Article 32 Reporting of breaches

This article addresses whistleblowing and breach reporting, operating on two levels simultaneously.

At the national level, it requires Member States to put in place mechanisms that encourage reporting of breaches to competent authorities.

At the firm level, it requires payment service providers and crypto-asset service providers to establish internal channels through which their employees can report breaches.

This article connects directly to the sanctions framework established in Articles 28 and 29, supporting enforcement by ensuring breaches can be surfaced both internally and to authorities.

Important points:

• Member States are required to establish effective mechanisms for reporting breaches to competent authorities, at minimum meeting the standards set out in Article 61(2) of Directive (EU) 2015/849.
• Establish internal procedures allowing employees to report breaches through a secure, independent, specific and anonymous channel.
• These internal reporting channels must be proportionate to the nature and size of your organisation, and set up in cooperation with competent authorities.