France has progressively strengthened its whistleblowing framework through Sapin II and the landmark Loi Waserman, imposing stricter obligations on organisations to establish secure, confidential reporting channels.
France has positioned itself as one of Europe's most rigorous jurisdictions for corporate whistleblowing compliance. Through successive legislative reforms — first with the Sapin II law of 2016 and then the transformative Loi Waserman of 2022 — French lawmakers have systematically expanded the obligations placed on private and public sector organisations, raising the bar for how whistleblowers must be protected and how reports must be handled. For any multinational with a French presence, understanding these two pillars of French whistleblowing law is no longer optional; it is a fundamental compliance requirement.
The Foundation: What Sapin II Established
Enacted in December 2016, the Sapin II law — formally the Loi relative à la transparence, à la lutte contre la corruption et à la modernisation de la vie économique — introduced France's first comprehensive whistleblower statute. The law created a unified legal definition of a whistleblower: a person who discloses, in a disinterested and good-faith manner, a crime, misdemeanour, serious threat to the public interest, or a violation of an international commitment ratified by France.
Critically, Sapin II imposed mandatory internal reporting obligations on companies employing fifty or more employees, as well as on public institutions above a certain threshold. Organisations were required to establish a dedicated internal reporting procedure, maintain confidentiality of the whistleblower's identity, and protect reporting individuals from retaliation. The Agence française anticorruption (AFA) was established under the same law to supervise anti-corruption compliance and issue guidance on whistleblowing procedures.
While Sapin II was a significant step forward, practitioners noted limitations. The law required whistleblowers to follow a strict sequential reporting hierarchy — raising concerns internally before approaching external authorities — which critics argued could expose reporters to undue risk and deterred disclosures altogether.
Loi Waserman: Transposing the EU Directive and Going Further
The Loi Waserman, which entered into force in March 2022, transposed the European Union's Whistleblower Protection Directive (Directive 2019/1937) into French law while in several respects exceeding the Directive's minimum standards. The reforms were substantial and touched nearly every aspect of the earlier framework.
- Abolition of the sequential reporting hierarchy: Whistleblowers may now choose to report internally, directly to external competent authorities, or — in cases of serious or imminent danger — publicly, without being obliged to exhaust internal channels first. This change fundamentally alters the risk calculus for potential whistleblowers.
- Broader personal scope: Protection now extends beyond employees to include job applicants, trainees, shareholders, board members, suppliers, subcontractors, and associates — reflecting modern workplace realities where wrongdoing is often witnessed by those outside the direct employment relationship.
- Expanded subject matter: The range of reportable matters has been widened, covering breaches of EU law in areas such as financial services, product safety, environmental protection, public health, and data privacy.
- Strengthened anti-retaliation provisions: Employers are explicitly prohibited from a broader catalogue of retaliatory acts, including subtle forms such as negative performance reviews, refusal of promotion, or exclusion from training. Importantly, the burden of proof in retaliation proceedings shifts: once a whistleblower establishes a link between their disclosure and the adverse measure, the employer must demonstrate the measure was justified on independent grounds.
- Confidentiality reinforced: The identity of the whistleblower and any third parties named in a report must be protected throughout the investigation process. Deliberate breach of this confidentiality obligation is a criminal offence under French law.
- Internal procedure requirements updated: AFA has issued updated guidelines specifying the content, accessibility, and acknowledgement timelines that compliant internal reporting procedures must meet. Organisations must acknowledge receipt of a report within seven days and provide feedback on the action taken within a reasonable timeframe.
Enforcement and Practical Implications for Organisations
The AFA retains supervisory and advisory powers and can conduct on-site inspections of companies subject to the law. While the AFA's primary enforcement role centres on anti-corruption programme compliance more broadly, the whistleblowing channel forms a core pillar of any compliant programme. Failures in this area can contribute to adverse findings and reputational consequences that accompany regulatory scrutiny.
Beyond regulatory risk, there is a practical dimension: a functioning, trusted internal reporting channel is widely recognised as an organisation's first and best opportunity to detect and remedy misconduct before it escalates into a regulatory investigation, litigation, or media disclosure. Organisations that invest in credible, confidential channels benefit not only from legal compliance but from a stronger speak-up culture that supports long-term governance.
It is also worth noting that French subsidiaries of non-French parent companies are not exempt. The obligations apply to legal entities established in France that meet the employee thresholds, irrespective of where the parent is headquartered.
With France's whistleblowing framework now among the most demanding in the European Union, organisations operating in France — or with French employees, clients, or operations — have a clear legal duty to implement a secure, confidential, and independently managed whistleblowing channel that meets the requirements of both Sapin II and Loi Waserman. If your organisation has not yet reviewed its reporting procedures against the updated standards, now is the time to act. A specialist whistleblowing service provider can help you deploy a compliant, trusted channel that protects reporters, satisfies regulators, and demonstrates your commitment to ethical business conduct.