Australia’s private sector whistleblower protection regime is at an inflection point.
More than six years after the enhanced private sector regime was introduced into Part 9.4AAA of the Corporations Act 2001 (Cth) (Corporations Act), the Federal Court is beginning to clarify concepts that have created practical uncertainty for regulated entities and disclosers alike — including who is protected, what kinds of disclosures qualify for protection, what constitutes detriment, and how courts will approach causation and decision-maker state of mind.
That uncertainty is not theoretical: public scrutiny, regulator enforcement activities and concern about the consequences for individuals raising concerns have brought into sharp focus the real-world impact of the regime. In turn, organisations are increasingly operating within a climate of intensified examination of corporate accountability and integrity, with genuine questions being raised as to the adequacy of protections for disclosers who raise concerns in high-profile, high-stakes environments. The recent announcement of Treasury’s statutory review of the corporate whistleblowing laws — with submissions due by 29 July 2026 — has placed the regime firmly back on the reform agenda for the first time since the laws’ introduction in July 2019. The review is expressly directed to whether the laws are working as intended and whether concerns remain about access to justice, incentives to speak up and deterrence of misconduct.
For the entities regulated by the regime - including all companies and constitutional corporations - the challenges faced are not simply grounded in policy compliance but extend to building adequate and effective triage, investigation, confidentiality and decision-making processes that navigate the regime’s onerous confidentiality and detriment prohibitions, and that can withstand scrutiny in complex, fact-sensitive circumstances. For whistleblowers, the position is no less complex. Protection depends on satisfying technical statutory thresholds, making disclosures to the right recipients, and traversing uncertain boundaries between reportable conduct, personal work-related grievances and broader governance concerns.
This four-part series examines the regime from each of these perspectives:-
- Part One explores the eligibility framework, including who qualifies as an eligible whistleblower and who can receive a protected disclosure;
- Part Two considers the boundaries of protected disclosures, including misconduct, improper states of affairs, personal work-related grievances and the requirement for reasonable grounds to suspect reportable conduct;
- Part Three analyses the concept of detriment in the context of the regime — a deliberately broad concept extending beyond termination to reputational, psychological, financial and other forms of disadvantage — and the safeguards organisations should adopt once a disclosure is made or suspected; and
- Part Four looks ahead to the reform landscape, including Treasury’s live consultation, proposals for a whistleblower protection authority, ASIC’s enforcement posture and the broader expectations now being placed on organisations to respond to whistleblower concerns with independence, rigour and transparency.
Part one
Drawing the line: Who qualifies for protection under the whistleblower eligibility framework?
Whistleblower protections are an important cornerstone of Australia’s corporate law and compliance landscape. They are designed to encourage individuals to speak up about corporate misconduct, fraud, or other improper behaviour within organisations and to provide legal safeguards to those individuals against retaliation.
However, six years on from the substantial revisions to the statutory whistleblower protection framework in the Corporations Act 2009 (Cth) (Corporations Act), the whistleblower regime continues to be, in material respects, opaque in its operation and causes uncertainty for those parties seeking to navigate it. While the statutory criteria for eligibility is relatively clear, the application of each element in practice is often misunderstood.
In this opening article of our four-part insight series, we cut through recent developments in the whistleblower space to clarify two of the three foundational elements of when a disclosure may qualify for protection. Specifically, who qualifies as an ‘eligible whistleblower’ and who is an ‘eligible recipient’. The third element addressing what constitutes a ‘disclosable matter’ will be the subject of Part Two of this series.
All or nothing: meeting the threshold requirements
To enliven whistleblower protection under the Corporations Act, three separate threshold requirements need to be met. The discloser must be an eligible whistleblower, who has made their disclosure to an eligible recipient, about a disclosable matter. Importantly, if any one of these requirements is not satisfied, the statutory whistleblower protections will not apply.
Before applying those three threshold requirements, organisations also need to ask a more fundamental question: whether the disclosure is sufficiently connected to a “regulated entity” for the purposes of Part 9.4AAA. That question is usually straightforward for companies and constitutional corporations, but it can be complex in other structures, especially those involving partnerships, service companies and offshore entities. Recent public discussions have highlighted a live debate about whether the current regime adequately captures firms who – while not exclusively structured as bodies corporate – perform work that may have significant market, regulatory or public-interest consequences. Best practice is for organisations operating through complex and/or global structures to map which entities are within the statutory regime, who is authorised to receive disclosures for those entities, and how disclosures that might cross entity or geographical boundaries will be characterised and managed (and to ensure this mapping is updated if any changes are made as a consequence of the statutory review).
Eligible whistleblowers include people connected to the company or organisation about which the disclosure is made, such as current and former employees, officers, contractors and suppliers, associates, and any relatives or dependents of the previous examples.[1]
Eligible recipients comprise a narrower list of persons and organisations or regulatory bodies including – in the context of the Corporations Act - company officers or senior managers, auditors, company actuaries, external regulators (such as ASIC and APRA), a person specifically authorised to receive disclosures (for example, a hotline or individual authorised under a company’s whistleblower policy), and legal practitioners (for the purpose of seeking legal advice about the operation of the regime).[2] Importantly, disclosures made outside of this designated list such as to clients, competitors, or third party body corporates will not be protected.[3] While the statutory tax whistleblowing regime adds tax-related regulators to this list for relevant disclosures, disclosures to regulators not prescribed by the legislation (such as the ACCC) are not currently protected.
In most cases, whether an individual is an eligible whistleblower is uncontroversial. Recent cases confirm this concept is applied strictly, with most eligible whistleblowers being current or former employees making disclosures directly to the company for whom they work (or worked).
However, in some circumstances, this threshold requirement can become a sticking point. For example, when employees of overseas subsidiaries make disclosures to an Australian parent company, the extra-territorial application of the Corporations Act becomes an issue. Whether eligibility is attained in these instances will ultimately turn on the particular factual matrix. A similar issue can arise where an organisation’s operating model does not neatly align with the statutory architecture. Recent public commentary illustrates the point: where work is performed through partnerships, service companies and international networks, careful attention is required to identify the relevant regulated entity, the discloser’s relationship with that entity and the person or function authorised to receive the disclosure. The legal question remains fact-specific, but the practical lesson is clear - ambiguity can translate quickly into uncertainty about protection, escalation and accountability.
Section 1317AAA of the Corporations Act.
Section 1317AAC.
Aland Care Pty Ltd v Pollard [2023] NSWSC 1466 at [31] (‘Pollard’); Express Cargo Services Pty Ltd v Mysko [2023] SASC 11 at [500].
Recent case insight: navigating multi-recipient disclosures
The case of Mount v Dover Castle Metals Pty Ltd [2025] FCA 101 (Mount) has provided important insight into how the protections are impacted where a disclosure is made to both an eligible recipient and another person not characterised as such. In this case, the Federal Court found a disclosure will only attract protection to the extent it is made to an eligible recipient. Importantly though, concurrent disclosure to an ineligible recipient will not deprive the disclosure of the statutory protections.
In Mount, acting CEO Mr Mount made several disclosures to Dover Castle Metals (DCM) through two whistleblower reports sent by email to various recipients. In relation to one of these disclosures, most of the recipients were directors of DCM and neatly fit within the Corporations Act definition of eligible recipient. However, one individual (Mr Stewart) occupied an ambiguous role at the time he received the disclosure. As he could not be described as director, chairman, or company secretary, he was found not to be an eligible recipient.[4]
Ultimately, her Honour Justice Katzmann held the preferable construction was that the disclosure qualified for protection insofar as to it was sent to the directors as eligible recipients, but not to the extent it was sent to Mr Stewart.[5]
Her Honour also provided some interesting commentary regarding the confidentiality provisions of the Corporations Act in the context of this multi-recipient situation (although she did not have to make a finding on this point), flagging the potential for an argument that the disclosure of information to a person who is not an eligible recipient may constitute a waiver of confidentiality which would otherwise apply to the disclosure.[6] Further, her Honour noted the Corporations Act would prevent a company from taking action against a discloser for disclosing confidential information to an eligible recipient, but would not prevent it from taking action against the same discloser for disclosing it to a person or body who was not an eligible recipient.[7] Of course, other federal laws may have a role to play in this event, notably the general protections provisions of the Fair Work Act 2009 (Cth), but the latter does not carry the same criminal and civil personal liability consequences as the Corporations Act regime.
Whether this issue is scrutinised and clarified in future litigation will certainly be of interest to both organisations and disclosers alike.
Mount v Dover Castle Metals Pty Ltd [2025] FCA 101 at [275]-[293].
Mount at [289].
Mount at [293].
Mount at [2923].
What does this mean in practice?
Mount concerned factual circumstances where the disclosure to the ineligible recipient occurred simultaneously with the disclosure to the eligible recipients. In other words, the disclosure was one and the same, and the Federal Court ultimately found it would have been capable of enlivening the protections (if Mr Mount’s claim had been made out) notwithstanding that it was also made to an ineligible recipient.
A similar but slightly different scenario that often arises is where a whistleblower makes two distinct disclosures to an eligible recipient and a person or body who is not an eligible recipient at separate points in time regarding different content. In these circumstances, applying the principles in Mount, the disclosure to the eligible recipient should attract the protection, while the disclosure to the other recipient will not.
Tying this together from a practical perspective, the key takeaways are:
1. |
an eligible whistleblower should try to ensure separate disclosures are only made to eligible recipients, to be assured of their statutory protection in respect of each disclosure; |
2. |
as a matter of best practice, and in light of the Federal Court’s comments in Mount, organisations should exercise caution and treat all whistleblower disclosures confidentially, until the nature of the disclosure and the recipient is fully understood; |
3. |
an organisation’s whistleblower policy should clearly identify who the eligible recipients are in line with Part 9.4AAA, and steps should be taken to ensure these individuals fully understand their role as eligible recipients to minimise the potential risk of an eligible whistleblower’s statutory protections being impacted; and |
4. |
organisations with group, partnership, overseas or service-company structures should map the entities covered by their whistleblower policy, the categories of persons eligible to make disclosures, and the authorised recipients for each relevant entity. Where there is uncertainty about whether a disclosure technically falls within Part 9.4AAA, organisations should preserve confidentiality and non-victimisation protections while that issue is assessed. This is preferable to treating statutory uncertainty as a reason to narrow the response at the outset, as once the identity of a potential whistleblower has been revealed, the damage may be irreversibly done. |
As flagged in our recent alert addressing the statutory review of the regime, these are matters on which Treasury is seeking views through consultation. Mallesons will be preparing a submission to Treasury to draw attention to some of these practical challenges and we welcome engagement with our clients as we finalise our submission.
In the meantime, what is clear is that whistleblower protections are only enlivened where disclosers meet all three components of the statutory eligibility criteria, in relation to an entity that is regulated by the regime. By better understanding how the framework applies in practice and appreciating its complexities (especially for organisations with multi-jurisdictional structures), organisations and disclosers alike can navigate the whistleblower framework with greater clarity and confidence that associated risks are being managed.
