Clifford Chance

The EU Whistleblower Directive (the "Directive") provides for a general framework of whistleblower protection, in stark contrast to the number of sectorial rules currently in force in Luxembourg.

Currently, there is no general provision on whistleblowing under Luxembourg law. However, specific laws in various sectors already have provisions related to whistleblowing.

Sector-specific regulations

Employment

Articles L.271-1 and L.271-2 of the Luxembourg Labour Code aim to protect workers who report breaches in the fields of corruption, influence peddling ("traffic d'influence") and unlawful taking of interest ("prise illégale d'intérêts").

An employee may not risk reprisals as a result of reporting breaches in the above mentioned fields made by (i) his employer and/or superior(s); (ii) his colleagues; or (iii) a third party who has a relationship with the employer, to the extent that the reporting is made in good faith ("bonne foi").

Any termination of an employment contract because of whistleblowing is therefore null and void.

Financial Sector

1. Luxembourg law of 5 April 1993 on the financial sector, as amended ("LFS")

The LFS applies to all Luxembourg credit institutions and professionals of the financial sector (also known as "PFS"), as well as European Economic Area ("EEA") credit institutions and professionals of the financial sector with branches in Luxembourg.

Articles 5 (1a) and 17 (1a) of the LFS require credit institutions and PFS to have robust "internal governance arrangements" in place, including internal reporting procedures according to Circular CSSF 12/552 on central administration, internal governance and risk management, as amended ("Circular 12/552").

Pursuant to Circular 12/552, Luxembourg credit institutions and PFS, as well as the Luxembourg branches of credit institutions and PFS whose headquarters are located inside and outside the EEA, must maintain internal whistleblowing arrangements which enable their entire staff to draw attention to serious and legitimate concerns about internal governance.

In addition, Article 38-12 of the LFS provides that the internal reporting process shall at least ensure:

• appropriate protection against unfair treatment (including retaliation and discrimination) for employees who report breaches of defined financial sector regulations (including of the LFS) internally; 
• protection of personal data concerning both the person who reports the breach and the natural person who is allegedly responsible for a breach, in accordance with the Luxembourg data protection provisions; and
• guarantee in all cases the confidentiality of the person who reports the breach (unless disclosure is required by or pursuant to a law) through the implementation of clear confidentiality rules.

The Luxembourg Supervisory Authority of the Financial Sector (Commission de Surveillance du Secteur Financier ("CSSF")) also established a whistleblowing procedure to encourage reporting of potential or actual breaches of applicable regulations by PFS.

2. Luxembourg law of 23 December 2016 on market abuse ("LMA")

Article 8 of the LMA provides that employers carrying out activities regulated by service regulations must put in place appropriate internal procedures allowing their staff to report any breach of Regulation (EU) No 596/2014 of 16 April 2014 on market abuse. An external reporting channel through the CSSF is also available.

3.  Investment Funds Managers ("IFM")

Circular CSSF 18/698 requires IFMs as defined therein to establish an internal whistleblowing procedure, and requires their designated Compliance Officer to include the handling of whistleblowing cases in his/her summary report.

Criminal law

Article 140 of the Luxembourg Criminal Code provides that any person (except where family members of the perpetrator or accomplice, or persons bound by professional secrecy, are concerned) having knowledge of a crime, which could still be averted or limited in its effects, or whose authors are prone to commit other crimes which could be prevented, is required to inform the judicial or administrative authorities (public prosecutor, investigating magistrates, police authorities, Labour Inspectorate etc.).

Similarly, article 23 (2) of the Luxembourg Criminal Procedure Code compels public officials (fonctionnaires) and employees or agents entrusted with a public service mission (salariés ou agents chargés d'une mission de service public) to report to the attorney general any crime or offence (including bribery) they become aware of in the performance of their duties, notwithstanding any applicable rules of confidentiality or professional secrecy.

Article 5 of the Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended ("AML Law") provides that professionals that fall within its scope, their managers and employees are obliged to fully cooperate with the Luxembourg authorities responsible for combating money laundering and the financing of terrorism, which implies in particular the obligation to inform promptly, on their own initiative, the Luxembourg Financial Intelligence Unit of any fact which could be an indication of money laundering or terrorist financing. Article 8-3 of the AML Law provides for the setup of reporting channels by supervisory authorities and self-regulating bodies as defined therein.

The reporting in good faith, whether internally, to a supervisory authority, a self-regulating body or to the Luxembourg Financial Intelligence Unit, cannot result in reprisals against the whistleblower.

Is Luxembourg ready for the Whistleblower Protection Directive?

The provisions of the Directive will broaden the protection of whistleblowers once transposed:

• article 2 of the Directive provides for a wider material scope through a long list of areas (e.g. consumer protection, protection of environment, protection of privacy and personal data, etc.) currently not covered under Luxembourg law;
• the obligation of establishing internal reporting channels pursuant to Article 8 of the Directive, will apply to all legal entities of the public sector, as well as entities in the private sector (i) which offer financial services; or (ii) are subject to money laundering and terrorist financing prevention regulations; or (iii) have more than 50 employees.
• the protection will include not only employees and civil servants to but also former employees, candidates, shareholders, and the categories listed in Article 4 of the Directive;
• a general prohibition of reprisals, including attempts and threats against whistleblowers (e.g. suspension, dismissal, downgrading, refusal of promotion, etc.) will be introduced; and
• the creation of external reporting channels (i.e., through competent public authorities) will be mandatory.

The Directive must be transposed in Luxembourg law before 17 December 2021, with companies between 50 to 249 workers benefiting from a grace period until 17 December 2023.