Whistleblower Policy (Malaysia)

A Whistleblower Policy in Malaysia documents the organisation's approach and the obligations placed on those it covers.

The Whistleblower Protection Act 2010 (Act 711) provides statutory protections for persons who report improper conduct to an 'enforcement agency' in Malaysia. Under Section 6, a whistleblower who makes a disclosure in good faith to an enforcement agency — such as the MACC, the Royal Malaysia Police (PDRM), the Securities Commission Malaysia, Bank Negara Malaysia, or another designated body — is entitled to immunity from civil and criminal liability arising from the disclosure, and protection against detrimental action by their employer. Detrimental action includes dismissal, demotion, harassment, intimidation, adverse changes to terms of employment, or any other action that causes injury or disadvantage to the whistleblower.

Section 17A(4) of the MACC Act 2009 provides that a commercial organisation may avail itself of the 'adequate procedures' defence against corporate liability for corruption if it has implemented thorough anti-corruption procedures. The MACC's Guidelines on Adequate Procedures (T.R.U.S.T. principles) identify a whistleblowing mechanism as a required component of adequate procedures under the 'Undertaking control measures' principle. A Whistleblower Policy supported by an accessible internal reporting channel — such as a dedicated email, hotline, or online portal — is therefore essential for demonstrating the adequate procedures defence.

For companies listed on Bursa Malaysia, the Malaysian Code on Corporate Governance 2021 (MCCG 2021) Practice 1.9 recommends that the board establish formal and transparent arrangements for maintaining appropriate standards of conduct and ethical behaviour, including a whistleblowing mechanism. The Corporate Governance Guide (4th Edition) published by Bursa Malaysia provides detailed guidance on whistleblower policy best practice for listed companies.

Beyond corporate governance, a Whistleblower Policy supports an organisation's culture of integrity by providing employees with confidence that reports of wrongdoing will be taken seriously, investigated impartially, and protected from retaliation — creating an internal deterrent against misconduct.

The legal framework governing the Whistleblower Policy (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a Whistleblower Policy (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies Act 2016 (Act 777) sets the foundational requirements.

A Whistleblower Policy is required for Malaysian organisations seeking to establish the adequate procedures defence under Section 17A of the MACC Act 2009 and to comply with corporate governance best practice.

A Whistleblower Policy is required for all companies listed on Bursa Malaysia under MCCG 2021 Practice 1.9 and the Bursa Malaysia Corporate Governance Guide, to establish a formal channel for reporting improper conduct to the board's Audit Committee.

A Whistleblower Policy is needed for any commercial organisation that has engaged high-risk associated persons — including agents operating in high-corruption-risk markets, government-interface contractors, or customs brokers — where the risk of facilitation payment demands or bribery is elevated.

A Whistleblower Policy is required for companies that have adopted an Anti-Bribery Policy under Section 17A of the MACC Act 2009, as the MACC's Guidelines on Adequate Procedures identify a reporting mechanism as a necessary component of adequate procedures.

A Whistleblower Policy is needed for companies operating in regulated sectors — including financial services under Bank Negara Malaysia's oversight, capital markets under the Securities Commission, healthcare under the Ministry of Health, and construction under CIDB — where regulatory compliance obligations require an internal reporting mechanism.

A Whistleblower Policy is required for subsidiaries or joint ventures of multinational companies subject to the UK Bribery Act 2010 or US Foreign Corrupt Practices Act 1977, as the parent company's group compliance programme typically mandates a whistleblowing mechanism across all operations.

Parties in Malaysia should prepare a Whistleblower Policy (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A thorough Whistleblower Policy for a Malaysian organisation must include the following essential elements.

Scope and Purpose: A statement of the policy's purpose — to provide a safe and confidential channel for reporting suspected wrongdoing — and its scope, covering all employees, contractors, agents, suppliers, and associated persons of the organisation.

Types of Reportable Conduct: A non-exhaustive list of conduct that may be reported under the policy, including bribery and corruption under the MACC Act 2009, financial fraud, false accounting, money laundering contrary to the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001), breaches of the PDPA 2010, workplace safety violations under the Occupational Safety and Health Act 1994 (OSHA 1994), environmental violations, and breaches of the company's own policies.

Reporting Channels: Multiple accessible reporting channels — including a dedicated email address, a confidential telephone hotline, an online reporting portal, and the option to report directly to the Audit Committee or an independent director — to cater for different preferences and levels of concern about internal reporting.

Anonymity Option: The option for whistleblowers to make anonymous reports, with an acknowledgement that anonymous reports may limit the ability to conduct a full investigation if the investigating team cannot seek clarification from the reporter.

Confidentiality Protections: A commitment that the identity of the whistleblower will be kept strictly confidential and disclosed only to those directly involved in the investigation and only to the extent necessary, consistent with Section 28 of the MACC Act 2009.

Non-Retaliation Commitment: An unequivocal commitment that no person who makes a report in good faith will suffer any retaliation, adverse employment action, or detrimental treatment, consistent with the Whistleblower Protection Act 2010. Retaliation against a whistleblower is itself a disciplinary offence.

Investigation Process: An outline of the process for investigating reported concerns — including acknowledgement of receipt, preliminary assessment, formal investigation by the Internal Audit function or Audit Committee, escalation to external authorities (MACC, PDRM) where appropriate, and feedback to the whistleblower on the outcome.

False Reports: A statement that knowingly false or malicious reports are a disciplinary offence, to deter abuse of the reporting mechanism.

Additional compliance elements for a Whistleblower Policy (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.