Foez Dewan
Principal
ASIC released its final Regulatory Guide 270 on Whistleblower Policies this week. In doing so, it noted the concerns raised by some that there was now insufficient time to implement a compliant policy by the 1 January 2020 deadline, but confirmed that the deadline must be met.
ASIC released its draft Regulatory Guide on Whistleblower Policies in August 20191. It received a range of submissions in response and has had regard to those in concluding the final Regulatory Guide released this week.
The final Guide is now considerably clearer than the draft released in August; but it is also more prescriptive. ASIC made these changes in response to submissions that the draft Guide did not make clear enough which elements were mandatory and which were included as good practice only (ie. which it is not mandatory to follow). That has now been clarified; however, at a cost.
While some of the changes made to the final Guide are structural, the document now contains a more liberal use of “must” and “should”, instead of “may” and “could”. While most of these mandatory elements of the Guide are largely unchanged from the draft, some are detailed and specific. Picking out just a few examples, the Guide now expressly requires the Whistleblower Policy to include the following:
The wording of Whistleblower Policies will need to closely align with these requirements if they are to be compliant. As a result, even entities that already have a revised Whistleblower Policies in place may now need to revisit them in order to meet the requirements of the Regulatory Guide.
ASIC rejected submissions that companies should not need to publish their Whistleblower Policy on their external website. It is now quite clear that that needs to be done. The one concession that ASIC has made is to allow the company to post a version of the policy which removes irrelevant and unsuitable information, for instance regarding contact details of internal employees.
ASIC confirmed that public and large proprietary companies, which need a Whistleblower Policy under section 1317AI of the Corporations Act, must have their Policy in place by the 1 January 2020 deadline. In support of that position, it noted that companies have been aware of the obligation since February 2019 and have since had guidance from ASIC. While it did indicate a modicum of flexibility by noting that it anticipates companies “will need to review and refine their whistleblower policy over time”, that of course will not excuse the absence of a policy altogether.
ASIC has included a new section in the Regulatory Guide to remind companies that a failure to have a compliant Whistleblower Policy in place by 1 January 2020 is an offence. It states that it will be “periodically” conducting surveillance activities to ensure compliance and that it will “pursue non-compliance in accordance with our enforcement approach and operational priorities”. Given the requirement to post policies on external websites, that surveillance will be relatively straight-forward.
Having regard to these points, we recommend that companies subject to these requirements give priority to making sure they have a compliant Whistleblower Policy in place, and on their internal and external websites, before the end of the year.
A link to ASIC’s Regulatory Guide can be found here:
https://asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-270-whistleblower-policies/
1 Refer here for our article on the draft Guide:
http://mccabes.com.au/asic-sets-expectations-whistleblower-policies/