Must I make anonymous reporting possible?

Anonymous reporting is not a legal requirement

No, an employer is not required to enable anonymous reporting. Both the Dutch Protected Disclosures Act and the German Hinweisgeberschutzgesetz mandate an internal reporting channel, a procedure and the associated timeframes, but neither law requires that an employee be able to report without providing their name. A reporting channel that only accepts reports provided with a name therefore complies with the basic legal obligation.

The difference lies in what happens if an anonymous report is nevertheless received, and that difference is not merely cosmetic. In the Netherlands, an anonymous report does not need to be processed; the employer may disregard it. In Germany, the situation is different: if an anonymous report is received, it must be addressed, even though there was no obligation to establish a channel for it. For an organisation active in both countries, this means that the same reporting page can ignore an anonymous report in the Netherlands but cannot do so in Germany. In addition, in both countries, the works council (Netherlands) or the Betriebsrat (Germany) has consent rights regarding the design of the reporting system — even if anonymous reporting is not part of it, that consent process is not optional.

What the Protected Disclosures Act and the HinSchG say about this

The scope to make this decision yourself stems from the European directive itself: Article 6 of Directive (EU) 2019/1937 explicitly leaves the choice regarding anonymous reports to the Member States. The Netherlands has exercised this choice in the Protected Disclosures Act, which contains no obligation for an anonymous channel and does not require that a received anonymous report be processed. Germany has in § 16 Abs. 1 Satz 4 HinSchG the same freedom to refrain from establishing an anonymous channel, but has coupled an obligation to process any anonymous report that is received.