Is My Company Required to Have a Whistleblowing Channel? What the Karin Law and Law 20.393 Require

The first, the Karin Law (Law 21.643, in force since August 1, 2024), rewrote Article 2 and Title IV of Book II of the Labor Code. It covers three conducts defined in Article 2: sexual harassment, workplace harassment, which exists even if it occurs only once, and workplace violence by third parties such as clients, suppliers or users. The channel it requires is the entry point of a procedure with fixed deadlines, conducted by the employer or by the Labor Directorate (Dirección del Trabajo). That procedure governs employers subject to the Labor Code. State officials and workers of State companies subject by law to a special statute fall outside the Code in what that statute regulates (Article 1); for the State Administration, the same Law 21.643 separately amended the Administrative Statute and the Administrative Statute for Municipal Officials. Some sectors also have their own rules, such as higher education institutions, which must have special procedures for complaints and investigation of sexual harassment, violence and gender discrimination (Article 6, letter a), of Law 21.369). The full duty is in the Karin Law page and the investigation rules in its regulation.

Rewritten by Law 21.595 (the Economic Crimes Law), Law 20.393 governs the criminal liability of legal entities. Its channel is an element of the crime prevention model (Article 4). This law does not require the model to be adopted, but its Article 3 makes the company liable for the crimes in the catalogue of Article 1 committed within the scope of its activity by those who hold a position, function or post in it or who provide it services managing its affairs before third parties, when the failure to effectively implement an adequate prevention model favored or facilitated the crime. The channel thus performs a defensive function for the company, and the law sets no deadlines for it. How the model works is in is the prevention model mandatory? and the statute in Law 20.393.

• A prevention protocol available to all workers, prepared through the mutual insurer (organismo administrador of Law 16.744), with the minimum content of Article 211-A: identification of risks, prevention measures, training and measures protecting the privacy and honor of everyone involved in an investigation.
• The duty to inform workers every six months of the channels the company keeps to receive complaints, and of the State bodies where any breach can be reported (Article 211-A; Article 6, letter c), of Supreme Decree No. 21 of 2024 of the Ministry of Labor, the regulation, refers to digital or other channels).
• Receipt in writing or verbally, before the company or the Labor Inspectorate (Inspección del Trabajo), in person or electronically, with a receipt for the complainant; a verbal complaint requires a signed record (acta) with a copy for the complainant (Article 211-B bis; Articles 11 and 12 of the regulation). The regulation lists the content of the complaint, including the identification of the affected person, and prohibits any admissibility screening.
• Immediate protective measures on receipt, weighing the gravity of the facts, the safety of the complainant and the working conditions: separation of physical spaces, redistribution of working hours, early psychological care through the mutual insurer (Article 211-B bis; Article 13 of the regulation).
• A decision within 3 days: investigate internally, informing the Labor Directorate of the start and the measures adopted, or remit the file to the Labor Directorate (Article 211-C). Remittal is mandatory if the complainant asks for it or if the complaint is directed against the manager, the administrator or another person who habitually performs management or administration functions on behalf of the employer (Article 4 of the Labor Code; Article 12 of the regulation). The investigation closes within 30 days, in writing, under strict confidentiality and hearing both parties; the report goes to the Labor Directorate within 2 days; the Directorate has 30 days to rule and its silence validates the conclusions (Article 211-C; Articles 17 and 18 of the regulation). In cases of sexual and workplace harassment, the measures or sanctions are applied within the 15 calendar days following notice of the ruling or, without a ruling, once those 30 days have elapsed (Article 19, paragraphs 1 and 2, of the regulation). Article 211-E of the Code counts those 15 days from receipt of the report.
• Companies with 10 or more permanent workers must also carry the protocol and the procedure in their internal regulations, with the protective measures and the sanctions (Articles 153 and 154 No. 12). The others give them to each worker, in writing, when the employment contract is signed (Article 154 bis).
• The duty to inform the complainant of the channels to report possible crimes to the Public Prosecutor’s Office (Ministerio Público) or the police (Article 211-E; Article 6, letter g), of the regulation).

Article 4 lists what an adequate prevention model must consider, to the extent required by the entity’s corporate purpose, line of business, size, complexity, resources and activities. Its second element is the protocols and procedures to prevent and detect criminal conduct in risky activities, which must necessarily consider secure reporting channels and internal sanctions for breaches. Those protocols must be communicated to all workers and expressly incorporated into the employment and service contracts of everyone, including top executives. The third element assigns one or more persons responsible for applying the protocols, with adequate independence, effective powers of direction and supervision and direct access to management: the position known in practice as the crime prevention officer (encargado de prevención de delitos).

These elements of the model concern a wide universe of entities: Article 2 reaches private-law legal entities, public companies created by law, State companies, corporations and universities, political parties and religious legal entities of public law. Article 3 also extends liability to crimes committed through another legal entity with which there are ownership or participation ties, when that entity manages the company’s affairs before third parties or lacks operational autonomy from it; that is why a group’s channel is usually opened to the staff of its subsidiaries and to its service providers. On who receives the complaints, whether they may be anonymous or how long an investigation may last, Law 20.393 says nothing; it requires the channel to be secure and breaches to carry internal sanctions.

• Confidentiality, with the affected person identified, in harassment matters. The Karin Law procedure is governed by the principles of confidentiality, impartiality, speed and gender perspective (Article 211-B), and the complaint identifies the affected person (Article 11 of the regulation). For Law 20.393 matters the channel only has to be secure, so an anonymous route for suspected crimes is lawful.
• Protection of everyone involved. The protocol includes, by mandate of Article 211-A, letter e), measures protecting the privacy and honor of all participants, measures against inconsistent complaints and mechanisms that safeguard the proper conduct of workers regardless of the outcome of the investigation.
• A record from receipt: the receipt, the signed record of the verbal complaint, the written investigation and the report sent to the Labor Directorate within 2 days of closing (Articles 211-B bis and 211-C; Article 18 of the regulation). A channel unable to produce these documents when the Inspectorate requires them does not prove compliance.
• A designated investigator, preferably a worker trained in harassment, gender or fundamental rights, whose designation is notified in writing to the complainant. When giving their statement, the complainant or the accused may submit information affecting the investigator’s impartiality and request a replacement; the employer decides with reasons (Article 211-C; Article 14 of the regulation). For crime reports, the prevention officer, with the independence and direct access to management required by Article 4 No. 3.

• Internal or external operator. Neither law regulates who operates the intake on the company’s behalf, so nothing prevents a platform or an external firm from operating it if it issues receipts, draws up records and passes the file on immediately. Responsibility stays with the employer: the decision to investigate or remit within 3 days is the employer’s, and the investigation runs on its account even if a third party conducts it. That decision has two limits: the complaint is remitted to the Labor Directorate if the complainant asks for it, and one directed against the manager, the administrator or whoever habitually performs management or administration functions always goes to the Labor Directorate (Article 12 of the regulation). The channel identifies those cases on receipt.
• One channel or several. A single entry point that first asks whether the matter is harassment or violence, or a suspected crime or breach, routes each complaint to its procedure: the Karin Law deadlines and the Labor Directorate on one side, the prevention officer on the other. One complaint may contain facts of both kinds; in that case it follows both routes, each with its own responsible persons and deadlines. Separating them in the design avoids processing a crime report under labor deadlines or a harassment complaint without them.
• Who may use the channel. Article 4 of Law 20.393 requires the protocols to be incorporated into the contracts of workers and service providers alike, and Article 3 reaches related entities. On the labor side, Article 24 of the regulation allows the worker of a contractor or of a temporary services company to file a complaint with the principal or user company. When the facts involve workers of different companies, the principal or user company is always responsible for conducting the investigation, "as appropriate", while each employer adopts the protective measures and applies the sanctions with respect to its own employees. If the complaint is directed against whoever represents the employer under Article 4 of the Code, Article 12 of the regulation orders it always to be referred to the Labor Directorate. The regulation does not say which of the two rules prevails; the prudent course is to refer. A channel closed to those workers is not prepared for the complaints the regulation allows to be filed with the principal company.
• How it serves the investigation. From day one, the intake records the content the regulation lists (Article 11) and the protective measures adopted, because that is what goes to the Labor Directorate within 3 days and what the report reproduces at the end. For crime reports, that record is evidence of traceability: it helps show that the channel was working when it is disputed whether the model was effectively implemented.