Compliance with regulations, corporate values and internal codes of conduct and the effectiveness of the institution's internal controls are enhanced where there are channels for staff to raise legitimate concerns internally, in good faith, about significant breaches of such regulations, corporate values and codes or about unethical or illegal behaviour relating to matters within the institution's competence and control. In this context, institutions should put in place and maintain appropriate internal reporting policies and procedures for staff to report potential or actual breaches of regulatory or internal requirements, including in particular requirements imposed by the Banking Law and Regulation No 575/2013, or of the internal governance arrangements, through a specific, independent and autonomous channel.

The proper operation of the reporting process should depend on clear rules and procedures that precisely indicate what can be reported and specify the stages of the procedure. The internal reporting procedures should meet the criteria set out in the law transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law, which regulates the establishment of internal and external reporting channels and the handling of breach reports and the NBB circular issued on its basis, as well as in paragraph 138 of Guidelines EBA/GL/2021/05. The management should see to it that the information communicated by staff is effectively examined and that the necessary measures are taken to rectify any dysfunction.

The rules provided should be in compliance with the legislation on privacy. Institutions can usefully resort to the advice of the authorities in charge of these matters in order to assess their rules on the basis of the applicable provisions. Please refer to paragraphs 132 to 138 of Guidelines EBA/GL/2021/05 (future legislation: law transposing Directive (EU) 2019/1937).