HinSchG for Banks + Financial Services: BaFin Specifics

Main article: HinSchG: setting up an internal reporting channel — the full pillar article on the topic.

1. BaFin MaRisk obligation from 1 employee

The BaFin Minimum Requirements for Risk Management (MaRisk), based on § 25a(1) KWG, require a whistleblowing procedure irrespective of headcount. However, this is not stricter than the HinSchG: under § 12(3) of the German Whistleblower Protection Act (HinSchG, Hinweisgeberschutzgesetz), the obligation to set up and operate an internal reporting channel applies to institutions within the meaning of § 1(1b) KWG and investment firms (§ 2(1) WpIG), investment services enterprises, stock exchange operators, capital management companies (§ 17(1) KAGB), insurance undertakings under § 1(1) VAG as well as payment and crypto service providers in any event irrespective of the number of employees — so the 50-employee threshold in § 12(2) HinSchG does not apply to these companies in the first place. The supervisory whistleblowing requirement applies in parallel and supplements the design and audit duties; it does not tighten the HinSchG threshold.

What setting up and operating concretely requires in Germany: at least one internal reporting channel (§ 12(1) sentence 1 HinSchG), reporting channels in oral or text form with an in-person meeting on request (§ 16(3) HinSchG — details in the FAQ), the necessary expertise of the persons entrusted with the task (§ 15(2) HinSchG) and informing employees about the reporting routes (§ 13 HinSchG). Failing to set up and operate the internal reporting channel is an administrative offence carrying a fine of up to EUR 20,000 (§ 40(2) no. 2 in conjunction with (6) HinSchG; classification in section 8). Practical recommendation: document a management resolution, the appointment of the responsible person with a declaration of independence, and rules of procedure containing the deadlines from section 4 — the obligation here does not depend on any size threshold; in an audit, what counts is what you can evidence about the operation of the reporting channel.

2. Report data in risk management: the confidentiality limit

Whistleblower data may feed into risk management, but only without any link to identity — § 8(1) HinSchG limits the circle of those who may learn the identity exclusively to the persons responsible for receiving reports and taking follow-up measures and those supporting them (in detail in section 5). For risk data aggregation at banks this means: whistleblower data feed into the risk assessment, the identifying details stay out.

Practical recommendation: set up analyses for risk management so that they work without identifying details — keep metrics such as case numbers, category of breach and processing time separate from the case file, log access, and define the circle of authorised persons on a need-to-know basis.

Delimitation: the supervisory reference points in this article — MaRisk and § 25a KWG, § 23 VAG, BCBS 239 as well as the DORA interface for IT incident reporting (Regulation (EU) 2022/2554, applicable since 17 January 2025) — come from supervisory law or from supervisory standards. This article goes into the obligations under the German HinSchG and the Austrian HSchG; for the design of the supervisory requirements, the supervisory rulebooks themselves are decisive.

3. Reporting sector-specific breaches

In the financial sector, reportable matters are above all breaches of the KWG, of market abuse law (MAR) including market manipulation and insider dealing, as well as suspected money laundering under the GwG.

Whether a report triggers statutory whistleblower protection, however, is decided by the material scope of the respective act, not by the sector. In Germany, the HinSchG applies to reports about criminally sanctioned breaches, about breaches subject to a fine in so far as the provision infringed serves to protect life, limb or health or to protect the rights of employees or their representative bodies, as well as about other breaches of numerous listed federal, Land and EU legal provisions (§ 2(1) nos. 1 to 3 HinSchG). The financial services area is moreover expressly named in the Annex to Directive (EU) 2019/1937 (Art. 2(1)). In Austria the scope is narrower: the HSchG covers, among other things, financial services and the prevention of money laundering as well as corruption offences under §§ 302 to 309 StGB, but not all criminal offences as German law does (§ 3(3) HSchG). Practical recommendation: spell out the catalogue of reportable breaches in the rules of procedure and record in the intake screening whether a report falls within scope — outside it, statutory protection does not apply.

4. BaFin as an external reporting channel

For financial services providers, BaFin is the competent external reporting channel: § 21 HinSchG designates it as the special external reporting channel for the financial sector; it operates its own whistleblower hotline for this purpose, and the reporting person is free to choose between the internal reporting channel and BaFin (on the provider side of the internal reporting channel: External reporting channel: provider comparison).

This coexistence is built into the HinSchG systematically: the federal external reporting channel at the Federal Office of Justice (BfJ) is organisationally separate from the rest of its remit and is competent whenever no special external reporting channel is competent (§ 19(1) and (4) HinSchG) — alongside BaFin, that is the Federal Cartel Office for competition law and the DMA (§ 22 HinSchG). In practice this means for institutions: in so far as BaFin is competent as a special external reporting channel, the external report goes there and not to the Federal Office of Justice; its residual competence only applies beyond that. The choice between an internal and an external report rests with the reporting person alone (§ 7(1) HinSchG); obstructing reports or the subsequent communication is prohibited (§ 7(2) HinSchG). An external reporting channel therefore does not replace the internal one. In Austria the BAK is the external body in so far as no special body is competent (§ 15(1) HSchG) — in the financial area the FMA, see section 7.

All figures in the following table are statutory deadlines; the jurisdiction column separates the German and the Austrian sources.

5. Suspected money laundering: keeping the HinSchG track clean and separate

Where money laundering is suspected, two tracks run in parallel: the report to the internal HinSchG reporting channel and the anti-money-laundering track via the money laundering officer (FIU). The anti-money-laundering reporting duty exists independently alongside the HinSchG report; this article does not go into it, it deals with the HinSchG track.

For that track, Germany has a firm rule: reporting channels must preserve the confidentiality of the identity of the reporting person, of the persons concerned by a report and of the other persons named in the report; the identity may become known exclusively to the persons responsible for receipt and follow-up measures and to those supporting them (§ 8(1) HinSchG). A breach of this is subject to a fine (section 8). Practical recommendation: for cases with two procedural tracks, define in advance who receives the report, who is responsible for the follow-up measures and which details are passed on without any link to identity; log every handover. In Austria, the money laundering reporting office is designated as the special body for suspected money laundering (§ 15(2) no. 5 HSchG); protection of identity there follows from § 7 HSchG (section 7).

6. Level of damages

There is no statutory flat rate: under § 37(1) HinSchG, in the event of a breach of the prohibition of reprisals the party causing it is obliged to compensate the reporting person for the resulting damage — scope and evidence follow general damages law. § 37(2) HinSchG makes clear that this gives rise to no claim to the establishment of an employment, vocational training or other contractual relationship and no claim to career advancement.

What drives the risk is the burden of proof: if the reporting person suffers a detriment in connection with their professional activity and asserts that they suffered it as a result of the report, the detriment is presumed to be a reprisal; the party causing the detriment must then prove that it was based on sufficiently justified grounds or was not based on the report (§ 36(2) HinSchG). The Higher Labour Court of Lower Saxony confirmed this two-stage test in its judgment of 11 November 2024 (7 SLa 306/24). Practical recommendation: for every personnel measure taken after a report, document the reason for the decision and its independence from the report. In Austria, retaliatory measures are legally ineffective; what is owed is restoration of the lawful position, compensation for financial loss and compensation for the personal detriment suffered (§ 20(1) last sentence and (2) HSchG), and the reporting person need only establish the retaliation as credible (§ 23 HSchG).

7. Austria: HSchG instead of HinSchG — FMA instead of BaFin

This article describes the German legal position. For Austrian institutions, the Austrian Whistleblower Protection Act (HSchG, HinweisgeberInnenschutzgesetz) applies instead:

• Likewise irrespective of headcount: under § 3(2) in conjunction with § 11(1) HSchG, the obligation to have an internal whistleblowing system in the areas of financial services, financial products, financial markets and the prevention of money laundering and terrorist financing applies without regard to the number of employees.
• The external body is the FMA, not the BAK: in so far as the Financial Market Authority is competent on the basis of the legal acts listed in § 2 FMABG, the Federal Bureau of Anti-Corruption (BAK) has no competence (§ 15(2) no. 4 HSchG); for suspected money laundering, the money laundering reporting office applies (§ 15(2) no. 5 HSchG).
• Deadlines: acknowledgement of receipt no later than seven calendar days (§ 9(1) HSchG), feedback on follow-up measures no later than three months after receipt (§ 13(9) HSchG).
• Penalties: administrative offence, fine of up to EUR 20,000, in the event of repetition up to EUR 40,000, imposed by the district administrative authority (§ 24 HSchG) — Austrian law does not provide here for a tenfold increase against legal persons as under § 30 OWiG.
• Confidentiality: the identity of the reporting person must be protected by internal, external and mandated bodies; this also applies to all information from which it can be derived directly or indirectly. If the content of a report becomes known to persons other than the responsible staff, those persons are prohibited from disclosing the content or the identity (§ 7(1) and (2) HSchG).
• Start of protection: protection applies from the moment the report is made to an internal or external body, where the reporting person had sufficient grounds to assume the report was true and that it fell within the scope of the act (§ 6(1) HSchG).
• Data protection: a data protection impact assessment is dispensable (§ 8(13) HSchG in conjunction with Art. 35(10) GDPR); the retention period is five years (§ 8(11) HSchG).

8. Fines and limitation periods in Germany

Breaches of the HinSchG are administrative offences in Germany with maximum amounts graded by offence (§ 40 HinSchG). A tenfold increase against legal persons under § 30(2) sentence 3 OWiG is possible — but for a missing internal reporting channel, § 40(6) sentence 2 HinSchG expressly does not order it. The following amounts are the statutory maximums; the Austrian penalty ranges are set out in section 7.

The limitation period for prosecution follows the maximum fine threatened: three years for offences carrying more than EUR 15,000, that is the EUR 50,000 and the EUR 20,000 cases (§ 31(2) no. 1 OWiG), and two years for the negligent breach of confidentiality with a maximum fine of EUR 10,000 (§ 31(2) no. 2 OWiG). Since 15 April 2025, the Federal Office of Justice (BfJ) has been competent for prosecution and sanctioning in so far as implementation of the act falls to the Federal Ministry of Justice or an authority within its remit (§ 1 HinSchGOWiZustV, BGBl. 2025 I no. 111); outside that remit, the general rules on competence continue to apply. Practical recommendation: align retention and deletion concepts with the three-year mark — it covers the longer limitation period as well as the deletion period of three years after conclusion of the procedure (§ 11(5) HinSchG).