I need to bring my Luxembourg organisation into compliance with recital 72 of Whistleblowing (UE 2019/1937). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 72 Whistleblowing — Recital 72

EU frameworkGDPR NIS 2 DORA AI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 72

Directive on the protection of persons who report breaches of Union law · UE 2019/1937

(72)

In many policy areas falling within the material scope of this Directive, there are cooperation mechanisms through which national competent authorities exchange information and carry out follow-up activities in relation to breaches of Union rules with a cross-border dimension. Examples range from the Administrative Assistance and Cooperation System established by Commission Implementing Decision (EU) 2015/1918 (36), in cases of cross-border breaches of the Union agri-food chain legislation, and the Food Fraud Network under Regulation (EC) No 882/2004 of the European Parliament and of the Council (37), the rapid alert system for dangerous non-food products established by Regulation (EC) No 178/2002 of the European Parliament and of the Council (38), the Consumer Protection Cooperation Network under Regulation (EC) No 2006/2004 of the European Parliament and of the Council (39), to the Environmental Compliance and Governance Forum set up by the Commission Decision of 18 January 2018 (40), the European Competition Network established pursuant to Regulation (EC) No 1/2003, and the administrative cooperation in the field of taxation under Council Directive 2011/16/EU (41). Member States' competent authorities should make full use of such existing cooperation mechanisms where relevant as part of their obligation to follow up on reports regarding breaches falling within the scope of this Directive. In addition, Member States' authorities could also cooperate beyond the existing cooperation mechanisms in cases of breaches with a cross-border dimension in areas where such cooperation mechanisms do not exist.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 relative a la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 on the protection of whistleblowers entrusts the Office des rapports de signalement (OFRS) with the role of cross-sectoral external authority, coordinating with sectoral authorities (CSSF, CNPD, ITM, ILR, CAA) the transmission of cross-border reports to EU counterparts. The OFRS may be seized in parallel with the sectoral authority, which multiplies the European entry points for the same case.

Luxgap practice: map in advance, for each report, the triptych OFRS / LU sectoral authority / EU counterpart to avoid a fragmented response that could be used as evidence of concealment.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 72 reminds national authorities (OFRS, CSSF, CNPD, ITM, ILR, CAA) that they must activate European cooperation mechanisms as soon as a report has a cross-border dimension. In practice, many organisations fail to anticipate that a report handled locally by the OFRS can trigger parallel proceedings in another Member State through the European Competition Network, the Food Fraud Network or the CPC network. As a result, the company prepares a Luxembourg defence while BaFin, AMF or the Bundeskartellamt are already investigating the same case based on information exchanged between authorities.

What this recital changes for you in practice

An internal report concerning a foreign subsidiary can be forwarded to the local competent authority AND to its EU counterpart via administrative cooperation channels.
Areas with strong cross-border cooperation are: finance (ESMA, EBA), competition (ECN), taxation (DAC 6), food safety (RASFF), consumer protection (CPC), environment (ECGF).
Your defence must be consistent across all jurisdictions involved: a divergent answer between the CSSF and BaFin will be used as evidence of bad faith.
The 3-month feedback deadline to the whistleblower applies even when the authority has forwarded the file to an EU counterpart: coordination does not pause the clock.
Traceability of inter-authority exchanges is documented: what you declare to one authority becomes enforceable by the others.

How Luxgap automates this risk

Our Luxgap Cross-Border Whistleblowing Radar turns your internal reporting channel into a multi-jurisdictional coordination cell that anticipates European ricochet effects before they become unmanageable. The tool cross-references each report with an up-to-date mapping of EU cooperation mechanisms (ECN, RASFF, CPC, DAC, Food Fraud Network, ECGF) and identifies within minutes which foreign authorities are likely to receive the file through administrative channels, based on the legal qualification of the reported facts and the legal entities involved.

Automatically analyses the content of a report via a specialised LLM agent to detect its cross-border dimension and the relevant EU legal basis (competition, finance, taxation, environment, agri-food).
Maps group subsidiaries, branches and data flows from your Odoo data, RCS and Companies House registers to identify all exposed jurisdictions.
Predicts which foreign authorities will be notified through cooperation mechanisms and with what typical propagation delay.
Generates a response consistency matrix: same facts, same legal qualifications, same evidence, in all required languages.
Alerts the DPO and compliance officer as soon as a parallel report is publicly detected via a peer authority (monitoring of CSSF, BaFin, AMF, AFM bulletins).
Produces a cryptographically sealed time-stamped PDF report, enforceable during an OFRS audit to demonstrate diligent use of the cooperation mechanisms set out in recital 72.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real mapping, with a free white audit within 48h to measure your cross-border exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 72

They trust us

Before we chat