On 2 July 2016, the German Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht - BaFin) introduced a new reporting platform for whistleblowers of financial sector institutions under BaFin's supervision to report violations of supervisory provisions, including violations of the law, regulations, ordinances, other provisions and legal acts of the EU and the European Supervisory Authorities (EBA, EIOPA and ESMA).

A priority defined by BaFin is the protection of the whistleblower's anonymity as no disadvantages shall arise for the whistleblower when reporting to BaFin. Reports may be submitted in writing or electronically, by phone or verbally. Whistleblowers may choose whether or not to reveal their identity but must take own precautions to guard their privacy (e.g. by blocking the telephone number when calling the BaFin hotline). Remaining anonymous is an option, but even if a whistleblower reveals his or her identity, BaFin may not pass on that information to any third party without express consent, unless the information is needed in subsequent administrative or criminal investigations.

The installation of this platform became necessary due to a recent amendment of sec. 4d of the German Act Establishing the Federal Financial Supervisory Authority (Finanzdienstleistungs-aufsichtsgesetz - FinDAG) that stipulates the construction of a reporting system for whistleblowers that guarantees anonymity as well as the legal protection of whistleblowers. This statutory amendment implements respective requirements of the Fourth EU Money Laundering Directive (2015/849).

The amended Act now also expressly states that employees of BaFin-supervised companies and institutions may not be subject to criminal or employment law-related sanctions and may not be held liable for damages to the company caused by the report, unless a false report has been made in a grossly negligent or intentional manner (sec. 4d para. 6 FinDAG). However, this whistleblower protection does not apply to individuals not employed by a BaFin-supervised company, like external auditors or advisors.

Specific statutory protection of whistleblowers is a novelty in German law: besides new sec. 4d FinDAG, only some protection of whistleblowers is provided by the German Dismissal Protection Act (Kündigungsschutzgesetz - KSchG) as whistleblowing is per se considered not to be a valid reason for terminating employment of a whistleblower. However, outside of the scope of BaFin supervision, blowing the whistle externally, without trying to resolve the issue internally first, with the potential consequence of damaging the employer's reputation, may still be considered a valid reason for termination, provided the employee did not report a criminal offence committed by the employer.

BaFin's platform is a notable indicator of a shift in German legislation towards more protection for anonymous whistleblowers. Previous legislative attempts towards an increased protection for whistleblowers have continuously failed in Germany, particularly based on a general fear of risks of organized denouncements. The BaFin platform is also part of a harmonization process across the EU and similar provisions may have to be expected in other EU member states.

The new whistleblower platform significantly facilitates and protects whistleblowing for employees of BaFin-supervised companies. Therefore, companies under BaFin supervision must not only ensure that their internal whistleblowing policies and processes are in compliance with the new Act, but they should also review if their policies and processes provide for trusting and effective ways for potential whistleblowers to internally report and remedy any supervisory violations.