I need to bring my Luxembourg organisation into compliance with recital 35 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 35 Whistleblowing — Recital 35

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 35

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(35)	This Directive should provide for protection to be granted in cases where persons report, pursuant to Union legislation, to institutions, bodies, offices or agencies of the Union, for example in the context of fraud concerning the Union budget.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers expressly confirms that reports to EU institutions, bodies, offices or agencies benefit from the same protection as a national external report to the OFRS. In practice, an employee who alerts OLAF directly on EU budget fraud (Horizon grant, FEDER funds, EU-cofunded public tender) without going through the internal channel or the OFRS remains protected, and any retaliation exposes the employer to criminal fines of 1,250 to 25,000 EUR, doubled in case of recidivism, plus full civil compensation.

Luxgap practice: we embed in your whistleblowing charter the exhaustive and up-to-date list of relevant EU channels (OLAF, EPPO, ESMA, EDPS, European Court of Auditors) alongside the OFRS and the LU sectoral authorities (CSSF, CNPD, ITM, CAA, ILR), to eliminate any restrictive reading of your scheme during an inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Many organisations restrict their internal whistleblowing scheme to Luxembourg-only reports and forget that a whistleblower can legitimately escalate to OLAF, the European Commission, ESMA or the ECB when EU budget fraud, FEDER subsidies, EU-cofunded public procurement or cross-border banking breaches are involved. The result: the person reports directly to Brussels or Kirchberg, the employer learns about it through an official letter, and any retaliatory measure becomes an aggravated offence before the OFRS and the Luxembourg labour courts.

What this recital changes in practice for your scheme

Your internal channels and whistleblowing charter must explicitly mention the option to report to EU institutions (OLAF, European Public Prosecutor's Office, European Court of Auditors, ESMA, EBA, EIOPA, EDPS) without loss of protection.
Beneficiaries of EU funds (Horizon, FEDER, FSE+, RRF, LIFE) face heightened risk: any employee, consultant or subcontractor can alert OLAF directly, and protection even covers anonymous reports later traced back.
Manager training must build the reflex: never ask a colleague whether they contacted an EU institution, that question alone is a prohibited investigative measure.
The DPO and CISO must coordinate evidence retention: an OLAF report often triggers requests for Microsoft 365 logs, Sage BOB extracts and ERP records, sometimes with very short deadlines.

How Luxgap automates this risk

Our Luxgap EU Whistleblowing Shield makes your whistleblowing scheme interoperable with the complete map of European channels and ensures that no report to OLAF, the EPPO or a sectoral EU authority can trigger unintended retaliation within your organisation. The solution relies on an AI agent that continuously monitors your HR flows (Workday, Sopra HR, SD Worx LU), your ITSM tickets and your manager mailboxes via the M365 Graph API, to detect weak signals of retaliation within the 90 days following a report, whether internal or external.

Maps in real time the 24 competent European institutions and bodies by type of breach (EU budget fraud to OLAF, market abuse to ESMA, data protection to the EDPS) and automatically publishes the up-to-date list in your whistleblowing charter.
Detects suspicious post-report measures (role change, lower performance rating, exclusion from meetings, removal of M365 access) by cross-referencing Active Directory, your HRIS and your Defender logs.
Generates a multilingual FR/EN/DE/PT/LU whistleblowing charter compliant with the law of 16 May 2023 and the EU Directive, with the explicit mention of European channels required by recital 35.
Alerts the DPO and ethics officer on Teams as soon as an OLAF, EPPO or OFRS letter is detected in scanned incoming mail, and triggers a freeze protocol on adverse HR decisions.
Produces a time-stamped, cryptographically sealed PDF defence file, enforceable before the OFRS and the labour judge, demonstrating the absence of any link between an HR decision and a prior report.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free 48-hour blind audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 35

They trust us

Before we chat