Whistleblower policy - procedure for external reports

Procedure for external notifications to the federal coordinators to the regulatory authorities

Each authority shall establish an independent and autonomous external reporting channel for receiving and handling information on breaches. The external reporting channels offer the possibility to make written and verbal reports. Verbal reporting is possible by telephone or other voice messaging systems and, at the request of the reporting person, by means of a physical meeting within a reasonable time.

The appointed regulatory authorities shall determine, by means of regulations or circulars, specific procedural rules for receiving and processing reports.

The regulatory authority shall always send an acknowledgement of receipt within seven days of receipt of the report, unless explicitly requested otherwise by the reporting person or unless the regulatory authority considers on reasonable grounds that an acknowledgement of receipt of the report would jeopardize the protection of the identity of the reporting person.

The regulatory authority shall follow up on reports, including anonymous reports, and shall provide feedback to the reporting person within a reasonable period of time not exceeding three months or, in duly justified cases, six months, except where a legal provision prevents this.

The regulatory authority shall inform the reporting person of the final outcome of the investigations resulting from the report, taking into account the national provisions applicable to it.

Any authority that has received a report but is not competent to deal with the reported breach shall transmit the report within a reasonable period of time and in a secure manner to the federal coordinator, who in turn shall forward it to the regulatory authority, and shall inform the reporting person of this transfer without delay.

If the authority that received the notification is aware that other authorities are also competent, the notification is transmitted within a reasonable period of time and in a secure manner to the federal coordinator, who transmits it to the regulatory authorities and ensures their coordination. 

The external reporting channels must always meet the requirements of independence and autonomy. This means that they meet each of the following criteria:

(1) by design, set-up and management, the channels shall ensure the completeness, integrity and confidentiality of the information and shall not be accessible to unauthorised staff of the competent authority;

(2) they offer the possibility, for the purpose of further investigations, of storing information permanently;