Whistleblower Compliance in Australia: Corporations Act, AUSTRAC and Documentation Guide 2026

Regulatory disclaimer: This article is for informational purposes only. Australian whistleblower obligations apply under the Corporations Act 2001 and AML/CTF Act 2006. Consult legal counsel for your specific situation.

Australia has a robust, company-specific whistleblower protection regime under Part 9.4AAA of the Corporations Act 2001, significantly strengthened by the Treasury Laws Amendment (Enhancing Whistleblower Protections) Act 2019. Unlike the EU's size-based threshold system, Australian obligations apply to public companies, large proprietary companies, and companies limited by guarantee — regardless of employee count in most cases. This guide covers the documentation requirements your compliance team must maintain.

Who Must Comply: Australian Whistleblower Obligations

AUSTRAC-regulated entities have additional obligations. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), reporting entities must submit Suspicious Matter Reports (SMRs) to AUSTRAC and maintain documented AML/CTF programs that include internal reporting procedures. As of January 2026, AUSTRAC's amended guidance requires explicitly addressing the protection of employees who raise AML/CTF concerns internally.

Corporations Act Whistleblower Policy: Documentation Requirements

Under section 1317AI of the Corporations Act, entities that must have a whistleblower policy must include the following in a written, publicly available document:

Mandatory policy content

1. Information about the protections available to whistleblowers under the Corporations Act
2. Information about the entity's internal mechanisms for making disclosures
3. Information about how the entity will investigate disclosures
4. Information about how the entity will protect the confidentiality of disclosures
5. Information about how the entity will protect whistleblowers from detriment
6. Information about the availability of external reporting channels (ASIC, ATO, APRA)

ASIC guidance RG 270 (Whistleblower Policies) provides detailed guidance on what must be included in a compliant policy. ASIC has taken enforcement action against companies with inadequate policies.

Record-keeping requirements

All records related to whistleblower disclosures must be secured with restricted access — only the Whistleblower Protection Officer (WPO) and authorised investigators should have access during an active investigation.

Eligible Disclosures and Protected Conduct

Under Part 9.4AAA, an "eligible whistleblower" is a current or former officer, employee, contractor, supplier, associate, or their relatives or dependants. An "eligible disclosure" is a disclosure that:

• Is made to ASIC, APRA, the ATO, another prescribed body, or a legal practitioner for the purpose of obtaining legal advice
• Relates to a contravention of, or concern about, the Corporations Act, the ASIC Act, banking laws, insurance laws, or superannuation laws
• Is made by an eligible whistleblower who has reasonable grounds to suspect the conduct

Anonymous disclosures are protected under the Corporations Act, provided the whistleblower does not disclose their identity. The protected whistleblower's identity must not be disclosed without their consent, except in limited circumstances (e.g., to ASIC investigators).

AUSTRAC Suspicious Matter Reporting (SMR) Documentation

Financial institutions and other designated reporting entities must submit SMRs to AUSTRAC when they form a suspicion that a matter is relevant to an investigation of, or prosecution for, an offence against any Australian law.

SMR documentation obligations:

AUSTRAC's tipping-off prohibition under section 123 of the AML/CTF Act is absolute: a reporting entity must not disclose to the subject of an SMR that a report has been made or is being considered. This is more restrictive than most EU member state implementations of the Directive.

Privacy Act 1988 and Australian Privacy Principles (APPs)

Whistleblower data is personal information subject to the Privacy Act 1988 and the Australian Privacy Principles (APPs). Key obligations for whistleblowing channel operators:

• APP 3 (Collection): Collect only personal information that is reasonably necessary for the legitimate business purpose (investigating the disclosure)
• APP 6 (Use and Disclosure): Use whistleblower information only for the purpose for which it was collected
• APP 11 (Security): Take reasonable steps to protect whistleblower personal information from misuse, interference, loss, and unauthorised access
• APP 1 (Open and Transparent Management): Update your privacy policy to describe how you handle whistleblower disclosures

The OAIC (Office of the Australian Information Commissioner) has published guidance on whistleblower privacy. A Privacy Impact Assessment (PIA) is recommended before deploying a new whistleblowing platform.

Identity Verification in the Australian Context

For Australian entities, identity verification relevant to whistleblower and KYC contexts uses:

CheckFile supports 3,200+ document types across 32 jurisdictions. For Australian financial institutions, the KYC verification module supports document verification aligned with AUSTRAC's customer identification requirements and the Digital Transformation Agency's Trusted Digital Identity Framework (TDIF).

Building an Australia-Compliant Whistleblower Programme

Key differences from the EU framework that Australian compliance teams must address:

1. Entity type, not size: Australia triggers obligations based on company type (public, large proprietary), not employee count
2. Mandatory policy publication: The policy must be available to officers, employees, and contractors — effectively a public document
3. Designated Whistleblower Protection Officer (WPO): ASIC recommends (though does not mandate) a named WPO
4. AUSTRAC tipping-off: Absolute prohibition, stricter than most EU implementations

A practical checklist for Australian compliance:

• Adopt and publish a Corporations Act-compliant whistleblower policy (required for public and large proprietary companies)
• Appoint a WPO and document the appointment
• Establish intake procedures with restricted-access records (7-year retention)
• Complete PIA before deploying whistleblowing platform (Privacy Act recommendation)
• Establish SMR filing procedures for AUSTRAC-regulated entities with 7-year retention
• Train eligible recipients on their obligations under the Corporations Act
• Annual policy review and version control

Integrate this into your compliance risk assessment and our document compliance guide for a complete governance framework.

Frequently Asked Questions

Does a small private Australian company need a whistleblower policy?

Not by law if it is a small proprietary company (below the "large proprietary" thresholds: revenue below $50M, assets below $25M, fewer than 100 employees). However, the Corporations Act's whistleblower protections apply to disclosures made to any company, regardless of whether a formal policy is required. Best practice is to have a basic policy in place even if not legally required.

What happens if we breach the tipping-off prohibition under the AML/CTF Act?

Tipping off under section 123 of the AML/CTF Act is a criminal offence carrying up to 2 years' imprisonment or a fine of up to 100 penalty units (currently $33,000 AUD). AUSTRAC actively enforces this prohibition. All staff involved in AML/CTF compliance must be trained on the prohibition, and records of training must be maintained.

How long must AUSTRAC-related records be retained?

All records required under the AML/CTF Act — including SMRs, customer identification records, and transaction records — must be retained for 7 years from the relevant date (date of transaction, date of identification, or date of SMR filing). Records must be in English or readily translatable into English.

Does ASIC actively enforce the whistleblower policy requirements?

Yes. ASIC has issued infringement notices and commenced enforcement actions against companies with inadequate or non-existent whistleblower policies. Penalties for non-compliance include civil penalties of up to $1.1 million for companies and $222,000 for individuals. ASIC publishes enforcement outcomes on its website.

Can anonymous disclosures be made under the Australian regime?

Yes. The Corporations Act explicitly protects anonymous disclosures. An eligible whistleblower can make a disclosure without identifying themselves, and the disclosure is still protected. The receiving person or body cannot attempt to identify the anonymous discloser.