The French whistleblower law, loi Waserman, and what it asks of an employer
The French whistleblower law, known as the loi Waserman, asks every employer with 50 or more staff to run an
internal reporting channel. It was passed as loi n° 2022-401 of 21 March 2022, and it works by rewriting the
2016 Sapin II law to carry the EU Whistleblower Directive into French law. The rules have applied since
1 September 2022. France ended up with one of the more protective regimes in Europe, and a reporter
there can skip the employer entirely and still keep every protection.
Which employers must comply with the loi Waserman?
Employers with 50 or more staff must comply with the loi Waserman. That covers the private sector and the public
sector alike. Regulated firms are caught at any size. A bank or a finance house owes the duty from its first
employee, because Directive (EU) 2019/1937 reaches those sectors directly. Towns of fewer than 10,000 residents
are let off. They can still pass the job to the territorial civil service management centre. Firms under
250 staff may share their reporting procedures with each other. A group may also run a single channel
across several of its companies. The operating detail sits in a second text, décret n° 2022-1284 of 3 October
2022.
How do you set up the internal reporting channel in France?
You set up the internal reporting channel in France after consulting the staff representative bodies. Skip that
step and the whole procedure is exposed. With no procedure in place, a report just goes to the line manager, the
employer, or a referent they name. The October 2022 décret then frames the channel itself. You
acknowledge a report within 7 days and give feedback within 3 months. That second clock covers the
feedback, not the end of the inquiry. WeMoral takes the alerts in for the referent and keeps each one private,
and the worker still decides whether the case then goes on to the Défenseur des droits. A specialist adviser can
hold the referent role instead, and many French firms hand it out that way.
What the October 2022 décret requires of a French internal channel.
| Requirement | What it means in practice |
|---|
| Independence | Guarantees of independence and impartiality in how each report is handled |
| Anonymous intake | Anonymous reports accepted alongside named ones |
| Confidentiality | The whistleblower, the people named and any third parties all kept confidential |
| Data | Handled under the GDPR and kept only as long as needed |
| Outsourcing | A specialist provider may run the channel for the employer |
What can a French whistleblower report?
A French whistleblower can report a crime, an offence, a threat or harm to the general interest, and a breach of
the law. The breach limb is broad. It covers a treaty France has signed, European Union law, and French statute
and regulation alike. An attempt to hide any of those counts too. Five secrets stay
outside the regime. Those five are defence secrecy, medical confidence, the secrecy of court rulings,
the secrecy of an inquiry, and lawyer client privilege. For everything else the alert is protected. Two
conditions ride with it. The reporter has to act in good faith. They may take no direct payment for the
report.
Who is a whistleblower under French law?
Under French law a whistleblower is a natural person who reports information learned through their work. Article 6 opens the internal route to current staff, former workers and
job candidates. Shareholders, partners and holders of voting rights are in. So are members of the board and of
management and supervisory bodies. External and occasional contributors count, and so do the employer's
contractors and subcontractors and their staff. Article 6-1 stretches cover past the reporter to
facilitators, who may be a non-profit body such as an association or a trade union. Natural persons
linked to the reporter are covered. So are legal entities they control, and colleagues who risk payback.
How does French law protect a whistleblower from retaliation?
French law protects a whistleblower from retaliation the moment a report or public disclosure is made. One
condition applies. The reporter needed fair reason at the time to believe the information was true and fell
inside the law. The banned reprisals run to fifteen measures, and the list is open ended. A threat to use one of
them counts as much as the act. An act of retaliation is void from the start, so in law it never
happened. The reporter can have it set aside and claim payment for the harm. Any clause that waives
or limits these rights is void as well, in any form at all. A settlement or an exit agreement cannot buy
silence.
The fifteen banned reprisals under the loi Waserman, and the list is open ended.
| Group | Measures named in the law |
|---|
| Ending the job | Dismissal, suspension, a non renewed contract, a fixed term left unconverted |
| Downgrading it | Demotion, a refused promotion, a transfer of duties, a pay cut, suspended training |
| Personal pressure | Intimidation, harassment, freeze outs, discrimination, a negative review |
| After the job | Harm to a reputation, blacklisting, financial sanctions |
Who has to prove retaliation in a French case?
The employer has to prove retaliation was not the reason, in any French case. The reporter only puts forward
facts suggesting they reported by the book. The employer then shows its decision rested on unrelated grounds.
Immunity runs alongside that shift. A good faith reporter answers neither in civil law for harm caused by the
alert, nor in criminal law under article 122-9 of the Criminal Code. They can no longer be prosecuted
for taking documents they accessed lawfully, as long as they then report them as the law requires.
That protection is rare in Europe, where few other acts say plainly whether a reporter may take the evidence
with them.
What are the three reporting routes in France?
The three reporting routes in France are the internal channel, the external channel and public disclosure.
- The internal channel. The employer's own system, advised where the breach can be fixed in
house with no risk of payback.
- The external channel. A competent authority, the Défenseur des droits, the courts or an EU
body. Since 2022 a reporter may go there first, with no internal report at all.
- Public disclosure. Telling the public, the press included. It is open only on grave and
urgent danger, on official inaction, or where payback looks likely.
The October 2022 décret names the external authorities sector by sector. The financial markets regulator and
the French Anti-Corruption Agency are two of them. From 1 July 2026, décret n° 2026-311 of 24 April 2026 adds
Tracfin, the financial intelligence unit, for money laundering and terrorist financing. The Défenseur des droits
steers each reporter to the body best placed to act, and collects a yearly account from every one of them. Free
choice of channel is the real change of 2022. The old Sapin II rule made staff report inside the firm first.
What does breaking the French whistleblower law cost?
Breaking the French whistleblower law costs a year in prison and €15,000 for getting in the way of a report.
Leaking the reporter's identity is punished harder, at two years and €30,000. France went after gag lawsuits
too. A judge can impose a civil fine of up to €60,000 where an abusive suit is aimed at silencing a
whistleblower, on top of any damages owed, and can order the ruling published. Support runs the other
way. The labour court can order an employer to top up the reporter's personal training account. The external
authorities can arrange psychological support. They can also grant temporary financial aid where the reporter's
finances fell apart because of the alert.
Which whistleblowing software fits the loi Waserman?
Whistleblowing software fits the loi Waserman when it takes anonymous reports, keeps three groups confidential
and holds the 7 day and 3 month clocks. WeMoral is secure whistleblowing software, delivered as
SaaS and kept patched, so the employer's side of the job is the procedure and the referent. The case data never leaves Frankfurt. Every report and every reply travels encrypted and
sits encrypted in storage. The form keeps no IP address. Uploads lose their hidden data before a handler opens
them. Anonymous intake is how the form ships, and a name field is a setting rather than a second product.
WeMoral PRO costs €79 a month, net, and the branded reporting page goes live in under 5
minutes. Nothing is opened or altered without the audit log naming who did it and when. That is the
record a French authority will ask to see.
Where to start if your French channel is not running yet
If your French channel is not running yet, start with the procedure and the staff consultation. Both take
longer than the software does. The technical half is quick. A buyer can price WeMoral and launch it
without a sales call, because the rate sits on the page before anyone picks up the phone. Reporters
and case handlers each pick from 25 languages. A French parent can therefore cover its sites abroad from the
same channel. PRO covers five panel users. Enterprise lifts that to unlimited, and adds single sign on and a
reporting page on your own corporate domain. Open cases move across from a tool you already run, without
downtime. The regime has applied since September 2022, so a channel that is not running yet is already late.
