Reporting corruption without fear

Most corruption is discovered because someone spoke up: an employee who saw an invoice that made no sense, a civil servant asked to sign off on a doubtful contract, a supplier who was told that a “fee” would help their offer. Audits and investigations depend on information that only people close to the events can provide.

Yet many people stay silent. In the 2017 Special Eurobarometer, as reported by Transparency International EU, 81% of respondents who had experienced or witnessed corruption said they had not reported it to anyone, and nearly half of Europeans did not know where they could report it. Many feared legal or financial consequences, and nearly a third thought that people who report corruption are not protected.

The fear is understandable, and it is the reason EU law now gives people who report wrongdoing a set of rights. This page explains where to go, what to expect and how the law protects you. It is general information, not legal advice. If your situation is complex or risky, consult a lawyer or a specialised support organisation before you act.

The right place depends on what you saw and whose money is involved.

National authorities. Most corruption concerns national or local budgets and officials. In that case the competent bodies are the national police, public prosecutors or a dedicated anti-corruption agency. Many countries also have channels inside public bodies and large companies.

The European Public Prosecutor’s Office (EPPO). If you suspect a crime that harms the EU budget, such as fraud with EU funds, corruption affecting EU money, money laundering or cross-border VAT fraud, you can report it to EPPO. Anyone can do so, whether an EU citizen or not, a private individual or a company, provided there are reasonable grounds to suspect an offence. Reports go through the “Report a crime” web form and may be written in any official EU language. After submitting, you receive an acknowledgement with a registration number.

The European Anti-Fraud Office (OLAF). OLAF investigates fraud and serious irregularities affecting EU funds, and serious misconduct by staff or members of EU institutions. You can contact OLAF anonymously and without formalities, using its Fraud Notification System, in any of the 24 official EU languages, or by post to the European Commission, European Anti-Fraud Office (OLAF), 1049 Brussels, Belgium. The more precise and documented your information, the more useful it is.

The two bodies work together. EPPO is a prosecutor and handles criminal cases, while OLAF conducts administrative investigations. OLAF passes on to EPPO any conduct that EPPO may prosecute, so reporting to either one is a reasonable start.

Directive (EU) 2019/1937, known as the Whistleblower Directive, sets minimum standards that apply in all Member States. In short:

• Who is protected. People who report breaches of EU law in a work-related context: employees, civil servants, self-employed contractors, shareholders, volunteers, trainees and job applicants. Colleagues and relatives who help or may suffer because of the report are also covered.
• What is covered. Breaches of EU law in listed areas, among them public procurement, financial services and money laundering, and the protection of the EU’s financial interests. Many countries have extended protection to national law as well.
• Three ways to report. Internally (organisations of a certain size, and public bodies, must provide a safe channel), externally to a competent authority, or by public disclosure, which is protected only in specific circumstances.
• Clear deadlines. The recipient must acknowledge your report within seven days and give you feedback within three months.
• Confidentiality. Your identity may not be disclosed without your consent, apart from narrow legal exceptions.
• No retaliation. Dismissal, demotion, threats, harassment or other punishment for reporting are prohibited, and if you suffer a disadvantage after reporting, it is assumed to be retaliation unless the employer proves otherwise.

The deadline for Member States to transpose the directive was December 2021. How well it works in practice differs from one country to another, so check the rules and the competent authority in your own country.

If you work for a public body or a company, the first option is often the internal channel. Under the Whistleblower Directive, public bodies and private organisations above a certain size must provide a way to report concerns safely, with a person or department designated to receive reports, keep them confidential and follow up. Smaller organisations in some sectors are covered too, and national rules can go further.

Internal reporting can be the quickest way to stop a problem, and it is often the expected first step. The Directive nevertheless does not oblige you to use it first: you may go directly to a competent external authority, for example if you fear retaliation, if you do not trust the internal channel, or if the people at the top are involved. Choose the route that realistically gives your report the best chance of being handled properly, and keep a record of what you submitted and when.

Managers and employers have an interest in creating channels that people trust. A safe internal channel allows problems to be fixed early, before they become a scandal or a criminal case. Good practice includes naming an impartial person or team to receive reports, guaranteeing confidentiality, acknowledging reports within seven days, providing feedback within three months, and making it very clear that retaliation will have consequences.

It also means training managers to respond well. A person who raises a concern needs to be heard and thanked, not questioned about their motives. Organisations that react to a report by punishing the messenger teach everyone else to stay silent, and often end up with a much bigger problem later.

A report is the start of a process, not the end of it. The authority will normally confirm receipt and assess whether the facts fall within its remit. If they do, an investigation may follow, which can take months or years. You may not be told details, because investigations are confidential and the rights of suspects must be respected.

Reports do lead somewhere. In 2025 EPPO processed 6,966 crime reports and opened 2,030 new investigations. In the same year it filed 275 indictments against 1,438 people, and its conviction rate in cases that reach judgment is close to 95%. Not every report becomes a case, and a suspicion is not proof, but the system does produce results.

Reporting wrongdoing can be stressful, even when the law is on your side. It helps to talk to someone you trust and to a lawyer or advisory service before you act, and to think about how you will handle the time between the report and the outcome. Many countries have organisations that provide free, confidential advice to whistleblowers and, in some cases, legal support.

Keep your report factual, avoid discussing it widely in the meantime, and do not take documents you are not entitled to take. Staying calm and methodical protects both you and the credibility of your case.

Fear of reporting is not irrational. Many Europeans doubt that wrongdoers face consequences: in the 2024 Eurobarometer, 65% said that high-level corruption cases are not sufficiently pursued. When people believe that nothing will happen, or that they might pay a price, they stay silent.

The EU is trying to change that. Directive (EU) 2026/1021 on combating corruption, published in May 2026, harmonises corruption offences and penalties across Member States, and Member States must bring it into national law by June 2028. Together with the Whistleblower Directive, it is meant to make reporting both safer and more likely to lead to results. Whether it succeeds will depend on how national authorities apply it.

What you can do now is to inform yourself, use the protected channels, and, where possible, seek support. Organisations that advise whistleblowers exist in many countries, and legal advice before reporting is a sensible precaution.