Finland - Whistleblowing Laws in Europe: An international guide


1) Local Laws

a) Has the country implemented any laws / regulations on whistleblowing (Local Law)?

Finland has no general law regulating whistleblowing.

A working group has been set up to implement the EU Directive on whistleblowing. However, the process is at an early stage. The working group will assess the need for a separate law on the protection of reporting persons. In addition, the working group is considering whether the national scope should go beyond the minimum level mentioned in the Directive, and to which authority external notifications would be made.

The answers in this document are based on sector-specific legislation in this area currently in force. Regulations on protecting reporting persons are contained in legislation including the:

  • Act on Credit Institutions (610/2014).
  • Securities Market Act (746/2012).
  • Act on Common Funds (213/2019).
  • Insurance Companies Act (521/2008).
  • Act on Insurance Distribution (234/2018).
  • Act on Financial Supervisory Authority (878/2008).
  • Act on Detecting and Preventing Money Laundering and Terrorist Financing (444/2017).

In addition, the Trade Secrets Act (595/2018) includes a whistleblowing provision under which a person (e.g. an employee) is allowed to disclose a trade secret in order to reveal malpractice or illegal activity, if it is done to protect the public interest and the person has significant reasons to reveal. Also, the so-called Data Protection Law on Criminal Matters (1054/2018) includes provisions on the whistleblowing procedure and protection of the reporting persons.

2) Scope of application

a) What types of wrongdoings are covered by the Local Law? Does it cover breaches of EU law?

As mentioned above, no overarching law has been passed. To the extent that no specific provisions exist in current laws, Finland will implement the Directive in respect of all areas that it covers.

b) Personal scope

  1. Does the Local Law apply to reporting persons working in both the private and public sectors?

  2. Anyone may make a report of suspected infringement. The person making the report (the whistleblower) may generally be in such a position (e.g. employee, external expert) where they may obtain non-public information about the activities of an entity, or the management or an employee of an entity that is supervised, for example, by the Finnish Financial Supervisory Authority (FIN-FSA).

  3. Does the Local Law apply only to breaches that the reporting person became aware of in a work-related context?

  4. We are not aware of such restrictions.

  5. Does the Local Law also protect: facilitators; people connected to the whistleblower and who could suffer retaliation in a work-related context; and legal entities the whistleblower owns, works for, or is otherwise connected with?

  6. Current laws only refer to reporting persons.

c) Does the Local Law require specific conditions to protect reporting persons?

No. Whistleblowers do not need specific evidence to support their suspicions; justified suspicion is sufficient. However, a person may disclose a trade secret in order to reveal malpractice or illegal activity only if it is done to protect the public interest and the person has significant reasons to reveal the information.

3) Reporting channels

a) Does the Local Law allow anonymous reports? How are companies/agencies meant to handle them?

Yes. The reporting procedure shall contain appropriate and adequate measures that enable the appropriate processing of reports to protect the reporting person and to safeguard the personal data protection of both the reporting and reported persons.

b) Is there a duty of confidentiality and any derogation from this duty?

Yes. Whistleblowers are protected by the confidentiality of the system.

c) Public disclosures: does the Local Law provide for this possibility?

Finnish laws such as the Trade Secrets Act provide that an employee can reveal a trade secret in public in order to reveal malpractice or illegal activity if the company has not established a proper internal channel for whistleblowers. In addition, an employee can go public if the malpractice or illegal act involves a superior or the management body.

4) Reporting channels: internal

a) Is there an obligation for private and/or public legal entities to establish channels and procedures for internal reporting and follow-ups?

No such obligation is established under current legislation but entities may have an internal reporting system. Possible internal systems are company specific so no detailed commentary is possible.

However, it is worth noting in relation to the Trade Secrets Act that an employee has a primary duty to use a company’s internal whistleblowing channel if one exists. That is, an employee cannot reveal the trade secret in public if the company has established and maintains a proper internal channel for whistleblowers.

b) Do internal reporting channels need to allow reporting in writing, orally or both?

Internal systems are company specific so no commentary is possible.

c) Procedures for internal reporting and follow-up: does the Local Law require legal entities to adopt internal reporting systems with the following elements?

  1. Channels able to ensure the confidentiality of the identity of the reporting person and the protection of third parties mentioned in the report:

  2. Internal systems are company specific so no commentary is possible.

  3. Acknowledgement of receipt of the report to the whistleblower within seven days of receipt:

  4. Internal systems are company specific so no commentary is possible.

  5. The designation of an impartial function/team to manage follow-ups on reports and maintain communication with the whistleblower:

  6. Internal systems are company specific so no commentary is possible.

  7. Any other follow-up requirements including those for anonymous complaints:

  8. Internal systems are company specific so no commentary is possible.

  9. A reasonable timeframe to provide feedback, not exceeding three months from acknowledgment of receipt or if no acknowledgement was sent, three months from the expiry of the seven-day period after a report is made:

  10. Internal systems are company specific so no commentary is possible.

  11. Providing clear and easily accessible information on internal reporting procedures and external reporting procedures to competent authorities and/or EU institutions/bodies:

  12. Internal systems are company specific so no commentary is possible.

  13. Should legal entities take any additional measures in order to comply with the above requirements?

  14. Internal systems are company specific so no commentary is possible.

5) Reporting channels: external

a) Has the country designated a competent authority to receive and investigate whistleblower disclosure and retaliation complaints?

No general competent authority exists in the terms of the Directive. The Finnish Financial Supervisory Authority (FIN-FSA) maintains a system for receiving reports of suspected infringements of financial market provisions (whistleblowing system). Financial market provisions are acts and other statutes supervised by FIN-FSA. In addition, suspicions of tax non-compliance may be reported to the Tax Administration.

b) Is an independent and autonomous external reporting channel already established in the country?

No channel is established but separate sector-specific channels are provided by, for example, FIN-FSA and the Tax Administration.

6) Processing of personal data

a) Is personal data concerning the reports processed in compliance with local and EU legislation such as EU Regulation 2018/1725 and local privacy laws?


7) Record keeping of reports

a) Is there any obligation regarding record keeping of reports as provided for by the EU Directive?

The FIN-FSA shall store necessary information about a report for five years after a report is made. Thereafter, the information is deleted unless further storage is necessary to safeguard the investigation of a crime, pending trials, official investigations, the rights of the reporting person or the person being reported. The necessity of further storage must be reviewed at least three years after a previous review. A note of the review has to be made.

8) Protection

a) Is there any difference between whistleblower protections in the private and public sectors?

No difference.

b) Are whistleblowers protected against all forms of retaliation including threats and attempts of retaliation? Which forms of retaliation are expressly indicated?

Generally, whistleblowers are protected against all forms of retaliation. For example, FIN-FSA cooperates with the occupational safety and health authorities. The objective is the effective exchange of information and cooperation to protect people in their work who report suspected infringements or are accused of such an offence, and to prevent retaliation, discrimination and other forms of unfair treatment related to reports.

c) Does the Local Law provide for any other measures of support such as those indicated in the EU Directive?

No specific provisions exist under current legislation.

d) Does the Local Law provide for the necessary measures to prohibit any form of retaliation against whistleblowers?

No specific provisions exist under current legislation but whistleblowers are protected by employment laws that provide, at a general level, strong protection against unlawful dismissal.

e) Does the Local Law provide for any remedial measures, including interim relief measures?

No special remedies have been introduced but reporting persons can rely on general remedies under employment laws (e.g. against unlawful termination). However, for example, cooperation between FIN-FSA and occupational safety and health authorities aims to ensure that whistleblowers have access to sufficient information and guidance on available legal remedies against possible retaliatory measures by an employer.

f) Does the Local Law provide for exemptions from liability for whistleblowers?

Yes. For example, pursuant of section 71(b) of the Act on the Financial Supervisory Authority, whistleblowers are not considered to be infringing any restriction on disclosure of information imposed by contract or by any legislative, regulatory or administrative provision. They are thus not to be held liable related to such disclosure.

g) Does the Local Law provide for sanctions against natural and legal persons that violate whistleblowers’ protection or the duty of maintaining the confidentiality of their identity?

No specific provisions exist under current legislation but the Act on FIN-FSA generally empowers FIN-FSA to take action against entities that fall under its supervision and who act in breach of obligations imposed on them by sector-specific laws. The measures available include, inter alia, prohibiting the market actor from continuing their breach, and a fine.

h) Does the Local Law provide for sanctions in case of false reports?

If the report proves to be manifestly unfounded, this may result in an investigation request to the police.

9) Other issues

a) Under the Local Law, is adopting a whistleblowing system relevant to assess the adequacy of a compliance program? Does this have any value to mitigate or eliminate criminal liability for legal entities?

Adopting a whistleblowing system is not explicitly mentioned, in the Finnish Criminal Code for example, in relation to factors relevant to sentencing. The general principle is that the sentence shall be determined so that it is in just proportion to the harmfulness and dangerousness of the offence, the motives for the act, and the other culpable factors manifest in the offence. The prerequisites for a corporate fine under Chapter 9 of the Criminal Code set out that the court may waive imposition of a corporate fine when the punishment is deemed unreasonable, taking into consideration, for example, the measures taken by the corporation to prevent new offences. Therefore, existence of a whistleblowing system might have some minor value in mitigating/eliminating criminal liability.

b) Does the Local Law or another law in your country provide for whistleblower reward programs?

No reward programs are present.

c) Can companies benefit from any incentives in the case of voluntary self-disclosure of violations they became aware of following an internal report?

In respect of competition law, companies can benefit from leniency program. When, following an internal report, a company becomes aware of a cartel, the company can voluntarily self-disclose such violation to competition authority and possibly benefit from leniency program. Leniency program in Finland has been harmonized with the leniency program of European Commission and ECN leniency model programme. If certain conditions are fulfilled the company could be given immunity from or reduction of penalty payments in cartel cases.

See in more detail about requirements and processes.

d) Will implementing the EU Directive create any issues with obligations provided for under other laws / regulations?

Possibly. The issues are under review by the working group e.g. from competition law perspective the Finnish Competition and Consumer Authority has brought up the following concerns:

  • In competition cases, the use of an internal notification channel generally undermines the success of a competition authority's investigation and thus renders all further action practically pointless.
  • When an investigation is still under way or pending, it is not possible to provide time-bound and substantiated feedback to the notifier in competition cases.

Return to Overview page

For a pdf of the full guide please click on the button below.

Contenidos del número