By setting up a central contact point, BaFin enabled disclosures to be received and processed in a uniform manner as well as specially protecting the identity of whistleblowers, because they will only be willing to share their knowledge with BaFin if they are confident they will be protected.

Disclosures about supervisory misconduct

Around two thirds of the disclosures submitted so far were received by BaFin in the first half of 2017. In both 2016 and 2017, half of the reports were related to presumed breaches by supervised companies. Some disclosures helped to uncover supervisory misconduct. BaFin has followed up the information provided and has already initiated supervisory measures, while in other cases it is in the process of clarifying the facts.

However, BaFin has also received many reports relating to companies which are not subject to its supervision, which it deals with as part of its combating of unauthorised business (see BaFinJournal September 2013 - only available in German). In addition, the contact point for whistleblowers received consumer complaints and reports about matters for which BaFin is not responsible.

The proportion of disclosures which do not appear to be factual or which are of a defamatory nature is low. However, it is evident that whistleblowers find it difficult to judge which information is of supervisory significance.

Tasks of the contact point for whistleblowers

The main task of the contact point is communication with whistleblowers. First it checks whether incoming disclosures are relevant for the technical supervision, in other words, if the reports concern supervised companies and the facts described concern supervisory law. To protect whistleblowers and other persons affected by disclosures, the contact point for whistleblowers generally forwards relevant reports to the technical supervision division responsible in anonymised form or using a pseudonym.

The technical supervision examines the disclosures from a factual and legal point of view and, if necessary, initiates relevant measures. The technical supervision and contact point for whistleblowers support each other to fulfil their duties in order to ensure that BaFin deals with the disclosures it receives successfully. During the whole process, the central contact point for whistleblowers is responsible for communication with whistleblowers, for example if BaFin has any further questions. This is carried out by employees who have been specially trained, especially as regards data protection.

Whistleblower protection

Information on supervisory breaches may come from secret or confidential situations, so it is important to have organisational measures in place to protect whistleblowers so that they do not suffer from disclosing information to BaFin, regardless of whether they submit their report anonymously or reveal their identity. Therefore, BaFin does not in principle make public the identity of whistleblowers without their express prior consent.

However, section 4d (3) sentence 3 of the FinDAG (only available in German) contains the exception that BaFin may pass on personal data in the context of further investigations and subsequent administrative or judicial proceedings allowed by law, if this is necessary or if the disclosure is ordered by a court decision or in court proceedings.

Electronic reporting system

Since BaFin's contact point for whistleblowers started work, it has been possible to use it anonymously, but because it was initially only possible to submit reports by post, e-mail, telephone or in person, BaFin was only able to ask follow-up questions of the whistleblowers if they had revealed their identity.

For that reason, BaFin set up an electronic reporting system at the beginning of 2017 which enables it to ask further questions via a protected mailbox (see BaFinJournal January 2017 - only available in German), because the more specific a disclosure is, the more helpful it can be in supervisory work. It is technically impossible for disclosures submitted via the system to be traced, guaranteeing the whistleblower absolute anonymity throughout the whole dialogue if they so desire. At the same time, the system enables BaFin to check if disclosures are of supervisory significance.

The electronic whistleblowing system has been well-received, with over half of whistleblowers now using it. About two thirds of them set up a protected mailbox, enabling BaFin to continue to communicate with them. Previously, BaFin has received most reports by e-mail or post.

Protection under labour and criminal law

Whistleblowers from supervised companies can use the contact point at BaFin without having to worry about consequences under labour or criminal law. Section 4d (6) of the FinDAG lays down that employees of supervised companies who use the BaFin contact point for whistleblowers may in principle not be subjected to labour law or criminal proceedings because of their disclosure or held liable for damages caused by it, unless they submitted an intentionally or negligently untrue report. This provision removes the conflict inherent in an employee breaching their contractual duty towards their employer by reporting breaches.

Before the law was changed in this way, whistleblowers could have faced dismissal under labour law and they were simultaneously exposed to the risk of being punished for disclosure of trade and industrial secrets pursuant to section 17 of the Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb – UWG - only available in German). Since the introduction of section 4d of the FinDAG, employees of supervised companies or companies to which activities of supervised companies are outsourced no longer have to face such risks.