Blowing the Whistle in Malaysia: Are You Really Protected?

What the law requires you to report, what protection you actually get, how whistleblowers lose that protection, and why companies now need their own reporting channels

Why Whistleblowing Is in the Spotlight

Whistleblower protection made headlines in Malaysia in early 2022. As described in the book, the MACC Chief filed a defamation suit seeking about RM10 million against journalist Lalitha Kunaratnam over her online articles alleging that he owned shares worth more than RM100,000 in various companies and had not declared them. The MACC also lodged a police report claiming her allegations were false and unverified. The action drew criticism from many quarters, since she was seen by some as a whistleblower.

Yet under Malaysian law, she was not a protected whistleblower, because her disclosure was made to the public and not to an enforcement agency. This case captures the central question of this article: if you expose wrongdoing in Malaysia, will the law actually protect you?

The answer depends on understanding three separate pieces of law: the duty to report under Section 25 of the MACC Act, the informer protection under Section 65 of the MACC Act, and the wider protection under the Whistleblower Protection Act 2010 (“WPA”).

Part 1: You May Be Legally Required to Report

Many people think whistleblowing is voluntary. For bribery, it often is not. Section 25 of the MACC Act imposes a duty to report on any person, whether an ordinary member of the public approached by an officer or a Member of Parliament offered money to vote a certain way.

If this happens to you	You must report	Penalty for not reporting (as stated in the book)
You are given, promised or offered a bribe	The gift, promise or offer, and the name of the person if known, to the nearest MACC officer or police officer	Up to 10 years’ jail and a fine of up to RM100,000
Someone solicits or obtains a bribe from you, or tries to	The request, with a full and true description and the person’s name if known, to the nearest MACC officer or police officer, at the earliest opportunity	Up to 2 years’ jail and a fine of up to RM10,000, where there is no reasonable excuse

The book explains how this duty has grown. Under the old Prevention of Corruption Act 1961, there was no offence of failing to report a bribe demand. That offence was created by the Anti-Corruption Act 1997. The duty to report a bribe offer used to apply only to Members of Parliament, members of public bodies and public officers, but the MACC Act extended it to everyone. The idea is that people who ask for bribes face a much greater risk of being reported, which should discourage them.

“What if I report and turn out to be wrong?”

Some people worry about being punished for a false report. Section 27 of the MACC Act does make it an offence to give false statements or statements inconsistent with earlier ones. However, the book points out that this offence requires knowledge that the statement is false, misleading or inconsistent. A person who reports in good faith is not caught.

Part 2: What Protection Does the Law Give?

Protection under Section 65 of the MACC Act

Section 65 protects informers. Where an MACC officer makes a complaint based on information received from someone, the information and the identity of the person who gave it must be kept secret. They cannot be disclosed, or ordered to be disclosed, in any civil, criminal or other proceedings, and documents given in evidence can have identifying details concealed.

There is an important catch. This protection is not automatic. It only applies if the MACC officer actually uses your information as the basis for a complaint. If the officer decides not to proceed, your identity is not protected under this section. As the book notes, this depends on a decision entirely outside the informer’s control, which may discourage people from coming forward.

Protection under the Whistleblower Protection Act 2010

The WPA offers wider protection. It was passed to encourage disclosures of improper conduct in both the public and private sectors, to protect those who make them, and to ensure the matters are investigated. The key definitions are:

Term	Meaning under the WPA
Whistleblower	Any person who makes a disclosure of improper conduct to an enforcement agency under Section 6
Improper conduct	Any conduct which, if proved, would be a disciplinary offence or a criminal offence
Enforcement agency	A government ministry, department, agency or body (federal, state or local), or a body set up by law, that has investigation and enforcement functions or powers, including a unit or division of such a body
Basis for disclosure	A reasonable belief that a person has engaged, is engaging or is preparing to engage in improper conduct, provided the disclosure is not specifically prohibited by any written law

Once a proper disclosure is made, protection applies whether or not it leads to disciplinary action or prosecution. The WPA gives three main protections:

Protection	What it covers	Penalty for breaching it
Confidentiality	The identity, occupation, home and work address and whereabouts of the whistleblower and the person implicated, the information disclosed, and any information that could cause detriment to anyone if revealed	Fine up to RM50,000 or up to 10 years’ jail, or both
Immunity	No civil or criminal liability, and no administrative or disciplinary action, claim or demand, for making the disclosure	Not applicable
Protection from detrimental action	Covers the whistleblower and anyone related to or associated with them. Detrimental action includes injury, loss or damage, intimidation or harassment, and interference with employment such as discrimination, dismissal, demotion, suspension, termination, disciplinary action or adverse treatment, as well as threats of any of these	Fine up to RM100,000 or up to 15 years’ jail, or both

The MACC’s own website, as cited in the book, sets out practical conditions for protection when reporting to the MACC. The informant must be willing to be identified by the MACC, must meet MACC officers in person, and, if reporting by letter, email, phone or text, must give their identity and contact details. In other words, anonymous tips do not attract WPA protection.

Part 3: How You Can Lose Protection

Reason 1: You told the wrong people

The book describes this as the key requirement: the disclosure must be made to an enforcement agency and no one else. The Court of Appeal applied this strictly.

Case Spotlight: Rokiah binti Mhd Noor v Menteri Perdagangan Dalam Negeri, Koperasi & Kepenggunaan Malaysia & Ors and another appeal [2016] MLJU 1765 (Court of Appeal)

Facts: Rokiah was the Deputy Chief Executive Officer of the Companies Commission of Malaysia (SSM), and Azryain was Director of its Training Academy. In October 2011, they wrote a joint letter making serious allegations about senior SSM officers. These included claims of a conspiracy to appoint an unqualified person as the next CEO, claims that this person was being investigated by the anti-corruption agency, and claims that the CEO had condoned her conduct and interfered with investigations. The letter went to members of SSM and the Anti-Corruption Commission, but also to the Prime Minister, the Deputy Prime Minister, the Minister of Domestic Trade, Cooperatives and Consumerism, and the Chief Secretary to the Government.

What happened to them: SSM took disciplinary action for bringing it into disrepute. Rokiah’s contract was terminated and her appointment revoked, and Azryain was demoted by one grade. The disciplinary committees noted, among other things, that the allegations were not supported by solid evidence, that the pair had not used the proper internal complaint channels, and that the MACC had investigated the allegations and found no impropriety.

Their argument: The disciplinary action was unlawful retaliation against whistleblowers under Section 10 of the WPA.

Decision: The Court of Appeal dismissed their appeals. The Prime Minister, Deputy Prime Minister, Minister and Chief Secretary were not enforcement agencies. Because the disclosure went to them as well, Rokiah and Azryain did not qualify as whistleblowers under the WPA and could not claim protection. The court reached this conclusion even though it accepted that their allegations fell within the meaning of “improper conduct” and that their dismissal and demotion were “detrimental action”.

Another warning from the court: The court also pointed out that Section 8(1) of the WPA prohibits a whistleblower from disclosing the confidential information while it is being investigated. Doing so can lead to criminal prosecution.

Lesson: Reporting to the right agency is not enough if you also send the same allegations to others. Stick to the proper channel and keep the matter confidential.

Reason 2: One of the statutory exceptions applies

The WPA allows protection to be revoked in the following situations:

Protection may be revoked if…	In plain terms
The whistleblower took part in the improper conduct	You cannot use whistleblowing to shield your own involvement
The whistleblower wilfully made a material statement he knew or believed to be false, or did not believe to be true	Lying or exaggerating in your report
The disclosure is frivolous or vexatious	Reports without real substance or made to annoy
The disclosure mainly questions the merits of government policy, including the policy of a public body	Disagreeing with policy is not whistleblowing
The disclosure is made solely or substantially to avoid dismissal or other disciplinary action	Reporting to protect yourself from your own disciplinary case
The whistleblower commits an offence while making the disclosure or giving further information	For example, unlawfully taking or leaking documents

Is the Law Enforced Against Those Who Retaliate?

Spotlight: The first known charge under the WPA

As described in the book, on 11 December 2020, Wafiy Abd Aziz, former Deputy Chief Executive Officer of Education Malaysia Global Services (EMGS), was charged under Section 10 of the WPA. He was accused of inciting the EMGS chairman to sign a document terminating the employment of a whistleblower who had reported his alleged misconduct to the MACC.

On 20 May 2022, the Sessions Court acquitted him without calling for his defence, finding that the prosecution had not proved a prima facie case. The book notes that the court’s grounds of decision were not publicly available, so it remains unclear what the prosecution must prove to establish unlawful retaliation.

Why it matters: The charge shows that retaliation can lead to criminal prosecution. The acquittal shows how difficult such cases may be to prove.

So, Are You Really Protected? The Gaps

The book concludes that Malaysia’s statutory regime is currently inadequate to encourage whistleblowing, particularly within commercial organisations. It identifies several weaknesses:

Only enforcement agencies count. Groups such as the Center to Combat Corruption and Cronyism (C4) have criticised this restriction. Disclosures to the media, the public, politicians or even your own employer are not protected under the WPA.
What if the agency itself is involved? If an MACC officer asks you for a bribe, you are expected to report it to the MACC, the very institution implicated. Many people would hesitate.
“Frivolous or vexatious” is a judgment call. Whistleblowers may fear losing protection through what could be an arbitrary assessment of their report.
Internal reporting is not recognised. Unlike the European Union’s 2019 directive, which requires organisations with 50 or more workers to set up internal reporting channels, Malaysian law does not treat internal company channels as a legitimate route for protected disclosures.
Protection under Section 65 is not automatic. It depends on the MACC officer choosing to act on your information.
Low uptake. A Minister in the Prime Minister’s Department cited figures showing 73,545 reports to enforcement agencies between 2011 and 2021, but only 527 informants stepped forward. The book suggests this reflects low awareness and limited confidence in the system, and notes that the Government was looking at amending the WPA.

These concerns are not unique to Malaysia. The book cites a 2017 European survey in which 81 per cent of respondents said they had not reported corruption they experienced or witnessed, most often because they feared legal and financial consequences.

Practical Guide for Would-Be Whistleblowers

Do	Don’t
Report to an enforcement agency such as the MACC or the police	Send the same allegations to Ministers, senior politicians, the media or social media
Identify yourself to the agency and provide your contact details if you want WPA protection	Rely on an anonymous tip if you need legal protection
Report bribe offers and demands promptly, as required by Section 25	Simply refuse a bribe and say nothing
Report what you honestly believe, and stick to facts you can support	Exaggerate, guess or include claims you do not believe to be true
Keep the matter confidential while it is investigated	Discuss or circulate the information while the investigation is ongoing
Use your company’s internal channel too, where it is safe to do so	Assume an internal report alone gives you protection under the WPA

Part 4: What Companies Should Do

Because the statutory regime has gaps, the book argues that companies must take on much of the responsibility. This also matters for their own protection. A company facing a Section 17A charge must show it had adequate procedures, and the Government’s Guidelines on Adequate Procedures recommend that companies:

Set up an accessible and confidential reporting channel, which can be used anonymously, for both internal and external parties to raise concerns about real or suspected corruption or weaknesses in the anti-corruption programme.
Set up a secure information management system to protect the whistleblower’s identity and the information reported.
Encourage the use of reporting channels for suspected or real corruption and programme weaknesses.
Encourage people to report suspected, attempted or actual corruption in good faith.
Prohibit retaliation against anyone who reports in good faith.

The book adds suggestions from Transparency International UK, such as having an independent unit manage the reporting channels. This boosts employee confidence and avoids the problem of complaints being handled by the very people they concern.

Follow-up matters as much as the channel

The book uses the EU directive as a model for good follow-up practice. Although it does not apply in Malaysia, it offers a useful benchmark:

Step	EU benchmark
Secure channel	Designed and operated to keep the identity of the reporter and anyone named confidential, and to block access by unauthorised staff
Acknowledgement	Confirm receipt to the reporter within 7 days
Responsible person	Appoint an impartial person or department to follow up, communicate with the reporter and ask for further information
Diligent follow-up	Investigate properly, including anonymous reports
Feedback	Give feedback within a reasonable time, no more than 3 months
External options	Provide clear information on how to report externally to the authorities

Building a speak-up culture

The book also recommends that companies consider four further aspects:

Aspect	What it means
Company culture	Encourage staff to raise concerns early, even with minimal information, and give priority to reviewing reports. Prevention is better than cure.
Awareness	Make sure employees know the channels available and where to get confidential advice on next steps.
Publicity	Report whistleblowing statistics and the actions taken. This deters wrongdoing and shows whistleblowers that their reports make a difference.
External participation	Open the channels to business partners and other outsiders, not just employees.

Small company? Keep it simple

There is no one-size-fits-all approach. The book notes that in GIACC’s case study, a reporting channel for a small company could simply be a dedicated whistleblowing email address. The core elements, which are anonymity, confidentiality and a culture that supports speaking up, are not expensive to put in place.

Company Checklist

Do we have a confidential reporting channel that allows anonymous reports?
Is it open to outsiders such as suppliers, contractors and customers?
Is it managed independently of the people most likely to be the subject of complaints?
Is reported information stored securely, with access limited to authorised staff?
Do we acknowledge reports and give feedback within a set timeframe?
Does our policy expressly prohibit retaliation, and do we act on breaches?
Do staff know about the channel and their duty under Section 25 to report bribe offers and demands?
Do we tell staff how to report externally to the MACC or police?

Conclusion

So, are you really protected? Only if you follow the rules closely. The law requires you to report bribe offers and demands, and it offers meaningful protection under the WPA, but only if you report to an enforcement agency, identify yourself, act in good faith and keep the matter confidential. As the Rokiah case shows, going further, even with the best intentions, can leave you with no protection at all.

Until the whistleblowing laws are reformed, the book argues that companies must fill the gap. An effective internal complaint procedure and a firm policy against retaliation are among the most cost-effective anti-corruption measures a company can adopt, and they form an important part of the adequate procedures defence under Section 17A.

Settling Instead of Being Charged: How Compounding Works for Money Laundering Offences

Picture this. A letter arrives from an enforcement agency stating that you are reasonably suspected of committing an offence under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA). The letter then offers a way out. Pay a stated sum within a fixed number of days,…