General informationThis page describes the law and ASIC’s published process. It is not legal advice. ASIC says it cannot give legal advice to whistleblowers, and that only a lawyer who understands a person’s circumstances can.
How a report reaches ASIC
ASIC describes its online misconduct form as a single sitting of about 15 minutes. A form cannot be saved part way, and documents cannot be attached, so ASIC suggests gathering the key facts first: when it happened, who was involved, and which product or service it concerns.
- After the form is sent, a reference number appears on screen, and an email confirmation follows if an email address was given.
- ASIC gets back in touch only if it needs more information, and it generally will not say what action it is taking, or whether it is taking any.
- ASIC receives thousands of reports a year and formally investigates a limited number, chosen against its enforcement priorities and criteria.
- ASIC does not resolve complaints, step into disputes, give legal advice or act to recover anyone’s money.
Reports still count when they are not investigated: ASIC says it uses them to spot misconduct, patterns and wider problems, to pick targets for surveillance, and to choose cases for criminal or civil action.
Who qualifies as a whistleblower
There is no registration. The protections apply to anyone who meets the criteria in the Act, which ASIC sets out under four headings.
- Your connection. A current or former employee or officer of the company, or of a related company; a supplier of goods or services to it, paid or unpaid, or a supplier’s employee; an associate; certain superannuation roles; or a spouse, relative or dependant of any of those people, or a dependant of such an individual’s spouse.
- The organisation. A company, a bank or other authorised deposit-taking institution, a general or life insurer, a superannuation entity or trustee, or a body corporate that is a trading or financial corporation.
- Who receives it. A director, company secretary, officer or senior manager; the auditor or audit team; an actuary; a person the organisation has authorised to take disclosures; ASIC or APRA; or a lawyer, when consulted about the whistleblower provisions.
- What it is about. Reasonable grounds to suspect misconduct, or an improper state of affairs or circumstances, including breaches of the Corporations Act or other financial sector laws, Commonwealth offences punishable by 12 months’ imprisonment or more, or a danger to the public or the financial system.
Reasonable grounds means a reasonable person in the same position would also suspect it. The whistleblower does not have to prove the allegation, and their motives do not stop them qualifying. A disclosure can be anonymous and still be protected.
A report that is only about a personal work-related grievance, such as a dispute with a colleague or a decision about the discloser’s own promotion or dismissal, is generally outside the protections, unless it also concerns victimisation for whistleblowing, has wider significance for the organisation, or concerns conduct, or alleged conduct, that would be an offence against or breach of the Corporations Act or another listed financial sector law, an offence against another Commonwealth law punishable by 12 months’ imprisonment or more, a danger to the public or the financial system, or conduct prescribed by regulations. A disclosure to a lawyer to get legal advice or representation about the whistleblower protections can still be protected.
What the protections are
| Protection | What it does |
|---|---|
| Identity | Anyone receiving the report generally cannot reveal the whistleblower’s identity, or details likely to identify them, without consent. Narrow exceptions let it go to ASIC, APRA, the Australian Federal Police or a lawyer for advice, and a court or tribunal can order it disclosed if it finds that justice, or the working of the whistleblower provisions, requires it. |
| Legal action | Protection from criminal, civil and administrative action, including disciplinary action, for making the disclosure. If the disclosure was made to ASIC, APRA or a prescribed Commonwealth authority, or was a public interest or emergency disclosure, the information is also not admissible in evidence against the whistleblower in criminal proceedings or proceedings for a penalty, other than proceedings about whether it was false. These protections do not give immunity for misconduct of the whistleblower’s own that the disclosure reveals. |
| Detriment | Causing or threatening detriment because someone has made, or might make, a disclosure is both a criminal offence and a civil penalty matter. Detriment includes dismissal, changing someone’s duties to their disadvantage, harassment, harm, and damage to property, reputation or finances. |
| Compensation | A whistleblower who suffers loss, damage or injury can seek compensation and other remedies through a court, such as reinstatement, an injunction or an apology. Bringing that action is the whistleblower’s own responsibility. |
ASIC notes two things its role does not include. It does not decide who is a whistleblower; if that is disputed, only a court can decide it. And Australian law offers no financial reward for making a whistleblower report.
Going to a journalist or a parliamentarian
A disclosure to the media or to a member of parliament is protected only in narrow cases, set out in section 1317AAD. A public interest disclosure follows these steps, in order:
- The person first makes a disclosure to ASIC or APRA that itself qualifies for protection.
- At least 90 days pass, and the person has no reasonable grounds to believe action is being, or has been, taken on it.
- The person has reasonable grounds to believe a further disclosure would be in the public interest.
- After the 90 days, the person gives the body they reported to a written notice that identifies the earlier disclosure and says they intend to make a public interest disclosure.
- The disclosure goes to a journalist or a member of an Australian parliament, and says no more than is needed to inform them of the concern.
An emergency disclosure, about a substantial and imminent danger to people’s health or safety or to the natural environment, needs the earlier disclosure and the written notice but not the 90-day wait.
Inside the company
Public companies, large proprietary companies and corporate trustees of registrable superannuation entities have had to keep a whistleblower policy since 1 January 2020, and make it available to their officers and employees; a large proprietary company must do so from 6 months after the end of its first financial year as a large proprietary company. ASIC has exempted a public company limited by guarantee from needing a policy if it is a not-for-profit or charity and its annual revenue is under $1 million. ASIC’s Regulatory Guide 270 explains what a policy should cover.
In December 2025 ASIC published the results of a questionnaire to 134 entities across 18 industries. More than a third had no dedicated whistleblower web page, and a quarter gave staff no regular training on their whistleblower program.
The insider trading rules themselves are explained in the guide to what insider trading is, and the conduct ASIC treats as manipulation in the guide to market manipulation.