It is one of the most common issues in international groups:

Can the parent company handle all whistleblowing reports for the whole group?

The answer is:

Yes - but not without preconditions.

The starting point is in EU Directive (EU) 2019/1937.

1. the obligation applies per legal entity

The Directive requires legal entities in the private sector with 50 or more employees to establish internal channels and procedures for reporting (Article 8).

This applies per legal entity.

This means that:

• A subsidiary with 60 employees is subject to the obligation.

• A parent company with 10 employees is not covered simply because of the overall size of the group.

The Directive does not refer to ”groups” as a common legal duty bearer.

The obligation is linked to each individual legal person.

2. may the group centralize the function?

Yes.

The Directive does not prohibit the reporting function from being organized jointly within a group.

In practice, this can mean that:

• A parent company receives reports for subsidiaries.

• A common group platform is used.

• A central compliance or legal function handles cases.

But this does not change the basic responsibility.

Each legal entity must be able to ensure that:

• Reporting is possible.

• Confidentiality requirements are met.

• Feedback is provided within the prescribed time.

• Follow-up is carried out correctly.

Centralization must not undermine these requirements.

3. confidentiality and independence

The Directive sets clear requirements:

• Confidentiality of the identity of the reporting person.

• Restricted access to data.

• Protection against retaliation.

Group solutions raise specific issues:

• Who has access to the information?

• Can local management have access to sensitive cases?

• How are matters concerning the parent company's management handled?

A central function can strengthen independence - but only if the structure is well thought out.

4. Small subsidiaries in large groups

A common situation is:

• The group has thousands of employees.

• One subsidiary has 20 employees.

If the subsidiary has fewer than 50 employees, it is normally not subject to the obligation to establish its own internal channel under the Directive.

Men:

If the group chooses to offer a common function, these companies can also be covered in practice.

It is allowed - and often wise - but it is a voluntary organizational choice rather than a direct legal requirement at EU level.

5. Who is responsible in case of shortcomings?

This is a crucial issue.

Even if reception is centralized, each legal entity must be able to demonstrate that:

• The requirements of the Directive are met.

• Follow-up is done correctly.

• Protection against retaliation is ensured locally.

A group structure does not change the legal responsibility at entity level.

Conclusion

Is the parent company allowed to handle all whistleblowing reports?

Yes - it is possible to centralize the function within a group.

Men:

• The obligation to have a function applies per legal entity.

• Centralization must not reduce the requirements for confidentiality, feedback and follow-up.

• Responsibility cannot be fully ”moved up” to group level.

A group solution therefore requires a clear structure, clear mandates and documented responsibilities.