New Commonwealth Whistleblower Laws

: Existing Commonwealth whistleblower schemes have been strengthened and consolidated to enhance protections for corporate sector whistleblowers

This training brochure applies to all subscribers other than Victorian public hospital subscribers.

Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 No.10 (Cth)

The Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 No.10 (Cth) (the Amending Act) commenced on 1 July 2019 and has amended the Corporations Act 2001 (the Corps Act).

Application of the new whistleblower protections

The consolidated whistleblower protections apply to all subscribers other than public hospital subscribers in Victoria. Importantly, however, the requirement to have whistleblower policies in place (described below), is restricted to public companies and large proprietary companies incorporated under the Corps Act (see summary below).

Improving protection for whistleblowers in the corporate and financial sectors (applicable to all subscribers other than public hospitals in Victoria)

The amendments consolidate and strengthen corporate and financial sector whistleblower schemes that were (until now) contained under the Corps Act, the Banking Act 1959 (Cth), the Insurance Act 1973 (Cth) and the Superannuation Industry (Supervision) Act 1993 (Cth). The scheme is now centralised and exists under the Corps Act. Under this scheme, protected disclosures can be made in relation to regulated entities such as companies, trading and financial corporations within the meaning of section 51(xx) of the Constitution, banks, insurers and superannuation entities. Disclosure will only be protected if made by an eligible whistleblower (this includes officers, employees and contractors of the organisation).

The Amending Act expands the types of disclosable matter that may be protected by the Corps Act to also include disclosures of conduct which constitute misconduct or an improper state of affairs or circumstances in relation to a regulated entity or related body corporate. In addition to disclosures to ASIC, APRA and prescribed Commonwealth authorities, disclosures will be protected if made to officers and senior managers of the regulated entity itself, assuming it is also disclosable matter under section 1317AA, as discussed below.

Disclosures to a regulated entity are only protected if the information disclosed relates to disclosable matter under section 1317AA(4) and (5) of the Corps Act (in that it relates to misconduct or breach of law as described under those provisions and is not a personal work-related grievance, other than victimisation under section 1317AC as described below).

Information disclosed concerns a personal work-related grievance of the discloser if:

  • the information concerns a grievance about any matter in relation to the discloser’s employment, or former employment, having (or tending to have) implications for the discloser personally; and
  • the information:
    • does not have significant implications for the regulated entity to which it relates, or another regulated entity, that do not relate to the discloser; and
    • does not concern conduct, or alleged conduct, that is an offence against applicable financial, insurance or corporations legislation, an offence against a Commonwealth law that is punishable by imprisonment for 12 months or more, or other conduct that represents a danger to the public or the financial system.

Organisations should be aware that under new section 1317AAE of the Corps Act, it is an offence for a person to disclose an eligible whistleblower’s identity or information that is likely to lead to the identification of the whistleblower (confidential information). The penalty for this offence is 30 penalty units (currently $6,300), or 6 months imprisonment, or both.

Under section 1317AC of the Corps Act, it is also an offence for a person to victimise a whistleblower or another person by engaging in conduct that causes detriment, where the conduct is based on a belief or suspicion a person has made, may have made, proposes to make or could make a disclosure that qualifies for protection. It is also important to note that the offence of victimisation also covers threats to cause detriment to the whistleblower, or a person who assists the whistleblower. Detriment is defined broadly to include:

  • dismissal of an employee;
  • injury of an employee in his or her employment;
  • alteration of an employee’s position or duties to his or her disadvantage;
  • discrimination between an employee and other employees of the same employer;
  • harassment or intimidation of a person;
  • harm or injury to a person, including psychological harm;
  • damage to a person’s property;
  • damage to a person’s reputation;
  • damage to a person’s business or financial position; and
  • any other damage to a person.

For breach of this section, the penalty is 120 penalty units (currently $25,200) or imprisonment for 2 years, or both.

Further to this, new section 1317AAD will include protections for public interest and emergency disclosures. This section permits persons to disclose certain information to Parliamentarians or journalists where the disclosure would be in the public interest or the information concerns a substantial and imminent danger to the health or safety of one or more persons or the natural environment. A key limitation for these disclosures are that they must have first been made under another provision of the Corps Act (i.e. to ASIC, APRA, a prescribed Commonwealth authority or the regulated entity in relation to which the disclosure relates) and, in the case of a public interest disclosure a period of 90 days must have passed before the initial disclosure was made. For the further conditions that apply before a disclosure of either type can be made, please see section 1317AAD of the Act.

Whistleblower policies (applicable to public companies and large proprietary companies incorporated under the Corps Act)

To facilitate the operation of the new disclosure scheme under the Corps Act, new section 1317AI requires public companies and organisations that have been a large proprietary company for any year to have in place a whistleblower policy which covers the requirements of that section including, for example, information about how a company will support whistleblowers and protect them from detriment. The penalty for failure to comply with that section is 60 penalty units (currently $12,600). Public companies must have a policy in place by 1 January 2020 and large proprietary companies must have one in place within 6 months of the end of the financial year in which they meet the threshold for the large proprietary company classification. This will be 1 January 2020 for proprietary companies that have already met this threshold for any previous financial year.

An organisation is a large proprietary company for a financial year if their consolidated revenue for the year is $50 million or more, their consolidated gross assets are $25 million or more at the end of the relevant financial year, or they have 100 or more employees at the end of the year. In determining this, organisations should take into account the revenue, assets and employees of the entities controlled by the company.


Organisations should be aware of the types of disclosures and persons that are protected under the Corps Act and implement controls to ensure that the organisation does not commit an offence against the Act by breaching confidentiality or victimisation provisions. For public companies and large proprietary companies, whistleblower policies should be produced and made available to ensure compliance with section 1317AI of the Corps Act.

Please see the NATIONAL – Protections for Whistleblowers (Corporations Law) topic for more information.


For further information please contact the Law Compliance team:

Phone: 1300 862 667


Share this post

Ready to get in touch?