What does Spain’s Law 2/2023 require from an insurance brokerage?
Short answer
Spanish Law 2/2023 requires an internal reporting system (a whistleblowing channel) in companies with 50 or more employees and, regardless of size, in companies subject to EU financial services rules, which include insurance distribution. The channel must accept anonymous reports, acknowledge receipt within 7 calendar days and respond within 3 months at most.
What is Law 2/2023?
Law 2/2023 of 20 February regulates the protection of people who report regulatory breaches and the fight against corruption. It transposes EU Directive 2019/1937, known as the Whistleblowing Directive, into Spanish law and has two aims: that organisations have a safe way to receive reports of breaches, and that whistleblowers are protected against retaliation.
For the insurance sector this is not entirely new: Spain’s insurance distribution rules (Royal Decree-Law 3/2020) already required distributors to have an internal, independent and confidential procedure for employees to report breaches. Law 2/2023 makes those requirements more specific and stricter.
Who must comply?
- Companies with 50 or more employees, in any sector.
- Regardless of headcount, companies within the scope of EU acts on financial services, products and markets and on anti-money laundering. Insurance brokers, agencies and other insurance distributors fall into this group.
- Companies with 50 to 249 employees can share resources to run the channel, and groups of companies can have a common system.
In practice, an insurance brokerage or agency in Spain needs a whistleblowing channel even if it has only a few employees.
What must the channel include?
- Written reports, verbal reports or both. If the whistleblower asks, an in-person meeting within 7 days at most.
- Anonymous reports, and protection of the identity of the whistleblower and of the people concerned.
- A system officer, appointed by the board, who acts independently.
- A policy setting out the principles of the system and a procedure for handling reports.
- A confidential log of the reports received and of the investigations carried out.
- Clear and accessible information about the channel. If the company has a website, it must appear on the home page, in a separate and easily identifiable section.
What deadlines apply?
| Obligation | Deadline |
|---|---|
| Acknowledge receipt to the whistleblower | 7 calendar days from receipt, unless this could endanger confidentiality |
| Respond to the investigation | 3 months at most, extendable by another 3 in especially complex cases |
| In-person meeting, if requested | 7 days at most |
| Notify the appointment or removal of the system officer to the competent authority | 10 working days |
Can it be outsourced?
Yes. The law allows the management of the channel, that is, the receipt of reports, to be handled by an external third party, provided it offers adequate guarantees of independence, confidentiality, data protection and secrecy of communications. The company remains responsible for the system and for carrying out investigations.
Outsourcing has two clear advantages for a small brokerage: whistleblowers trust an independent channel more, and the company makes sure it meets the deadlines and technical requirements without building anything itself.
What are the penalties?
For legal entities, the law provides for fines of up to €100,000 for minor infringements, €100,001 to €600,000 for serious ones and €600,001 to €1,000,000 for very serious ones. Not having an internal reporting system when one is required, or not respecting its safeguards, is a very serious infringement. Retaliation against whistleblowers and breaches of confidentiality are also penalised.
How to set it up, step by step
- Check whether the company is required to have a channel and whether an in-house, shared or external one makes more sense.
- Have the board approve the internal reporting system policy.
- Appoint the system officer and notify the competent authority within 10 working days.
- Set up the channel: secure, accessible and able to receive anonymous reports.
- Approve the handling procedure and open the log.
- Inform staff and publish the information on the website’s home page.
- Review the system regularly.
Sources: Law 2/2023 of 20 February (Spanish Official Gazette, BOE) · Directive (EU) 2019/1937 · Royal Decree-Law 3/2020 (insurance distribution).
This guide is for information only and does not replace professional advice for each case.