Imported from JiayiV/question_mixing (
skills/public-03-claude-skills-main-legal-whistleblower-compliance-references-regulatory-framework-81a5ab6c/SKILL.md). Install upstream withnpx skills add JiayiV/question_mixing --skill public-03-claude-skills-main-legal-whistleblower-compliance-references-regulatory-framework-81a5ab6c. Copyright stays with the author.
Whistleblower Regulatory Framework
Multi-jurisdiction reference covering EU Directive 2019/1937, US SOX/Dodd-Frank, and UK Public Interest Disclosure Act 1998.
Table of Contents
- EU Directive 2019/1937
- US SOX Section 806
- US Dodd-Frank Act
- UK Public Interest Disclosure Act 1998
- Jurisdiction Comparison Matrix
- Protected Persons by Jurisdiction
- Reporting Channel Requirements
- Penalties for Non-Compliance
EU Directive 2019/1937
Scope
Material Scope -- Breaches of EU law in the following areas:
| Area | Examples |
|---|---|
| Public procurement | Bid rigging, conflict of interest, fraud |
| Financial services | Market manipulation, insider dealing, AML violations |
| Product safety | Non-compliant products, safety defects |
| Transport safety | Aviation, maritime, rail safety violations |
| Environmental protection | Pollution, waste disposal, emissions |
| Radiation protection / nuclear safety | Safety standard violations |
| Food and feed safety | Contamination, labeling fraud |
| Animal health and welfare | Cruelty, welfare standard breaches |
| Public health | Pharmaceutical fraud, medical device safety |
| Consumer protection | Unfair practices, product misrepresentation |
| Privacy and data protection | GDPR breaches, unauthorized processing |
| Network and information security | Cybersecurity incident concealment |
| Competition and state aid | Cartel activity, illegal state aid |
| Corporate tax | Tax fraud, aggressive tax planning |
Personal Scope -- Who is protected:
- Workers (employees, civil servants, self-employed)
- Shareholders and members of administrative/management/supervisory bodies
- Volunteers and paid/unpaid trainees
- Persons working under supervision of contractors, subcontractors, suppliers
- Former workers and job applicants
- Facilitators (persons assisting the reporter)
- Third persons connected with the reporter (colleagues, relatives)
- Legal entities owned/controlled by the reporter
Three Reporting Channels
1. Internal Reporting
| Requirement | Detail |
|---|---|
| Applicability | Mandatory for entities with 50+ employees; all public sector entities |
| Channel types | Must support written and/or oral reporting; in-person meetings on request |
| Acknowledgment | Within 7 calendar days of receipt |
| Feedback | Within 3 months from acknowledgment date |
| Designated person | Impartial person or department designated for follow-up |
| Record keeping | Maintain records in compliance with confidentiality requirements |
| Shared resources | Entities with 50-249 employees may share resources for receiving and investigating |
2. External Reporting (Competent Authority)
| Requirement | Detail |
|---|---|
| When available | Reporters may go directly to external channel without internal first |
| Authority | Each Member State designates competent authorities |
| Acknowledgment | Within 7 days unless reporter requests otherwise |
| Feedback | Within 3 months (extendable to 6 months in duly justified cases) |
| Follow-up | Authority must investigate and communicate outcome |
3. Public Disclosure
| Requirement | Detail |
|---|---|
| Condition 1 | Reporter first reported externally but no appropriate action within timeframe |
| Condition 2 | Imminent or manifest danger to public interest |
| Condition 3 | External reporting would risk retaliation or evidence destruction |
| Protection | Full protection if conditions met |
Protections
| Protection | Description |
|---|---|
| Prohibition of retaliation | Comprehensive list of prohibited retaliatory measures |
| Burden of proof reversal | If reporter suffers detriment, employer must prove it was not retaliation |
| Interim relief | Access to interim remedies pending legal proceedings |
| Waiver of liability | No liability for breach of confidentiality if report made in compliance |
| No criminal/civil liability | For acquiring or accessing information reported (unless criminal act) |
| Legal aid | Access to legal advice and representation |
| Support measures | Information, advice, and practical assistance from competent authorities |
Penalties
Member States must provide effective, proportionate, and dissuasive penalties for:
- Hindering or attempting to hinder reporting
- Retaliatory measures against reporters
- Vexatious proceedings against reporters
- Breaching confidentiality duty
- Knowingly making false reports (proportionate penalties)
US SOX Section 806
Scope
| Element | Detail |
|---|---|
| Applicability | Public companies (SEC registrants), subsidiaries, contractors, subcontractors, agents |
| Protected persons | Employees of covered companies |
| Protected disclosures | Fraud against shareholders, securities fraud, bank fraud, wire fraud, mail fraud, violations of SEC rules |
Protections
| Protection | Detail |
|---|---|
| Anti-retaliation | Cannot discharge, demote, suspend, threaten, harass, or discriminate |
| Filing deadline | Complaint with OSHA within 180 days of adverse action |
| OSHA investigation | OSHA investigates; preliminary reinstatement if reasonable cause found |
| Federal court | If OSHA does not issue final decision within 180 days, reporter may file in federal court |
| Remedies | Reinstatement, back pay with interest, compensatory damages, attorney fees |
Procedural Requirements
| Step | Timeline | Action |
|---|---|---|
| 1. Filing | Within 180 days | File complaint with OSHA |
| 2. OSHA investigation | 30-60 days typical | OSHA investigates, interviews, gathers evidence |
| 3. Preliminary order | If reasonable cause | Preliminary reinstatement, back pay |
| 4. ALJ hearing | If objected | Administrative Law Judge hearing |
| 5. ARB review | Appeal | Administrative Review Board |
| 6. Federal court | If no final decision in 180 days | File in appropriate federal district court |
US Dodd-Frank Act
Scope
| Element | Detail |
|---|---|
| Applicability | Broader than SOX; covers violations of securities laws reported to SEC |
| Protected persons | Any individual who provides information to SEC |
| Key distinction | Original information leading to successful enforcement action >$1M |
SEC Bounty Program
| Element | Detail |
|---|---|
| Eligibility | Original information leading to enforcement action with sanctions >$1M |
| Award range | 10-30% of monetary sanctions collected |
| Minimum sanction | $1,000,000 |
| Filing | Submit via SEC Tip, Complaint, or Referral (TCR) system |
| Anonymity | May report anonymously through attorney |
Anti-Retaliation
| Protection | Detail |
|---|---|
| Scope | Broader than SOX; covers reporting to SEC, assisting SEC, making required Dodd-Frank disclosures |
| Statute of limitations | 6 years from violation or 3 years from when facts became known (max 10 years) |
| Remedies | Reinstatement, double back pay with interest, litigation costs, attorney fees |
| Jury trial | Right to jury trial in federal court |
UK Public Interest Disclosure Act 1998
Scope
| Element | Detail |
|---|---|
| Legislation | Employment Rights Act 1996, Part IVA (inserted by PIDA 1998) |
| Protected persons | Workers (broader than employees: includes agency workers, contractors, trainees, NHS practitioners) |
| Not covered | Self-employed (other than workers), volunteers, intelligence services |
Qualifying Disclosures
A qualifying disclosure is one where the worker reasonably believes it shows one or more of:
| Category | Examples |
|---|---|
| Criminal offence | Fraud, theft, bribery, tax evasion |
| Breach of legal obligation | Contract, statutory duty, regulatory requirement |
| Miscarriage of justice | Wrongful conviction, procedural failures |
| Danger to health or safety | Workplace hazards, public health risks |
| Damage to environment | Pollution, contamination, waste |
| Deliberate concealment | Covering up any of the above |
Prescribed Persons
| Prescribed Person | Jurisdiction |
|---|---|
| Financial Conduct Authority (FCA) | Financial services regulation |
| Prudential Regulation Authority (PRA) | Prudential financial regulation |
| Health and Safety Executive (HSE) | Workplace safety |
| Environment Agency | Environmental protection |
| Information Commissioner's Office (ICO) | Data protection |
| Serious Fraud Office (SFO) | Serious/complex fraud |
| Care Quality Commission (CQC) | Health and social care |
| Ofsted | Education and children's services |
Protections
| Protection | Detail |
|---|---|
| Automatic unfair dismissal | Dismissal for making qualifying disclosure is automatically unfair |
| Detrimental treatment | Cannot subject worker to detriment for making disclosure |
| No qualifying period | No minimum service period required (unlike standard unfair dismissal) |
| No compensation cap | Compensation is uncapped (unlike standard unfair dismissal) |
| Interim relief | Can apply for interim relief within 7 days of dismissal |
| Employment tribunal | Claims heard by employment tribunal |
Reasonable Belief Standard
The worker must have a reasonable belief that:
- The information disclosed tends to show one or more of the qualifying matters
- The disclosure is made in the public interest (not purely personal grievance)
The belief does not need to be correct, only reasonable at the time of disclosure.
Jurisdiction Comparison Matrix
| Feature | EU Directive 2019/1937 | US SOX Section 806 | US Dodd-Frank | UK PIDA 1998 |
|---|---|---|---|---|
| Scope | EU law breaches (broad) | Securities/financial fraud | SEC violations | Qualifying disclosures (6 types) |
| Protected persons | Very broad (workers, shareholders, facilitators) | Employees of public companies | Anyone reporting to SEC | Workers (broad definition) |
| Internal channel required | Yes (50+ employees) | Yes (audit committee) | No | No (but recommended) |
| External channel | Competent authority | OSHA | SEC | Prescribed persons |
| Acknowledgment timeline | 7 days | None specified | None specified | None specified |
| Feedback timeline | 3 months | OSHA investigation timeline | SEC investigation | None specified |
| Burden of proof | Reversed (employer must prove no retaliation) | Employee bears initial burden | Employee bears initial burden | Employee proves disclosure; employer proves reason for treatment |
| Financial reward | Not required | Reinstatement + back pay | 10-30% bounty | Compensation (uncapped) |
| Filing deadline | Per national transposition | 180 days (OSHA) | 6 years / 3 years knowledge | 3 months (employment tribunal) |
| Anonymity | Encouraged | Permitted | Permitted (via attorney) | Not required |
| Public disclosure protection | Yes (conditions apply) | Limited | Limited | Yes (last resort) |
Protected Persons by Jurisdiction
| Person Type | EU | US (SOX) | US (Dodd-Frank) | UK |
|---|---|---|---|---|
| Employees | Yes | Yes | Yes | Yes |
| Former employees | Yes | No | Yes | Yes |
| Job applicants | Yes | No | No | No |
| Contractors/subcontractors | Yes | Yes | Yes | Yes |
| Self-employed | Yes | No | Yes | No |
| Shareholders | Yes | No | Yes | No |
| Board members | Yes | No | Yes | No |
| Volunteers | Yes | No | No | No |
| Trainees | Yes | No | No | Yes |
| Facilitators | Yes | No | No | No |
| Connected third parties | Yes | No | No | No |
Reporting Channel Requirements
| Requirement | EU | US (SOX) | US (Dodd-Frank) | UK |
|---|---|---|---|---|
| Internal channel mandatory | Yes (50+ employees) | Yes (audit committee) | No | No |
| Written reporting | Required | Recommended | SEC form/portal | Any form |
| Oral reporting | Required | Not specified | Permitted | Any form |
| In-person meeting | On request | Not specified | Not specified | Not specified |
| Anonymous reporting | Permitted (encouraged) | Permitted | Permitted (via attorney) | Not required |
| External authority | Competent authority | OSHA | SEC | Prescribed persons |
| Public disclosure | Protected (conditions) | Limited | Limited | Protected (conditions) |
Penalties for Non-Compliance
| Jurisdiction | Penalty Type | Detail |
|---|---|---|
| EU | Member State defined | Must be effective, proportionate, dissuasive |
| EU | Retaliation | Civil/criminal penalties per national law |
| EU | Hindering reporting | Penalties specified by Member States |
| EU | False reports | Proportionate penalties for knowingly false disclosures |
| US (SOX) | Criminal | Up to 10 years imprisonment for retaliation |
| US (SOX) | Civil | Reinstatement, double back pay, attorney fees |
| US (Dodd-Frank) | Civil | Double back pay with interest, litigation costs |
| UK | Employment tribunal | Uncapped compensation for unfair dismissal |
| UK | Interim relief | Continuation of employment pending hearing |
| UK | Costs | Employer may bear costs if claim succeeds |