Who must comply with corporate whistleblower protections (Part 9.4AAA Corporations Act)?
The applicability test for Comply with corporate whistleblower protections (Part 9.4AAA Corporations Act) (ASIC), computed across 35 industries, 9 business structures and 6 size bands.
Short answer: Some businesses
Applies when the business has a public company or an ASX listing or large proprietary company status. Where the business has maybe large proprietary, check whether you are a large proprietary company (s 1317AI policy requirement).
What the obligation is
Public companies and large proprietary companies must have a whistleblower policy and protect disclosers.
Part 9.4AAA of the Corporations Act (and Pt IVD of the Taxation Administration Act 1953) provides legal protections for whistleblowers reporting misconduct in corporations. Public companies, large proprietary companies and corporate trustees of registrable superannuation entities must have a written whistleblower policy. Confidentiality and victimisation protections backed by significant civil and criminal penalties.
The applicability test
Applies when the business has a public company or an ASX listing or large proprietary company status. Where the business has maybe large proprietary, check whether you are a large proprietary company (s 1317AI policy requirement).
How the regulator frames it: Public companies, large proprietary companies, corporate trustees of RSEs.
What triggers it: Being a covered entity.
Jurisdiction: Commonwealth law, so the test is the same in every state and territory.
Which industries are in or out
Outcome across the 35 industries Rules Mate maps (35 of 35: depends on size or structure).
The answer is the same in every industry: depends on size or structure. Industry does not change who must comply.
Business structure and size
| Structure | Answer across all industries, any size | Engine's reason (real estate agents, 6–19 employees) |
|---|---|---|
| Sole trader | No | Requires a public company or an ASX listing or large proprietary company status |
| Partnership | No | Requires a public company or an ASX listing or large proprietary company status |
| Trust | No | Requires a public company or an ASX listing or large proprietary company status |
| Pty Ltd company | Depends on size or structure | Requires a public company or an ASX listing or large proprietary company status |
| Public company | Yes | Public company |
| Not-for-profit (unregistered) | No | Requires a public company or an ASX listing or large proprietary company status |
| Registered charity | No | Requires a public company or an ASX listing or large proprietary company status |
| Super fund | No | Requires a public company or an ASX listing or large proprietary company status |
| Foreign company | No | Requires a public company or an ASX listing or large proprietary company status |
Size does not change the answer across all industries: at every size band the answer is "depends on size or structure".
Worked examples
Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:
- Pty Ltd company in real estate agents with 500+ employees, turnover $100M–$1B: applies. Large proprietary company (revenue ≥ $50M and 100+ employees — s 45A)
- Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a public company or an ASX listing or large proprietary company status.
- Pty Ltd company in real estate agents with 100–499 employees, turnover $10M–$100M: check whether it applies. applies only if you are a large proprietary company (s 1317AI policy requirement)
- Pty Ltd company in real estate agents with no employees, turnover $100K–$1M: does not apply. Requires a public company or an ASX listing or large proprietary company status.
Answers that bring it into scope
Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:
- The business is listed (or listing) on the ASX: it then applies (ASX-listed (or preparing to list)).
When you need to check further
The engine shows this obligation as "check whether this applies" when a business has maybe large proprietary. It then applies only if you are a large proprietary company (s 1317AI policy requirement). That fact is not something Rules Mate can infer from industry, structure or size.
What you must do, and when
- When due
- Whistleblower policy in place; ongoing protection.
- Frequency
- Ongoing
- Evidence to keep
- Whistleblower policy, training records, intake mechanism, investigation protocol.
- Status
- Current
- Priority
- High
Penalty for not complying
Maximum penalty: Civil penalties up to $1.82M (individuals, 5,000 penalty units); criminal liability for victimisation.
Criminal liability
Audit or assurance level
Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.
What usually applies alongside it
Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:
- Maintain auditor / financial reporting (Chapter 2M): applies to 100% of the same businesses (7.7× the overall rate)
- Lodge the ASIC annual company statement and review fee: applies to 100% of the same businesses (4.5× the overall rate)
- Pay ASIC fees + lodge prescribed forms: applies to 100% of the same businesses (4.5× the overall rate)
- Beneficial ownership transparency (Tranche 3 — under consultation): applies to 100% of the same businesses (4.5× the overall rate)
- Pay company PAYG/GST/SG or face Director Penalty Notice (DPN): applies to 100% of the same businesses (4.5× the overall rate)
- Discharge of directors' duties — practical evidence: applies to 100% of the same businesses (4.5× the overall rate)
Where it sits in the corpus
Rules Mate tracks 2 published obligations tagged "whistleblower", 0 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority and carries criminal liability, and is an ongoing duty.
Regulator, legislation and tools
Regulated by Australian Securities and Investments Commission.
ASIC: Corporate regulator administering the Corporations Act, financial services and credit licensing (AFSL/ACL), markets supervision, insolvency, and registries (ASIC and ABRS).
Corporations Act: The foundational federal Act for Australian corporate law.
Free tools that help with this obligation:
Questions
- Who must comply with corporate whistleblower protections (Part 9.4AAA Corporations Act)?
- Applies when the business has a public company or an ASX listing or large proprietary company status. Where the business has maybe large proprietary, check whether you are a large proprietary company (s 1317AI policy requirement).
- Do sole traders need to comply with corporate whistleblower protections (Part 9.4AAA Corporations Act)?
- No. Across every industry and every size band, the engine's answer for a sole trader is: no.
- Do businesses with 1–5 employees need to comply with corporate whistleblower protections (Part 9.4AAA Corporations Act)?
- Depends on size or structure (1–5 employees, turnover $100K–$1M).
- When is "Comply with corporate whistleblower protections (Part 9.4AAA Corporations Act)" due?
- Whistleblower policy in place; ongoing protection.
Related
Sources
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.