I need to bring my Luxembourg organisation into compliance with recital 68 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 68 Whistleblowing — Recital 68

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 68

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(68)

Union law in specific areas, such as market abuse, namely Regulation (EU) No 596/2014 and Implementing Directive (EU) 2015/2392, civil aviation, namely Regulation (EU) No 376/2014, or safety of offshore oil and gas operations, namely Directive 2013/30/EU, already provides for the establishment of internal and external reporting channels. The obligations to establish such channels laid down in this Directive should build as far as possible on the existing channels provided by specific Union acts.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the Law of 16 May 2023 on the protection of whistleblowers transposed Directive 2019/1937 and confirms the principle of recital 68: existing sector-specific channels (CSSF for MAR and AML, CAA for insurance, ILR for telecoms) remain the competent external authorities for their respective domains, with the OFRS acting as the default transversal authority. The 50-employee threshold applies to the internal channel for the private sector, with no threshold for public bodies.

Luxgap practice: explicitly document in your reporting policy which external authority (CSSF, CNPD, ITM, CAA, ILR or OFRS) receives which type of alert, and keep records of acknowledgement (7 days) and feedback (3 months) deadlines for each channel, under penalty of criminal fines from EUR 1,250 to EUR 25,000 doubled in case of recidivism.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Organisations regulated by the CSSF, subject to the Market Abuse Regulation (MAR 596/2014), civil aviation (376/2014) or offshore operations (2013/30/EU), often believe they must stack a new RGPD-style reporting channel on top of their existing sector-specific channels. The result: two parallel systems, two registers, two investigation teams, and whistleblowers who no longer know where to report. The CSSF and ITM verify during inspections that existing sector-specific channels are reused and harmonised with Directive 2019/1937, not duplicated. Recital 68 explicitly invites building on existing channels.

How to articulate your sector-specific channels with Directive 2019/1937

Map your existing channels: MAR reporting via the CSSF procedure, aviation reporting via EASA, offshore reporting via Directive 2013/30, money laundering reporting via the FIU.
Identify gaps against the 2019/1937 requirements: acknowledgement within 7 days, feedback within 3 months, protection against retaliation, confidentiality of identity.
Extend the material scope: a MAR channel only covers market abuse; it must be broadened to other domains (GDPR, public health, environment, product safety).
Unify governance: a single person or unit responsible, a single register of reports, a single policy published to employees.
Document the choice: an internal note justifying that channel X covers obligations Y and Z of the directive, defensible during an ITM or CSSF inspection.

How Luxgap automates this risk

Our Luxgap Whistleblowing Channel Orchestrator consolidates all your existing sector-specific reporting channels (MAR, aviation, offshore, AML, GDPR) into a single interface and ensures that no obligation of Directive 2019/1937 falls between two systems. The tool automatically maps your current procedures through CSSF eDesk, M365 Compliance, ServiceNow and SAP GRC connectors, then identifies gaps against the 2019/1937 requirements without asking your HR or compliance officer to fill out a questionnaire.

Detects reporting channels already in place in your IT environment by scanning Teams, Outlook, SharePoint intranet and documented ISO quality procedures.
Compares each channel to the minimum requirements of Directive 2019/1937 (7-day acknowledgement, 3-month feedback, confidentiality, retaliation protection) and produces a coverage matrix.
Generates a unified multi-channel reporting policy, ready to publish to employees, that routes each type of alert to the correct sector-specific channel.
Tracks the lifecycle of each report with cryptographic timestamping of acknowledgements and feedback, defensible before the OFRS and CSSF during inspections.
Alerts your DPO or compliance officer in real time when a legal deadline (7 days, 3 months) is about to expire.
Produces a consolidated annual report for the CSSF, ITM or OFRS demonstrating the operational effectiveness of the system.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real channels, with a free blank audit within 48 hours to measure the gaps between your sector-specific systems and Directive 2019/1937.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 68

They trust us

Before we chat