France has progressively strengthened its whistleblower framework through Sapin II and the landmark Loi Waserman. Here is what organisations operating in France must understand to stay compliant.
France has emerged as one of Europe's most active legislators on corporate transparency and whistleblower protection. Beginning with the landmark Sapin II law in 2016 and accelerating with the Loi Waserman reforms that came into force in 2022, French authorities have steadily raised the bar for what organisations must do to protect those who speak up about wrongdoing. For multinational businesses operating in France, understanding the cumulative weight of these obligations is no longer optional — it is a legal imperative.
Sapin II: The Foundation of France's Whistleblower Regime
Enacted in December 2016, the Sapin II law — formally known as the Loi relative à la transparence, à la lutte contre la corruption et à la modernisation de la vie économique — introduced a broad, codified definition of a whistleblower for the first time in French law. Crucially, it established that any person, acting in good faith and without direct personal interest, who discloses or reports a crime, a serious and manifest violation of an international commitment, or a threat to the general interest, qualifies for legal protection.
Sapin II imposed mandatory obligations on private-sector companies employing at least fifty people, as well as public bodies and local authorities above defined thresholds. These entities were required to establish internal reporting procedures, including a dedicated, secure, and confidential channel through which employees could raise concerns without fear of retaliation. Failure to maintain such a channel exposed organisations to regulatory scrutiny and potential sanctions.
The law also introduced important anti-retaliation provisions, prohibiting dismissal, demotion, or other adverse measures against a whistleblower acting in good faith. Importantly, the burden of proof was partially shifted: once a worker demonstrated they had made a disclosure and suffered a subsequent adverse measure, the employer bore the burden of demonstrating that the measure was justified on grounds unrelated to the disclosure.
Loi Waserman: Transposing the EU Directive and Going Further
In March 2022, France enacted the Loi Waserman — named after its parliamentary champion — to transpose the European Union Whistleblowing Directive of 2019 into domestic law. While the EU Directive set a minimum harmonised standard across member states, France used the transposition as an opportunity to strengthen and clarify its national framework in several meaningful ways.
Key changes introduced by the Loi Waserman include:
- Expanded scope of protected disclosures: The definition of reportable matters was widened to cover a broader range of violations, including breaches of EU law in areas such as financial services, product safety, environmental protection, and public health.
- Strengthened confidentiality obligations: Organisations are now explicitly required to protect the identity of the whistleblower, the identity of any persons mentioned in the report, and the content of the report itself throughout the entire investigation process.
- Facilitated reporting pathways: The legislation clarified that whistleblowers may now report directly to an external authority — such as a regulator or the French Anti-Corruption Agency (AFA) — without first exhausting internal channels. This removes a significant procedural barrier that had previously deterred disclosures.
- Enhanced protection against retaliation: The list of prohibited retaliatory acts was materially expanded to include subtle forms of harm such as negative performance reviews, withholding of training opportunities, and coercive psychiatric referrals.
- Protection for facilitators: The Loi Waserman extended formal legal protection to individuals who assist a whistleblower — including colleagues, trade union representatives, and legal advisers — recognising that retaliation can extend beyond the person who makes the initial report.
- Provisional interim measures: Courts may now order provisional measures to protect a whistleblower from ongoing retaliation during the course of legal proceedings, providing more immediate relief than was previously available.
Compliance Obligations for Organisations Operating in France
The combined effect of Sapin II and the Loi Waserman is a compliance landscape that demands genuine organisational commitment rather than cosmetic box-ticking. Companies above the fifty-employee threshold — and, for many obligations, those above 250 employees — must maintain an internal alert system that meets strict requirements around accessibility, confidentiality, data protection, and timely acknowledgement of reports. Organisations are also required to document procedures, communicate them clearly to staff, and ensure that any person responsible for receiving and handling reports is appropriately trained.
The French Anti-Corruption Agency plays an active role in monitoring compliance, particularly in relation to anti-corruption programmes, and has issued detailed recommendations that sit alongside the legislation. Regulators in other sectors — including financial markets and environmental authorities — have similarly signalled their expectation that supervised entities maintain robust reporting infrastructure.
Non-compliance carries reputational risk as well as legal exposure. In an environment where employees, journalists, and civil society organisations are increasingly aware of their rights under French law, a poorly designed or absent internal channel can itself become a catalyst for public disclosure.
Organisations that have not yet reviewed their whistleblowing infrastructure in light of the Loi Waserman should treat that review as a matter of urgency. A secure, confidential, and independently operated whistleblowing channel is not merely best practice — under French law, it is a legal requirement. Engaging a specialist whistleblowing services provider ensures that your organisation meets its obligations, protects those who come forward, and demonstrates to regulators and stakeholders that your commitment to ethical conduct is genuine.