Enhancing whistleblower protection in Spain: Establishment of an independent reporting body (Update)

At a glance

• Spain have implemented the EU Whistleblowing Directive, creating the Independent Authority for Whistleblower Protection (Spanish A.A.I).
• The internal rules for the Spanish A.A.I have been set up through the implementation act.
• Once the Spanish A.A.I. begins operations, companies will have two months to designate and communicate the individual responsible for the reporting channel within the organisation.

Update 9 June 2025

On 9 May 2025, Manuel Villoria Mendieta was officially appointed as the President of the newly established Independent Whistleblower Protection Authority. The ceremony was attended by Félix Bolaños, the Minister of the Presidency, Justice, and Relations with the Courts. Bolaños emphasised the government's commitment to combating corruption through the Democracy Action Plan.

Villoria, a distinguished professor of Political Science at the Universidad Rey Juan Carlos, brings extensive experience in governance, ethics, and public deontology. The new authority, created under the law regulating the protection of whistleblowers, aims to provide a secure channel for reporting violations, ensuring anonymity, and offering financial and psychological support to informants. The authority will operate independently from the government and other organizations, with the power to impose sanctions and advise the government on related matters. Despite the appointment there is not a website or a clear channel to communicate with the authority at this stage.

In response to the EU Whistleblowing Directive, Spain enacted Law 2/2023 (Spanish Implementation Act), creating the Spanish A.A.I, an autonomous administrative body with full operational capacity and legal personality, independent of government influence.

The Spanish Government has published the internal working rules and financing sources for the Spanish A.A.I. Companies have two months from the start of the Spanish A.A.I's operations to designate the individual or body responsible for the internal reporting channel.

The Spanish A.A.I acts as an external reporting channel, complementing internal channels required for certain companies, and operates under specific regulations. Its core functions include:

• serving as the primary external reporting channel for secure and confidential violation reports;
• protecting whistleblowers through anonymity and anti-retaliation measures;
• providing mandatory reports on draft legislation and regulations within its scope;
• managing disciplinary proceedings and imposing sanctions; and
• promoting a culture of whistleblowing.

Additionally, any changes in the designated individual or collegiate body responsible for the internal reporting system must be notified to the Spanish A.A.I. within ten working days, along with the reasons for removal.

In summary, the Spanish A.A.I is crucial for maintaining ethical standards and protecting whistleblowers, operating independently to ensure a secure framework for whistleblower protection in Spain.