Statutory review of Australia’s whistleblower laws: the case for balanced reform

The long‑awaited statutory review of Australia’s tax and corporate whistleblower regimes is now underway. On 2 June 2026, Treasury released its consultation paper, Review of tax and corporate whistleblowing frameworks (Consultation Paper), inviting stakeholder submissions by 29 July 2026. The review presents a pivotal opportunity to address persistent ambiguities, legal complexities and operational challenges that have emerged since the 2019 reforms.

The review is mandated by the Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019 (Cth) (Treasury Laws Amendment), which consolidated corporate and financial sector whistleblowing protections into a single regime in Part 9.4AAA of the Corporations Act 2001 (Cth) (Corporations Act) and introduced a new tax whistleblowing regime in Part IVD of the Taxation Administration Act 1953 (Cth). These reforms were intended to simplify what had been a previously complex legislative framework and to strengthen protections for whistleblowers in the private sector.

In our June 2024 article, ‘Whistleblower laws under review’, we observed a marked increase in client engagement with whistleblowing issues. In particular, with a heightened focus on how whistleblower frameworks operate in practice and how organisations can best manage disclosures while building robust internal frameworks. We identified several uncertainties that endured following the 2019 reforms — particularly given the absence of substantive judicial consideration — and welcomed the then-imminent statutory review as an opportunity to address them.

In this article, we analyse the key areas of the regimes canvassed by the Consultation Paper, dissect aspects of the regimes that continue to pose practical challenges, and consider the Government’s key priorities and potential measures for reform.

Mallesons will be preparing a submission to Treasury to draw attention to some of these practical challenges our practitioners and our clients experience in the handling and investigation of disclosures. We will be looking to engage with our clients on this submission so please do reach out to one of our team if you would like to discuss this with us.

Whistleblowing regime under review

The Consultation Paper opens the door to broader reassessment of the regimes, with the review being framed around a central question: whether Australia’s consolidated tax and corporate whistleblowing regimes are, in practice, delivering on their promise. In particular, Treasury is seeking views on:

• the current administrative arrangements, regulator powers and functions, and the impact of any gaps or overlaps between concurrent whistleblowing regimes;
• the scope of 'eligible whistleblower' categories and the range of entities captured by the regimes, including entity types not currently covered (such as partnerships and unincorporated associations);
• whether anonymous and confidential disclosure protections, and the ability of entities to rely on the carve-out permitting limited disclosures for investigation purposes, are fit-for-purpose;
• whether eligible recipients and regulators are able to receive disclosures in practice;
• compensation and remedy processes, and civil and criminal penalties as a deterrent against victimisation, breach of anonymity, and non-compliance with policy obligations; and
• existing guidance and support for whistleblowers, and the effectiveness of mandatory whistleblower policies in encouraging disclosures and discouraging wrongdoing.

While the breadth of the Consultation Paper indicates an intention to engage with structural and operational challenges, it remains to be seen whether the review will deliver meaningful reform or merely incremental refinement.

Strong and trusted whistleblowing frameworks are a critical pillar of corporate accountability, and this review presents an opportunity to bring clarity to the regime and enhance both protections for whistleblowers and the effectiveness of organisational responses.

Key challenges for our clients

 Encouragingly, there is significant overlap between the issues causing practical difficulties for our clients and those canvassed in the Consultation Paper.

Confidentiality carve-out for investigations remains too narrow

A recurring challenge observed across organisations is navigating the limitation on sharing whistleblower disclosures internally for the purpose of triaging, responding to and investigating them. The confidentiality carve-outs similarly add complexity to established governance processes, such as reporting to executive teams, boards and their committees. There is also a lack of guidance on managing anonymous reports — a significant gap given that ASIC’s 2025 Whistleblower Questionnaire, which polled 134 Australian companies, revealed that over half of in-scope whistleblower disclosures received in the year were made anonymously.[1]

The confidentiality carve-out under both regimes permits the sharing of information as reasonably necessary for an investigation, but only where the whistleblower's identity is not disclosed and all reasonable steps have been taken to reduce the risk of identification. In practice — particularly for smaller organisations or disclosures involving a narrow cohort of employees — it can be very difficult to investigate a matter without risking identification of the whistleblower. This places entities in the position where seeking to investigate a disclosure may compromise their obligation to protect the whistleblower’s identity.

The Consultation Paper considers this issue and asks whether entities are able to sufficiently rely on the carve-out to investigate disclosures. However, its primary focus appears to be on whether whistleblowers are adequately protected, rather than also addressing the practical difficulties facing entities seeking to investigate the matters raised. In our view, there is a compelling case for balanced reform of the confidentiality protections — reform that  clarifies legal obligations and permissions and reduces uncertainty for eligible recipients and entities, while preserving robust protections for whistleblowers. In particular, we consider the review should address:

• current limitations on the ability of entities to brief relevant internal stakeholders in accordance with good governance practices, or for the purpose of obtaining wellbeing support for the discloser;
• whether the current exemption for obtaining legal advice on the operation of the whistleblowing laws is appropriate, or too narrow;
• uncertainty regarding the ability to report matters to local or overseas police;
• uncertainty with respect to circumstances in which the whistleblower is taken to have consented to the disclosure of their identity – including the question of whether the confidentiality protections can be waived and the complexities of handling a rolling series of related disclosures (including where the same or similar subject matter has been previously raised by a whistleblower and investigated via different complaint avenues within an organisation); and
• the risks for eligible recipients and entities arising out of reports made in the course of day-to-day interactions between employees and their managers.

Qualifying disclosures (including the ‘personal work-related grievance’ exclusion) remain unclear

The Consultation Paper opens up a dialogue as to whether there is sufficient clarity around what disclosures qualify for protection under the regimes. 

While judicial consideration of the types of matters qualifying for protection is developing, there remains insufficient practical guidance for entities. In practice, this frequently leads to an overly inclusive approach, whereby matters lacking materiality for the entity are treated as qualifying disclosures simply because they cannot be clearly excluded.

While the whistleblower laws must remain appropriately flexible to capture a wide range of corporate wrongdoing and misconduct, modest amendments could relieve businesses of the time, cost and resources associated with an overly conservative compliance posture.  Similarly, our experience is that the whistleblowing laws may, in some instances, be relied upon in ways that complicate unrelated workplace processes such as restructures, performance management, disciplinary processes, or to leverage a financial payment (including the retrospective characterisation of a communication as a qualifying disclosure).

Particular attention is required to provide better guidance regarding personal work-related grievances.

The Corporations Act carves out personal work-related grievances from protection unless the grievance has significant implications for the regulated entity unrelated to the discloser. Research from Griffith University, as cited in the Consultation Paper, suggests that approximately 70 per cent of disclosures involve integrity issues, with more than half of those also involving workplace issues. While the policy intention of excluding purely personal workplace-related reports remains sound, in practice the boundary between a personal grievance and a systemic disclosure is frequently contested and difficult to assess at the point of receipt. This places considerable pressure on internal teams to make threshold determinations without clear guidance, and creates uncertainty for disclosers seeking statutory protections. It is also appropriate to question whether the existing definition of a personal work-related grievance remains fit for purpose. For example, disclosures concerning workplace matters affecting individuals other than the discloser are not, on the face of the statutory definition, covered by the exception.

For more on our clients’ frontline experiences and difficulties with the whistleblower regime since its 2019 reform, read our ‘Whistleblower laws under review’ article.

Overlap between concurrent regimes

Entities that contract with government, or that are incorporated under the Corporations Act but deliver services to a state or territory public body, may find that their employees qualify for protection under multiple whistleblower regimes simultaneously. For example, an individual who works for an entity contracted to a government organisation could qualify as a whistleblower under both the corporate regime and a public sector regime. This overlap creates genuine confusion for entities regarding which regime applies, which regulator has jurisdiction, and what policies they must comply with. The aged care sector has also recently become subject to an additional, potentially overlapping, whistleblowing regime.

Despite the Attorney-General's Department having consulted on this issue in 2023, the Consultation Paper acknowledges that the matter remains unresolved. The Consultation Paper invites discussion around whether there is sufficient clarity regarding the types of disclosures that qualify for protection under each regime and whether the scope of disclosable matters is appropriately targeted.

The mandatory whistleblower policy requirement

Public companies, large proprietary companies, and proprietary companies that are trustees of registrable superannuation entities are required to have a compliant whistleblower policy and to make it available to officers and employees. Non-compliance attracts a strict liability offence carrying 60 penalty units ($19,800). While the mandatory policy itself may promote transparency, for many organisations the rigid prescription of content — combined with the offence provision — can, in some cases, create compliance burdens that may not always align with intended outcomes. Although ASIC's Regulatory Guide 270[2] requires policies to be proportionate to the nature, size, scale, and complexity of the entity's business, the underlying legislative obligation draws no such distinction. The Consultation Paper invites views on whether whistleblower policies are effective in encouraging disclosures and discouraging wrongdoing but does not appear to contemplate reducing the compliance burden.

Gaps in entity coverage — a double-edged sword

The corporate regime does not capture partnerships, sole traders, trusts, unincorporated associations, or other non-constitutional corporations. Treasury has separately consulted on whether large audit, accounting, and consulting firms (many of which are structured as partnerships) should be brought within scope. Any expansion of entity coverage will impose new obligations on entities that currently sit outside the regime, including the requirement to have a compliant whistleblower policy. These developments may expand the scope of obligations for some organisations.

New measures on the horizon?

Financial incentives for whistleblowers

The most significant prospective reform referenced by Treasury is a financial incentive scheme for whistleblowers. This would represent a marked departure from the current position, where the regime relies primarily on normative drivers — such as perceived moral and civic obligations — rather than economic incentives.

The Consultation Paper canvasses established international models. The United States’ SEC Whistleblower Program provides awards where disclosures lead to enforcement action exceeding USD$1 million. More recently, the United Kingdom introduced a tax rewards scheme offering 15–30% of proceeds where disclosures result in recoveries above £1.5 million.

However, Treasury’s position is notably cautious. The Consultation Paper identifies risks that incentives may increase low‑value or speculative disclosures and may add to regulatory workloads, underscoring the importance of well-resourced oversight. This risk will likely be particularly concerning to organisations already facing a substantial number of whistleblower disclosures by employees as outlined earlier. The Consultation Paper also observes that enforcement timelines may dilute the practical utility of rewards. Practically, there is also a question as to whether the introduction of financial incentives may have the perverse effect of inhibiting genuine disclosures, with prospective whistleblowers concerned to not be seen as a person raising concerns in pursuit of financial reward rather than because it’s the right thing to do. Notwithstanding these concerns, prior parliamentary inquiries have supported the introduction of a rewards scheme.

If adopted, a rewards regime would fundamentally reshape the landscape of Australia’s whistleblowing laws and would require entities to reassess their internal disclosure management frameworks.

Extension of protections to preparatory acts

The Consultation Paper questions whether protections should extend to conduct undertaken in preparation for making a disclosure, such as copying or removing documents. As affirmed by the South Australian Court of Appeal in Boyle v Director of Public Prosecutions (Cth) [2024] SASCA 73, protections under substantially similar legislation are confined to the act of communicating a disclosure, rather than acts undertaken in preparation for it.

International approaches are mixed. The EU confers immunity where information is lawfully accessed, including where documents are copied or removed. Meanwhile, US jurisprudence is less settled, with courts divided on whether employees may retain proprietary information contrary to contractual obligations.

Extending protections in this way would have significant implications for business, potentially constraining the ability to enforce confidentiality obligations and data access controls — a concern Treasury itself acknowledges in the Consultation Paper. At the same time, any reform in this area would need to carefully balance effective protection for whistleblowers with the management of sensitive information and other legal obligations. Given the broad scope of the existing whistleblowing laws, this proposal may introduce additional complexity for entities seeking to protect against unauthorised access to and use of confidential information.

Broader coverage for protected disclosures

Under the current corporate regime (as distinct to the tax regime), disclosures made to regulators are only protected if made to ASIC or APRA, even where the misconduct falls within the remit of another regulator. While the legislation contemplates other bodies being prescribed as eligible recipients, to date this has not occurred.

The Consultation Paper gives the example of a potential whistleblower who notices anti-competitive conduct: a disclosure to the ACCC would not attract protection under the Corporations Act. Treasury is consulting on whether protections should extend to disclosures made to other regulators. If adopted, this would simplify the process for whistleblowers but would expand the range of external channels through which corporate misconduct may be reported — a matter of obvious sensitivity for respondent entities. In our view, a careful approach should be taken to assessing the merits of extending the regime to permit reports to additional regulators, to ensure that any such changes do not inadvertently expand the scope of qualifying disclosures beyond the intended remit of the laws.

A Whistleblower Protection Authority

The establishment of a dedicated Whistleblower Protection Authority to deliver services including advising potential whistleblowers and potentially taking matters to tribunals or courts on their behalf, remains under consideration. While recent legislative proposals have not proceeded, Treasury has been directed to consider the evidence received during the Senate Legal and Constitutional Affairs Legislation Committee’s 2025 inquiry as part of this review. Parallel proposals for a public sector Whistleblower Ombudsman further underscore the policy momentum in this area.

A September 2017 Parliamentary Joint Committee report, Whistleblower protections in the corporate, public and not-for-profit sectors, proposed that a Whistleblower Protection Authority could also include functions investigating non-criminal reprisals and taking non-criminal matters to the workplace tribunal or courts on behalf of whistleblowers.

If a Whistleblower Protection Authority or similar body were established in the corporate regime, it would represent a significant new actor in the enforcement landscape, especially if its functions included undertaking enforcement activities in existing tribunals and courts.

This measure could lead to increased regulatory and dispute activity, creating practical challenges for corporates, particularly those operating in resource‑constrained environments and who rely on existing roles (approximately 79% of companies according to ASIC’s Questionnaire), rather than dedicated whistleblowing functions, to manage these issues.

Reversal of the burden of proof in the corporate regime

The 2024 amendments reversed the evidential burden of proof in all proceedings that may be commenced against a tax whistleblower, meaning that tax whistleblowers need only demonstrate a "reasonable possibility" that they qualify for protection. This amendment is not mirrored in the Corporations Act. Given the Government's stated preference for consistency between the two regimes, there is a clear prospect that the same amendment will be extended to the corporate regime. Extending this approach would materially lower the threshold for corporate whistleblowers to establish protection and increase litigation risk for entities, particularly in early-stage disputes.

Key takeaways

Treasury does not advocate for any particular reform, but the range of questions canvassed in the Consultation Paper — particularly around financial incentives, preparatory act protections, and expanded regulator coverage — signals a potential appetite for reform.  It is critical, in our view, that Treasury hears from a range of organisations as to the opportunities to simplify and clarify the existing regime in a way that preserves meaningful protection for legitimate disclosures. 

We recommend that our clients consider the following priorities:

• Ensuring that any submissions address the practical difficulties with the current confidentiality carve-out for investigations and the overlap between concurrent regimes — these are areas where reform could meaningfully reduce compliance friction.
• Engaging early with the financial incentive proposal — a rewards scheme would represent a paradigm shift in how corporate whistleblowing disclosures are made and managed in Australia, and submissions from private sector respondents will be critical to the Government's assessment of costs and benefits.
• Monitoring the preparatory acts issue closely — any extension of protections to document-gathering activities would require a fundamental reassessment of how our clients manage confidential information, access controls and employment policies.

Next steps

If you need assistance in preparing your own submission by 29 July 2026, would like to provide your input as part of the Mallesons submission, or generally if you would like to discuss the implications of these proposals for your organisation, please reach out to us.