I need to bring my Luxembourg organisation into compliance with recital 20 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 20 acknowledges a reality that many Luxembourg financial institutions ignore: the whistleblowing directive does not replace sectoral regimes, it complements them. Concretely, a CSSF-supervised bank, a PSF, a management company or an insurance undertaking must layer the obligations of MAR (596/2014), the 4th/5th anti-money laundering directives, PRIIPs (1286/2014) and Directive 2019/1937. The CSSF and the CAA regularly sanction incomplete internal arrangements because the firm applied either the sectoral regime or the general one, never both stacked together.The multi-layer alignment to operationaliseThe legislator's intent is clear: Directive 2019/1937 sets a minimum floor, sectoral acts add specific requirements. You must therefore verify the following points for each regulated entity:Does the internal channel cover all reports targeted by MAR (market abuse, manipulation) and by Directive 2019/1937 (broad EU breaches)?Are the feedback deadlines (7-day acknowledgment, 3-month feedback) of Directive 2019/1937 respected even for MAR or AML reports?Do the strengthened anti-retaliation protections of the Luxembourg law of 16 May 2023 also apply to whistleblowers reporting under sectoral regimes?Can external reports be addressed at the whistleblower's choice to the CSSF, the CAA, the OFRS or the CNPD depending on the nature of the facts, without imposed hierarchy?Is the mapping of channels documented in a single enforceable procedure, or scattered across 4 contradictory sectoral policies?The fatal trap: believing that the existing MAR arrangement is sufficient. It is not. Directive 2019/1937 broadens the material scope (GDPR, environment, public health, taxation) and imposes procedural safeguards that MAR does not provide.How Luxgap automates this riskOur Luxgap Whistleblowing Channel Orchestrator eliminates the risk of inconsistency between sectoral and general regimes by automatically mapping, for each incoming report, the full set of applicable legal bases and the procedural obligations that flow from them. The tool integrates natively with your CSSF reference data (PSF, UCI, UCITS), CAA, FIU and with your activity register in Odoo or SAP to derive your regulatory qualification and trigger the right requirements matrix.Classifies each incoming report by legal basis (MAR, AML, PRIIPs, GDPR, Directive 2019/1937) via an AI agent that analyses the report content and proposes the qualification to the DPO or compliance officer.Automatically generates the strictest applicable handling workflow by combining the deadlines and safeguards of the sectoral regimes and the Luxembourg law of 16 May 2023.Routes the external report to the correct authority (CSSF, CAA, OFRS, CNPD, ITM, ILR) based on the detected material domain, and preserves a timestamped trace of the choice left to the whistleblower.Detects grey zones where several authorities are competent and proposes a documented coordination strategy, enforceable during inspections.P...

Recital 20 Whistleblowing — Recital 20

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 20

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(20)

Certain Union acts, in particular in the area of financial services, such as Regulation (EU) No 596/2014 of the European Parliament and of the Council (28), and Commission Implementing Directive (EU) 2015/2392 (29), adopted on the basis of that Regulation, already contain detailed rules on whistleblower protection. Any specific rules in that regard provided for in such existing Union legislation, including the Union acts listed in Part II of the Annex to this Directive, which are tailored to the relevant sectors, should be maintained. This is of particular importance for ascertaining which legal entities in the area of financial services, the prevention of money laundering and terrorist financing are currently obliged to establish internal reporting channels. At the same time, in order to ensure consistency and legal certainty across Member States, this Directive should be applicable in respect of all matters not regulated under the sector-specific acts, and thereby should complement such acts, so that they are fully aligned with minimum standards. In particular, this Directive should provide further detail as to the design of the internal and external reporting channels, the obligations of competent authorities, and the specific forms of protection to be provided at national level against retaliation. In that regard, Article 28(4) of Regulation (EU) No 1286/2014 of the European Parliament and of the Council (30) provides for Member States to be able to provide for an internal reporting channel in the area covered by that Regulation. For reasons of consistency with the minimum standards laid down by this Directive, the obligation to establish internal reporting channels provided for in this Directive should also apply in respect of Regulation (EU) No 1286/2014.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des personnes signalant des violations du droit national ou du droit de l'Union europeenne

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers confirms the articulation set out in recital 20: sectoral regimes (CSSF for MAR, AML, PRIIPs; CAA for insurance) remain applicable, and the Office des rapports de signalement (OFRS) acts as the residual transversal authority for all matters not covered. The 50-employee threshold triggers the internal channel obligation, with no threshold for public bodies, and criminal penalties range from 1,250 to 25,000 EUR (doubled in case of recidivism).

Luxgap practice: for any CSSF or CAA entity, explicitly document in your internal policy which reports fall under the sectoral regime and which fall under the general regime, and guarantee the whistleblower's free choice of external authority among CSSF, CAA, OFRS, CNPD, ITM or ILR.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 20 acknowledges a reality that many Luxembourg financial institutions ignore: the whistleblowing directive does not replace sectoral regimes, it complements them. Concretely, a CSSF-supervised bank, a PSF, a management company or an insurance undertaking must layer the obligations of MAR (596/2014), the 4th/5th anti-money laundering directives, PRIIPs (1286/2014) and Directive 2019/1937. The CSSF and the CAA regularly sanction incomplete internal arrangements because the firm applied either the sectoral regime or the general one, never both stacked together.

The multi-layer alignment to operationalise

The legislator's intent is clear: Directive 2019/1937 sets a minimum floor, sectoral acts add specific requirements. You must therefore verify the following points for each regulated entity:

Does the internal channel cover all reports targeted by MAR (market abuse, manipulation) and by Directive 2019/1937 (broad EU breaches)?
Are the feedback deadlines (7-day acknowledgment, 3-month feedback) of Directive 2019/1937 respected even for MAR or AML reports?
Do the strengthened anti-retaliation protections of the Luxembourg law of 16 May 2023 also apply to whistleblowers reporting under sectoral regimes?
Can external reports be addressed at the whistleblower's choice to the CSSF, the CAA, the OFRS or the CNPD depending on the nature of the facts, without imposed hierarchy?
Is the mapping of channels documented in a single enforceable procedure, or scattered across 4 contradictory sectoral policies?

The fatal trap: believing that the existing MAR arrangement is sufficient. It is not. Directive 2019/1937 broadens the material scope (GDPR, environment, public health, taxation) and imposes procedural safeguards that MAR does not provide.

How Luxgap automates this risk

Our Luxgap Whistleblowing Channel Orchestrator eliminates the risk of inconsistency between sectoral and general regimes by automatically mapping, for each incoming report, the full set of applicable legal bases and the procedural obligations that flow from them. The tool integrates natively with your CSSF reference data (PSF, UCI, UCITS), CAA, FIU and with your activity register in Odoo or SAP to derive your regulatory qualification and trigger the right requirements matrix.

Classifies each incoming report by legal basis (MAR, AML, PRIIPs, GDPR, Directive 2019/1937) via an AI agent that analyses the report content and proposes the qualification to the DPO or compliance officer.
Automatically generates the strictest applicable handling workflow by combining the deadlines and safeguards of the sectoral regimes and the Luxembourg law of 16 May 2023.
Routes the external report to the correct authority (CSSF, CAA, OFRS, CNPD, ITM, ILR) based on the detected material domain, and preserves a timestamped trace of the choice left to the whistleblower.
Detects grey zones where several authorities are competent and proposes a documented coordination strategy, enforceable during inspections.
Produces a timestamped, cryptographically sealed PDF report demonstrating multi-layer alignment for each case, enforceable during CSSF or OFRS inspections.
Automatically updates the obligations mapping as soon as a sectoral act evolves (MAR amendment, new DAC, AML revision).

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your regulatory scope. Request a personalised quote and our teams will prepare a demonstration on your real regulatory map, with a free 48h blind audit to identify blind spots between your sectoral regimes and Directive 2019/1937 before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 20

They trust us

Before we chat