Whistleblowing Policies Within Companies

Whistleblowing policies within companies are governance and compliance tools that help organisations identify risks before they develop into financial, criminal or regulatory crises. Their importance increases in companies operating through multiple departments, branches or agents, where information concerning bribery, embezzlement, conflicts of interest or accounting manipulation may reach an employee or supplier before it appears in audit reports or formal complaints.

However, legal implementation in Egypt requires an important distinction: there is no single rule requiring every private company to establish a Whistleblowing channel in the same form. The policy may operate as a general governance best practice, while its requirements become more specific and mandatory in sectors subject to special regulatory frameworks, particularly certain non-banking financial and insurance activities.

What Is a Whistleblowing Policy?

It is a written framework defining who may report, what types of conduct fall within the policy, which reporting channels are available, who receives reports, how they are assessed and investigated, how confidentiality is protected, and what action is taken where misconduct or malicious reporting is established.

The channel may be available only to employees or may extend to suppliers, agents, customers and external parties depending on the company’s size and risk profile.

Whistleblowing Is Not Merely a Complaints Box

An employment grievance may concern pay, leave, performance appraisal or a dispute with a manager. Whistleblowing, by contrast, usually focuses on matters affecting organisational integrity or legal compliance, such as bribery, fraud, embezzlement, conflicts of interest, financial manipulation or concealment of regulatory breaches.

It is advisable for companies to maintain a separate pathway or triage mechanism distinguishing Grievance matters from Whistleblowing so that serious reports are not lost among routine complaints.

Must Every Egyptian Company Establish a Whistleblowing Policy?

This obligation should not be generalised to all private companies. The applicable rules differ according to legal form, sector and regulator.

The Egyptian Corporate Governance Guide issued by the Financial Regulatory Authority includes whistleblowing as an important governance policy and recommends encouraging employees and stakeholders to report unlawful conduct or breaches of codes of conduct, while protecting reporters and maintaining confidentiality.

When Does the Policy Become a More Explicit Sector-Specific Obligation?

In certain sectors regulated by the Financial Regulatory Authority, governance rules include express requirements concerning Whistleblowing procedures.

A recent example is FRA Board Decision No. 200 of 2025 on governance of insurance and reinsurance companies, which requires companies to prepare internal governance rules containing policies and procedures for Whistleblowing alongside compliance, risk, internal audit, conflict-of-interest, anti-money laundering and counter-terrorist financing policies.

The Labour Law in Force in 2026

The current reference is Labour Law No. 14 of 2025, not Labour Law No. 12 of 2003. In 2026, the Ministry of Labour also issued the general rules for private-sector workplace regulations, applicable as a unified framework to establishments employing ten or more workers.

Whistleblowing policies should therefore be aligned with employment rules, disciplinary procedures and non-discrimination principles applicable within the establishment.

Is There a Unified General Regime Protecting Whistleblowers from Retaliation?

The Egyptian system should not be presented as equivalent to foreign regimes establishing comprehensive and uniform whistleblower protection across all sectors.

More accurately, whistleblower protection should be grounded in company policy, employment and non-discrimination rules, sector-specific requirements where applicable, and any special protection prescribed by law for the relevant matter.

What Does Non-Retaliation Mean Within the Company?

The policy should prohibit adverse action against a person merely because they submitted a report in good faith or lawfully participated in an internal investigation.

This may include dismissal, demotion, punitive transfer, denial of benefits or administrative harassment where the true reason is the report.

Good Faith Does Not Mean the Report Must Ultimately Be Proven

An employee may report information they honestly believe to be true, only for the subsequent investigation not to establish misconduct. That outcome does not automatically make the report malicious.

A distinction should be drawn between an unsubstantiated report and a report deliberately fabricated to harm another person.

Anonymous Reporting

Anonymous reporting is a common compliance tool but is not a uniform mandatory requirement for every Egyptian company.

Where a company permits anonymous reporting, the platform should be designed to allow follow-up and requests for additional information while protecting the reporter’s identity as far as reasonably possible.

Anonymous Reports Should Not Be Rejected Merely Because the Reporter Is Unnamed

The more important criterion is whether the report contains facts, documents or data capable of verification.

The absence of the reporter’s identity may limit the ability to clarify certain points, but the report should be assessed by reference to its content rather than anonymity alone.

Reporting Channels

A company may use a dedicated email address, hotline, electronic portal or external service provider, or combine several methods.

The channel should be sufficiently independent from the management line that may itself be the subject of the report.

Who Should Receive the Report?

The model depends on company size. Reports may be received by Compliance, Internal Audit, the Audit Committee or external counsel.

Where the report concerns senior management or the compliance officer, an alternative channel should ensure that the report is not first routed to the person accused.

Conflicts of Interest in Handling Reports

A report should not be reviewed by a person who has an interest in the outcome, participated in the facts, or reports directly to the person under suspicion.

The policy should therefore contain clear recusal rules for referring the matter elsewhere where a conflict exists.

Must a Report Be Acknowledged Within Three or Five Days?

There is no single general statutory deadline applicable to all companies unless imposed by sector regulation or internal policy.

Companies may establish Service Levels for acknowledgement, assessment and follow-up, but those timelines should not be presented as general legislative requirements.

Initial Triage

Not every report should immediately trigger a full investigation. The first step is classification: determine whether the matter falls within the channel’s scope, assess severity, and identify whether evidence preservation or urgent measures are required.

Triage may result in referral to HR Grievance, Cybersecurity, a legal investigation, or closure where there are no facts capable of meaningful review.

When Should Emails and Data Be Preserved Immediately?

Where a report raises concerns of evidence deletion, embezzlement, bribery or document manipulation, a Legal Hold and preservation of emails and digital logs may be required before confronting the persons concerned.

The preservation process should remain proportionate to the matter and respect privacy and data-protection requirements.

Confidentiality of the Reporter’s Identity

The policy should preferably limit knowledge of the reporter’s identity to persons who need it for a defined role.

However, companies should not promise “absolute confidentiality” in every circumstance. Legal or procedural requirements may compel disclosure to authorities, or another person’s defence rights may depend on certain information.

Personal Data Protection Law No. 151 of 2020

A whistleblowing file may contain data concerning the reporter, the reported person, witnesses and other parties. The company should therefore define the processing purpose, restrict access, avoid retention beyond necessity, and apply appropriate security measures.

Information necessary for the investigation should be separated from personal data unrelated to the matter.

Retention of Whistleblowing Records

Companies should maintain a central register showing the report date, classification, referral pathway, actions and outcome, while restricting access to sensitive information.

Retention periods should not be chosen arbitrarily; they should reflect the purpose, applicable law, sector and nature of potential disputes.

Reporting Money Laundering Concerns

Entities subject to anti-money laundering and counter-terrorist financing requirements may have independent duties for handling and reporting suspicious transactions through legally prescribed channels.

An internal Whistleblowing channel should not be confused with the formal Suspicious Transaction Reporting regime; each has a different purpose and legal pathway.

Must Every Report of Bribery or Crime Be Sent Immediately to the Public Prosecution?

There is no general rule requiring a company to refer every internal report immediately to the Public Prosecution upon receipt.

The nature of the matter, sector-specific legislation and any legal reporting duty should first be assessed, while preserving evidence and avoiding obstruction of justice or concealment of offences where the law imposes a specific obligation.

Malicious Reports

Where it is established that a person deliberately fabricated facts or documents with the intention of harming another person, disciplinary action or other liability may arise depending on the circumstances.

However, the concept of a “malicious report” should not be used to punish every person whose report ultimately could not be substantiated.

When May a Whistleblower Be Subject to Disciplinary Action?

A distinction should be drawn between the substance of the report and separate misconduct by the reporter. Where bad faith, fabrication of documents, or publication of allegations outside the proper channels for the purpose of defamation is established, that conduct may be assessed independently under the Labour Law and applicable workplace regulations.

The mere fact that a report is not substantiated is not sufficient by itself.

Absence of a Policy Does Not Automatically Create Criminal Liability for Management

The absence of a Whistleblowing channel may reveal weaknesses in governance and internal controls, but it does not by itself establish criminal liability of the Board for an offence committed by an employee.

Criminal liability requires a statutory basis, the relevant legal elements and a specific role. Governance best practices should not be converted into conclusive evidence of criminal wrongdoing.

Commercial and Operational Effects

An effective reporting channel may uncover losses, conflicts of interest or regulatory violations at an early stage and help the company reduce financial impact and strengthen controls.

It also provides investors or lenders with an indicator of the maturity of the company’s Compliance framework, particularly in Due Diligence and acquisition transactions.

Impact of Whistleblowing on M&A and Investment

In acquisition transactions, an investor may request review of open and material whistleblowing matters, how they were handled, and whether there are retaliation claims or recurring compliance issues.

Such information should nevertheless be provided in a manner that preserves privacy and confidentiality and does not disclose more personal data than the review requires.

International Companies and Group Policies

An international group may apply a Global Hotline to its Egyptian subsidiary, but the policy should be aligned with Egyptian labour law, data-protection requirements and sector-specific rules.

A European or U.S. policy should not be copied verbatim where it contains deadlines, rights or reporting mechanisms that do not apply locally.

EU Whistleblower Directive

The EU Whistleblower Directive may be relevant to companies falling within its scope in the European Union, but it does not become Egyptian law merely because the parent company is European.

Its effect on the group should be analysed separately from the obligations of the Egyptian entity.

FCPA and UK Bribery Act

A Whistleblowing channel can help international companies identify bribery risks before they escalate, but the existence of the channel does not by itself create a complete defence, nor does its absence alone establish liability.

Compliance assessment under foreign laws depends on the overall programme, the facts and the applicable jurisdictional scope.

Transferring Whistleblowing Data Outside Egypt

Where a global platform or investigation team outside Egypt will receive employee data, cross-border personal-data transfer rules and any required authorisations or safeguards under the Egyptian framework should be assessed.

It is preferable to limit transferred data to what the investigation actually requires rather than automatically sending complete files.

Periodic Reporting to the Board

The Audit Committee or Board may receive statistical reports concerning the number of reports, categories, ageing and outcomes, with names anonymised where disclosure is unnecessary.

This allows the Board to identify recurring risks without turning every report into broad circulation of personal information.

Core Elements of an Effective Whistleblowing Policy

Define the categories of misconduct accepted by the channel.
Identify the persons permitted to report.
Provide more than one appropriate reporting method.
Identify the function responsible for Triage and investigation.
Create an alternative channel for reports concerning senior management.
Set clear confidentiality and non-retaliation rules.
Regulate anonymous reporting and follow-up.
Link serious reports to Legal Hold and evidence-preservation procedures.
Define rules governing data sharing and transfer.
Set standards for closing reports and retaining records.
Distinguish malicious reports from good-faith but unsubstantiated reports.
Provide periodic reporting to the Board or Audit Committee on trends and risks.

Common Errors

Common errors include placing the channel under the control of a manager who may be the subject of a report, guaranteeing “absolute confidentiality” that the company may not legally be able to maintain, or automatically disregarding anonymous reports.

Other errors include taking adverse action against a reporter without documenting an independent reason, circulating the report text too widely, or starting an investigation without preserving relevant evidence.

Practical Best Practices

Companies should periodically review the channel to assess report volumes, handling times, substantiation rates and recurring risk categories, without using metrics to encourage premature closure at the expense of quality.

Managers should also be trained on how to respond to reports made outside the formal channel, because an employee may speak to a line manager or HR rather than use the Hotline.

When Is Specialist Legal Counsel or Local Counsel in Egypt Necessary?

Legal involvement becomes particularly important when drafting a policy for a specially regulated company, when a report concerns senior management, or when the matter involves bribery, money laundering, serious fraud or sensitive personal data.

Local Counsel can identify statutory reporting duties, manage evidence preservation, assess employment and privacy risks, supervise investigations and protect the company’s legal position.

How Can Specialist Legal Support Help?

El Rouby Law Firm supports companies in designing and reviewing Whistleblowing policies and aligning them with workplace regulations, governance requirements and data-protection rules, including Triage, investigation and non-retaliation procedures.

The firm also supports risk management, supplier contracts and policies, dispute prevention, negotiation and settlement, litigation and arbitration in related contractual disputes, and representation before the Financial Regulatory Authority, Ministry of Labour, Public Prosecution and other competent Egyptian authorities depending on the matter.

Conclusion

An effective Whistleblowing policy is not merely an email address for receiving complaints. It is a framework linking early detection with investigation, evidence preservation, data protection and governance. It should be tailored to the company and its sector without assuming that one uniform statutory obligation applies to all companies.

Where your company is establishing a reporting channel, reviewing an existing policy or handling a sensitive report, El Rouby Law Firm can review the legal and governance framework, structure report-handling and investigation procedures, and assess any resulting regulatory or judicial steps.