France's Sapin II and Loi Waserman: Tightening Whistleblower Protections for Companies

France has built one of Europe's most demanding whistleblower protection frameworks, and organisations operating in the country — whether domestic or foreign — cannot afford to treat compliance as optional. The successive enactment of the Sapin II law in 2016 and the Loi Waserman in 2022 has dramatically raised the bar, extending protections, broadening definitions, and tightening procedural requirements in ways that directly affect how companies design and operate their internal reporting systems.

Sapin II: Laying the Foundation

Enacted in December 2016, the Sapin II law — formally the Law on Transparency, the Fight against Corruption and the Modernisation of Economic Life — introduced a comprehensive national definition of a whistleblower for the first time. Under Sapin II, a whistleblower is an individual who discloses, in a disinterested and good-faith manner, a crime, a misdemeanour, a serious and manifest violation of an international commitment, a unilateral act of an international organisation based on such a commitment, law, or regulation, or a serious threat to the public interest.

Critically, the law imposed a legal obligation on companies employing at least fifty employees, as well as on public authorities and certain other entities, to establish internal reporting procedures. These procedures were required to be clearly documented, communicated to staff, and capable of guaranteeing the confidentiality of the whistleblower's identity and the information disclosed. Failure to implement a compliant procedure exposed organisations to regulatory scrutiny and reputational damage.

While Sapin II was widely regarded as a landmark piece of legislation, practitioners identified gaps over the following years. Protections were not always applied consistently by courts, and the hierarchical requirement — obliging whistleblowers to exhaust internal channels before going externally — was criticised as placing undue burden on the very individuals the law sought to protect.

Loi Waserman: Transposing the EU Directive and Going Further

The European Union's Whistleblowing Directive, adopted in October 2019, required member states to transpose its provisions by December 2021. France took the opportunity not merely to meet minimum standards but to go further. The Loi Waserman, which entered into force in March 2022, substantially reformed the original Sapin II framework in several important respects.

• Broader definition of whistleblower: The Loi Waserman removed the requirement that disclosures be made in a purely disinterested manner — a threshold that had proven difficult to meet in practice — replacing it with a good-faith standard focused on the absence of malicious intent.
• Elimination of mandatory internal reporting hierarchy: Whistleblowers are no longer required to use internal channels before approaching a competent external authority. They may choose whichever route they consider appropriate, which significantly reduces the risk of retaliation at an early stage.
• Extended protection against retaliation: The law broadens the categories of prohibited retaliatory measures and extends personal protection to a wider group, including facilitators, colleagues, and relatives of the whistleblower who may also be targeted.
• Financial and legal support: The Défenseur des Droits (the French Ombudsman) can now provide provisional financial assistance to whistleblowers facing economic hardship as a consequence of their disclosure.
• Strengthened confidentiality obligations: Organisations must ensure that identity-related information is strictly protected throughout the entire process, with breaches of confidentiality exposed to criminal liability.

The Loi Waserman also refined the sanctions framework. Obstructing a whistleblower's report, breaching confidentiality obligations, or retaliating against a protected individual can result in significant criminal and civil penalties for both the organisation and responsible individuals within it.

What This Means for Compliance Teams

For legal, compliance, and HR professionals operating in France, the combined effect of Sapin II and Loi Waserman is unambiguous: a robust, confidential, and accessible internal reporting channel is a legal requirement, not merely good practice. Organisations must ensure that their procedures meet the following baseline standards:

• Clear written procedures that are communicated to all employees and accessible at all times.
• Strict confidentiality safeguards covering the whistleblower's identity, the identity of any person implicated, and the substance of the report.
• Reasonable and documented timeframes for acknowledging receipt of a report and providing feedback to the reporting person.
• Effective protection against any form of retaliation, including demotion, dismissal, harassment, or adverse changes to working conditions.
• Governance arrangements that ensure reports are handled independently and without conflicts of interest.

Regulators and courts in France have demonstrated a growing willingness to examine whether internal procedures are genuinely effective rather than merely formal. A policy that exists on paper but is not embedded in organisational culture is unlikely to satisfy regulatory expectations and will not protect the organisation in the event of a dispute.

Organisations that have not yet reviewed their whistleblowing procedures in light of Loi Waserman — or that still rely on informal reporting arrangements — face material legal and reputational exposure. Securing a professionally managed, legally compliant whistleblowing service is no longer optional. Providers such as Whistleblowing.services offer purpose-built platforms designed to meet the confidentiality, accessibility, and governance requirements imposed by French law and equivalent frameworks across the EU. Now is the time to act.