Corporations Act: Whistleblower Protections in Australia

Understanding the Corporations Act 2001

The main whistleblower laws for Australian companies sit in Part 9.4AAA of the Corporations Act 2001 (Cth). If someone inside a company reports suspected misconduct to the right person, Part 9.4AAA keeps their identity confidential, protects them from retaliation and gives them a route to compensation.

The rest of the Act governs how companies are formed and run. The Corporations Act whistleblower protections were rewritten in 2019 and apply to every company, large or small. Tax whistleblowers have a parallel scheme in Part IVD of the Taxation Administration Act 1953 (Cth). Public sector employees are covered by separate laws: the Public Interest Disclosure Act 2013 (Cth) for Commonwealth agencies, and state and territory public interest disclosure laws for state agencies.

Corporations Act compliance

Every company is bound by the protections, but only some must have a written whistleblower policy. Section 1317AI requires one from public companies, large proprietary companies and proprietary companies that are trustees of a registrable superannuation entity. Policies have been required since 1 January 2020.

A proprietary company is “large” for a financial year if it meets at least two of these tests:

1. Consolidated revenue of the company and any entities it controls is $50 million or more for the financial year.
2. Consolidated gross assets of the company and any entities it controls are $25 million or more at the end of the financial year.
3. The company and any entities it controls have 100 or more employees at the end of the financial year.

ASIC has exempted not-for-profit and charitable public companies with annual revenue under $1 million. The thresholds may rise: the Government is consulting on lifting the revenue test to $100 million and the asset test to $50 million. Until that happens, the figures above apply.

Criteria for whistleblowing under the Corporations Act

Section 1317AA looks at who made the disclosure, who received it and what it is about. A disclosure has to pass each test.

Eligible whistleblower: Section 1317AAA covers anyone who is or has been an officer or employee of the company, or who supplies it with goods or services, paid or unpaid. Suppliers' employees and associates of the company qualify, and so do relatives and dependants of anyone in those groups.

Eligible recipient: The disclosure must go to someone the Act recognises:

• An officer or senior manager of the company or a related body corporate
• An auditor, or a member of an audit team conducting an audit, of the company
• An actuary of the company
• A person the company has authorised to receive disclosures, such as a designated whistleblower officer
• A legal practitioner, for the purpose of obtaining legal advice or representation
• ASIC, APRA or a prescribed Commonwealth authority

Reasonable grounds: The whistleblower must have reasonable grounds to suspect that the information concerns misconduct, or an improper state of affairs or circumstances, in relation to the company or a related body corporate. A disclosure that turns out to be mistaken can still qualify.

Disclosable matters: The disclosure must relate to one or more of the following:

• Misconduct, or an improper state of affairs or circumstances, in relation to the company or a related body corporate
• An offence against, or a contravention of, specified legislation, including the Corporations Act
• An offence against any other Commonwealth law punishable by 12 months' imprisonment or more
• Conduct that represents a danger to the public or the financial system
• Conduct prescribed by regulations

Personal work-related grievances are excluded by section 1317AADA. A clash with a colleague or a decision about your promotion falls outside Part 9.4AAA unless it has wider implications for the company, or concerns detriment you suffered for making a disclosure.

Good faith: The 2019 reforms removed the good faith requirement. ASIC has said a whistleblower's motive is not relevant, so a disclosure made out of anger at a manager is still protected if the grounds are reasonable.

Public interest and emergency disclosures

Section 1317AAD lets a whistleblower take information to a journalist or a member of parliament, but only after reporting it to a regulator. Every condition must be met, so get legal advice first.

For a public interest disclosure, the whistleblower must:

1. Have previously made a disclosure to a regulator (ASIC, APRA or a prescribed Commonwealth authority)
2. Wait at least 90 days since the initial disclosure
3. Have no reasonable grounds to believe action is being, or has been, taken to address the matter
4. Have reasonable grounds to believe a further disclosure would be in the public interest
5. After the 90 days, give the regulator written notice of their intention to make a public interest disclosure

For an emergency disclosure, there is no waiting period. The whistleblower must:

1. Have previously made a disclosure to a regulator
2. Have reasonable grounds to believe the information concerns a substantial and imminent danger to the health or safety of one or more people, or to the natural environment
3. Give the regulator written notice of their intention to make an emergency disclosure

In both cases, the whistleblower can share only what the journalist or parliamentarian needs to understand the misconduct or the danger.

Protections for whistleblowers

Once a disclosure qualifies, the whistleblower protections in the Corporations Act apply. They exist to encourage whistleblowers to come forward, because nobody reports misconduct if speaking up costs them their job.

Confidentiality comes first. Under section 1317AAE, anyone who learns a whistleblower's identity because of the disclosure must not reveal it, or anything likely to identify them, without consent. Narrow exceptions cover ASIC, APRA, the Australian Federal Police and lawyers.

Detrimental conduct

Section 1317AC makes it an offence to cause or threaten detriment to someone because you believe or suspect they made, or might make, a protected disclosure. The suspicion is enough. A manager who sidelines an employee they think went to ASIC is caught, whether or not the employee did. Detriment includes:

• Dismissal, or altering an employee's position or duties to their disadvantage
• Harassment, intimidation or discrimination
• Harm or injury, including psychological harm
• Damage to property, reputation, business or financial position
• Any other damage to the person

Section 1317AB gives the whistleblower immunity from civil, criminal and administrative liability, including disciplinary action, for making the disclosure. No contractual remedy can be enforced against them because of it, so a confidentiality clause cannot be used to punish a protected disclosure. The immunity covers the act of disclosing. It does not excuse the whistleblower's own misconduct if the report reveals any.

The people who receive reports need to know these rules before the first one arrives. A team leader who tells colleagues who raised a concern has breached section 1317AAE, however well meant.

Penalties

Detrimental conduct and confidentiality breaches attract civil penalties under section 1317G. The maximum for an individual is at least 5,000 penalty units. For a company it is the greatest of 50,000 penalty units, three times the benefit gained, or 10% of annual turnover (capped). With a Commonwealth penalty unit at $364 for contraventions from 1 July 2026, that means at least $1.82 million for individuals and $18.2 million for companies.

Whistleblowers who suffer detriment can also ask a court for compensation or reinstatement under section 1317AE.

Expanded protections under the Treasury Laws Amendments

The Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 took effect on 1 July 2019. The old rules required whistleblowers to give their name and act in good faith.

The key changes include:

• Expand eligibility for whistleblower protections: The definition of an "eligible whistleblower" now reaches former insiders, suppliers and their staff, and the families of each.
• Expanding the range of reportable conduct: Disclosable matters now include misconduct or an improper state of affairs generally, and Commonwealth offences carrying 12 months' imprisonment or more. Tax matters got their own protections in the Taxation Administration Act.
• Allow anonymous disclosures: Whistleblowers no longer have to identify themselves to be protected, which matters most to people who fear being found out.
• Strengthen confidentiality protections: Revealing a whistleblower's identity without consent is an offence and a civil penalty contravention.
• Introduce civil penalties and remedies: Civil penalties now sit alongside the existing criminal offences for causing detriment or breaching confidentiality.
• Require whistleblower policies: Public companies, large proprietary companies, and corporate trustees of registrable superannuation entities must have a whistleblower policy.

Implications for Australian organisations

A policy on the intranet does little by itself. When ASIC reviewed whistleblower policies in 2021, a third still said only disclosures made in good faith were protected.

Developing a robust whistleblower policy

Section 1317AI(5) says the policy must explain:

• The protections available to whistleblowers
• How and to whom disclosures can be made
• How the organisation will support whistleblowers and protect them from detriment
• How investigations into disclosures will be conducted
• How the organisation will ensure fair treatment of employees mentioned in disclosures
• How the policy will be made available to officers and employees

Have legal, compliance and risk review the draft, along with whoever will receive reports. Then check it against what happens when a report comes in. A policy that describes a process nobody follows helps no one.

Establishing secure reporting channels

Staff need a channel that reaches an eligible recipient without going through their own manager. That might be a designated officer, a dedicated ethics hotline or an online platform. They should also know they can go straight to ASIC or a lawyer.

Anonymity has to work in practice. If the only way to report is a company email address, the whistleblower's name arrives with the report. A secure third-party whistleblowing platform lets someone stay anonymous and still answer follow-up questions.

Training and awareness

All staff need to know what they can report, where, and what protection they get. Managers need more. Senior managers are eligible recipients under section 1317AAC whether or not anyone has trained them, so a concern raised in a corridor may already be a protected disclosure.

Repeat the training regularly, and make clear that anyone involved in victimising a whistleblower is personally exposed.

Prompt and fair investigations

Part 9.4AAA sets no deadline for investigating, but your policy must say how you will investigate, so decide before the first report arrives. For sensitive matters, or anything involving senior leaders, an external investigator gives you independence an internal team cannot.

Report findings to the board or the right level of management. Keep the whistleblower's identity out of the file wherever you can, and watch for retaliation after the case closes. It can show up months later as a missed promotion or a changed roster.

Ongoing monitoring and review

Review the policy, channels and investigation process at least once a year and after any significant case. Look at how many reports came in, how long they took, and whether anyone who reported later left.

Boards and senior management should get regular reports on disclosure numbers, outcomes and trends, with identities removed. A sudden drop in reports from one business unit can mean people have stopped trusting the channel.