Howard Wilkinson filed an internal whistleblower report to Danske Bank's executive board in December 2013 with a subject line explicitly referencing criminal conduct. The report was discussed at an executive board meeting in January 2014. Wilkinson received no follow-up and resigned in April 2014. A watered-down version of the audit report was never shared with the Danish regulator. Under which international framework — adopted by the EU in 2019 partly as a direct consequence of this case — are member states now legally required to protect and report whistleblower disclosures like Wilkinson's?