Australian whistleblower protections: the Corporations Act regime and ASIC

An eligible whistleblower under s 1317AAA is a current or former employee, officer or supplier of goods or services, paid or unpaid, and a supplier's employees; an associate; a trustee, custodian or investment manager of a superannuation entity and their staff and service providers; and a spouse, relative or dependant of any of these. The disclosure must concern misconduct or an improper state of affairs, and go to an eligible recipient such as a director, officer, senior manager, auditor, authorised person, ASIC or APRA.

In effect, yes. The Act protects a disclosure made anonymously. ASIC's Information Sheet 238, reissued in June 2026, states that a person can report anonymously and still access the whistleblower protections, and RG 270.83 requires the policy to say so. In practice that means a route where the reporter never has to give a name, and a way to ask follow-up questions and give updates without learning who they are. A reporter who later identifies themselves keeps the same protections.

Public companies, large proprietary companies and proprietary company trustees of registrable superannuation entities, since 1 January 2020. ASIC Corporations (Whistleblower Policies) Instrument 2019/1146 exempts a public company that is a not-for-profit or charity with annual revenue under AUD 1 million. Large means two of three: consolidated revenue of AUD 50 million or more, gross assets of AUD 25 million or more, or 100 or more employees. Under s 1317AI(5) the policy must cover the protections, to whom and how to disclose, support and protection from detriment, investigation, fair treatment of people mentioned, and how the policy is made available. No policy is a strict liability offence: 60 penalty units, about AUD 21,840.

Causing or threatening detriment over a disclosure is a criminal offence and a civil penalty under s 1317AC. The civil maximum for an individual is 5,000 penalty units, about AUD 1.82 million; for a body corporate, the greatest of 50,000 penalty units (about AUD 18.2 million), three times the benefit, or 10 percent of annual turnover capped at 2.5 million penalty units. The dollar figures use the AUD 364 penalty unit that applies from 1 July 2026. Criminal victimisation carries up to two years' imprisonment. In August 2025 the Federal Court ordered TerraCom to pay AUD 7.5 million for public statements calling a whistleblower's claims false, ASIC's first enforcement outcome under the provisions.

No. Section 1317AI(5)(b) requires the policy to say to whom and how disclosures may be made, and RG 270.79 to 82 treat hotlines and web portals as options rather than requirements. ASIC's Report 827, published in December 2025, found that 69 percent of disclosures arrived through a dedicated web page or hotline, and that over one third of companies had no dedicated whistleblower web page at all. The test is whether the routes you name in the policy are the ones people can actually find and use.

A great deal. The Act does not require a hotline, a web portal, particular software, onshore hosting, training, or a timetable for investigations. It requires a policy covering the matters in s 1317AI(5), protection for anonymous disclosures, confidentiality of identity, no detriment, and an eligible recipient to receive the report. How reports arrive, how quickly they are investigated and how often the program is reviewed are company choices. In Report 827, 22 percent of companies received no disclosures and 30 percent do not regularly review their program.