Whistleblower Protection Policy¶


Code	`GOV-008`
Domain	Governance & Accountability
Owner	General Counsel
Status	Draft
Applicability	Platform
Jurisdiction	NZ + AU
Business domain	BD10
Review date	2027-03-25

Regulations: NZ Protected Disclosures Act · Corporations Act 2001 ¶

Purpose¶

Govern the platform's whistleblower protection programme — its reporting channels, investigation standards, confidentiality obligations, and anti-retaliation measures — in compliance with the NZ Protected Disclosures (Protection of Whistleblowers) Act 2022 and applicable AU provisions of the Corporations Act 2001.

Scope¶

All employees, contractors, and agents of the platform in NZ and AU, and any person who makes a protected disclosure relating to the platform's activities.

Policy statements¶

The platform SHALL maintain a whistleblower programme that provides secure and confidential reporting channels for concerns about misconduct, legal or regulatory breaches, safety issues, financial irregularities, and other improper conduct.

At least one reporting channel SHALL be operated by an independent third party to enable fully anonymous reporting. The channel SHALL be accessible to all staff and contractors at all times, including outside business hours.

All reports received through the whistleblower programme SHALL be triaged within one business day of receipt. Reports SHALL be acknowledged to the reporter (where contact details are provided) within two business days. Investigations SHALL be completed within 60 days for standard reports and 90 days for complex reports, with status updates provided to the reporter at 30-day intervals.

The identity of a whistleblower SHALL be protected to the maximum extent possible consistent with conducting a fair and thorough investigation. The identity SHALL not be disclosed to the subject of a report without the whistleblower's prior consent, except where disclosure is required by law or by a court order.

Retaliation against a whistleblower is prohibited. Any allegation of retaliation SHALL be treated as a separate matter and investigated with the same priority as the underlying disclosure. Where retaliation is substantiated, disciplinary action SHALL be taken up to and including termination of employment or engagement.

The platform SHALL comply with all obligations under the NZ Protected Disclosures (Protection of Whistleblowers) Act 2022, including the obligation to maintain an internal reporting procedure that meets the Act's requirements. For AU operations, the platform SHALL comply with the whistleblower protections in Part 9.4AAA of the Corporations Act 2001.

The Board Audit Committee SHALL receive an annual report on whistleblower programme activity, including report volumes by category, investigation outcomes, average resolution times, and any patterns suggesting systemic issues. The programme SHALL be reviewed every two years by internal audit.

Satisfying modules¶

Module	Name	Mode	Description
MOD-151	Risk case console	`GATE`	Whistleblower submissions are received through an isolated intake channel with no management routing; cases are delivered directly to the Board Audit Committee role and identity protection is enforced at the data layer.

Part of Governance & Accountability · Governance overview Compiled 2026-05-22 from source/entities/policies/GOV-008.yaml