ 31(2) no. 1 OWiG), 2 years for the offence carrying EUR 10,000 (§ 31(2) no. 2 OWiG). Which of the HinSchG offences dealt with here fall into which tier is shown in the table; the "Fine tier" column states the statutory maximum amount for natural persons, while the tenfold multiplier for legal persons and its exception for the missing internal reporting channel (§ 40(6) sentence 2 HinSchG) are set out in point 4.

Practical consequence: retention concepts should cover at least 3 years — matching the deletion period for documentation in § 11(5) HinSchG. Even so, the limitation period for prosecution and the deletion period must not be equated: they are two different periods from two different provisions (§ 31(2) OWiG and § 11(5) HinSchG respectively). The deletion period for report documentation is three years after conclusion of the procedure in Germany (§ 11(5) HinSchG) and five years in Austria (§ 8(11) HSchG) — the deletion concept should therefore be maintained separately for each jurisdiction. Practical recommendation (not a statutory period): keep evidence of compliance with deadlines, of training and of channel tests for at least as long as the applicable limitation period for prosecution.

6. Clarification: a "2026 amendment" with an audit obligation does not exist

A "HinSchG amendment 2026" with an audit obligation under § 22 does not exist. § 22 HinSchG governs a competence, not a corporate obligation: the external reporting channel at the Federal Cartel Office for competition-law breaches including the Digital Markets Act; how the external reporting channels under §§ 19, 21 and 22 HinSchG are delimited from one another is set out in point 2. The "§ 22 audit obligation from 1 January 2026" quoted in compliance publications in 2024–2025 comes from secondary sources, not from the statutory text (wording: gesetze-im-internet.de/hinschg).

A voluntary, documented self-assessment of the effectiveness of the internal reporting channel remains worthwhile. An annual rhythm for this is a practical recommendation and not a statutory audit interval. What is fixed by law, by contrast, are the procedural deadlines in the individual case: seven days for the acknowledgement of receipt (§ 17(1) no. 1 HinSchG) and three months for feedback on planned or already taken follow-up measures and the reasons for them (§ 17(2) HinSchG). Anyone who writes the annual rhythm into their own procedural policy is, however, binding themselves: a missed cycle is then a finding against your own rules.

If you want to implement a structured voluntary self-assessment: 12-point effectiveness self-assessment for compliance officers. Clarification in the glossary: Audit Obligation (HinSchG) — definition + clarification.

Austria: the HSchG in comparison

For Austrian entities, the Austrian Whistleblower Protection Act (HSchG) applies instead of the HinSchG: an internal whistleblowing system from 50 workers (§ 3(1), § 11(1) HSchG), acknowledgement of receipt within seven calendar days (§ 9(1) HSchG), feedback no later than three months after receipt (§ 13(9) HSchG), and the external body is the Federal Bureau of Anti-Corruption (BAK, § 15(1) HSchG); administrative penalties of up to EUR 20,000, and up to EUR 40,000 in the event of a repeat offence, imposed by the district administrative authority (§ 24 HSchG). The following table adds the differences that are relevant in practice for corporate groups with German and Austrian entities. Each statement names its statutory source.

In both jurisdictions the protection applies irrespective of the reporting route chosen; the differences are shown in the table — among others in the material scope, the standard of proof, the legal consequence and the retention period.

What compliance officers should now follow up on

Six documentation steps follow from the six points. The steps themselves are practical recommendations; the only legal obligation is what the provision cited in each case requires — the suggested rhythm is not. The allocation of roles in the "Who" column is likewise a practical suggestion, not a statutory requirement.