Parliament Fixed The Whistleblower Act's Biggest Flaw In 2025. The Fix Still Isn't In Force.

Here is the number that tells you most of what you need to know about whistleblower protection in Malaysia.

In November 2021, the then law minister told Parliament that 73,545 complaints had been received under the Whistleblower Protection Act 2010 since 2011 — and only 527 of those complainants received protection under the Act.

That is roughly 0.7%.

The single biggest reason was a proviso in s.6 of the Act: protection did not apply where the disclosure was specifically prohibited by any written law. Since the Official Secrets Act 1972 prohibits disclosure of a great deal of government material, and s.203A of the Penal Code criminalises certain disclosures, the exact documents that would prove serious wrongdoing were often the documents that disqualified you from protection for disclosing them.

Parliament removed that proviso in 2025. The Whistleblower Protection (Amendment) Bill 2025 passed the Dewan Rakyat on 22 July 2025 and the Dewan Negara on 10 September 2025.

And as far as we can establish, it still has not come into force.

On 16 December 2025, Transparency International Malaysia stated plainly that the amendments "were already passed this year but have yet to come into force", and urged the government to expedite commencement, warning that delayed enforcement "leaves whistleblowers exposed in the interim". We could not locate any subsequent commencement notification.

So if you are thinking about blowing the whistle today, you need to assume the old law applies.

1. What the WPA 2010 actually gives you

Three protections, and it is worth being precise about each:

The critical limit, stated plainly: protection attaches to the disclosure, not to your underlying conduct. If you took part in the wrongdoing, disclosing it does not immunise you for the wrongdoing itself, and under s.11(1)(a) your protection can be revoked where you participated in the improper conduct disclosed.

2. You must disclose to an enforcement agency

This is the design feature that generates most of the criticism.

Protection under the WPA arises when a disclosure of improper conduct is made to an enforcement agency. Practitioner guidance is explicit that these protections only apply when disclosures are made to enforcement agencies and do not extend to internal company disclosures.

Consequences:

• Telling your employer first does not protect you. Many people assume internal escalation is the responsible first step. Under the WPA, it is unprotected.
• Going to the media does not protect you. Not even where the enforcement agency has done nothing.
• Telling an MP, an NGO or a lawyer does not, of itself, attract WPA protection.

The criticism of this design is that where the wrongdoing implicates the enforcement agency itself, or where an agency simply declines to act, the whistleblower has no protected alternative channel. Commentary has argued for restricted disclosure channels to be widened, and for a specialised Whistleblower Tribunal or Ombudsman to provide a confidential, accessible and independent review — so that whistleblowers are not left unprotected by a flawed or biased agency decision.

Malaysia still lacks a centralised whistleblower protection agency.

3. What the 2025 amendments change

The s.6 change is the significant one. C4 Center described it as dismantling the barrier such that whistleblowers can disclose even classified material so long as they reasonably believe wrongdoing has occurred. TI-Malaysia welcomed it on the basis that the WPA would grant immunity from the prohibiting law.

The s.11 change is more contested. TI-Malaysia's assessment was that adding "wilfully" falls short: it protects only those who "unknowingly" or "unwillingly" participated, leaving unresolved the position of whistleblowers who were in some way involved in the conduct they expose — which is very often how people come to know about it. TI-M president Dr Muhammad Mohan characterised it as leaving the position "almost back to square one" on that issue.

Other gaps commentators identify: lack of discretionary powers for enforcement agencies, restricted disclosure channels, absence of physical protection, and missing support services.

4. Commencement: the thing you must check

The Bill's own commencement clause reads that the Act "comes into operation on a date to be appointed by the Minister by notification in the Gazette", and that the Minister may appoint different dates for different provisions.

That matters in two ways. First, passage through Parliament is not commencement. Second, even after commencement, some provisions may be in force while others are not.

Where things stood at our last verification:

• Passed Dewan Rakyat 22 July 2025
• Passed Dewan Negara 10 September 2025
• TI-Malaysia, 16 December 2025: amendments "have yet to come into force"
• A June 2026 practice guide described the amendments as strengthening protection "once it comes into force" — future tense
• In December 2025 the Prime Minister announced that further amendments to the WPA would be tabled in Parliament the following year, aimed at preventing abuse by individuals seeking to misuse whistleblower protections to evade accountability

We have not been able to confirm a commencement date. Check the Federal Gazette or lom.agc.gov.my before relying on the amendments — and note the possibility of partial commencement.

A note on the further amendments. TI-M's response was to welcome the aim of preventing abuse while stressing that reform must strengthen and not dilute protection for genuine whistleblowers, warning that reforms focused too narrowly on exclusion risk deterring good-faith reporting. It also pointed to Malaysia's obligations under Article 33 of the UN Convention against Corruption, which requires protection against unjustified treatment for those who report corruption in good faith and on reasonable grounds, and UNCAC Resolution 10/8, which calls for a reasonable-belief standard and for confidentiality rules not to be misused to conceal corruption or penalise reporting persons.

5. Where a whistleblower actually discloses

MACC (SPRM) for corruption and abuse of power — 1-800-88-6000, or sprm.gov.my. MACC operates a rewards mechanism for informants in certain circumstances; ask about it rather than assuming.

PDRM for criminal conduct generally.

Sector regulators where the misconduct falls within their remit — Bank Negara for financial institutions, the Securities Commission for capital markets, MCMC for communications, KPDN for trade, and so on.

Note s.65 of the MACC Act 2009 separately protects the confidentiality of informers in corruption matters, and operates alongside the WPA. If your matter is a corruption matter, both regimes are potentially relevant.

6. Before you blow the whistle — a checklist

Take this seriously. The Malaysian statistics say the protection is difficult to obtain.

Understand your position first:

• ☐ Is this improper conduct within the meaning of the Act, or a grievance? The Act is not a general employment dispute mechanism.
• ☐ Did you participate in the conduct in any way? If so, take legal advice before disclosing — s.11(1)(a) revocation is the single most likely reason your protection fails.
• ☐ Is the material covered by the OSA or another prohibiting law? If the 2025 amendment is not yet in force, the old s.6 proviso still applies.
• ☐ Have you checked whether the amendments have commenced?

Get advice before you act:

• ☐ See a lawyer before making the disclosure, not after. This is the most important item on this list. Bar Council Legal Aid Centres: malaysianbar.org.my.
• ☐ Consider approaching an organisation like C4 Center or TI-Malaysia for guidance on process — they are not a substitute for legal advice but they know the terrain.

Prepare:

• ☐ Identify the correct enforcement agency. Disclosure to the wrong body may not attract protection.
• ☐ Do not disclose to the media, to colleagues, or on social media first. That is unprotected and can compromise both your position and any investigation.
• ☐ Document what you know: dates, names, documents, amounts. But be careful about how you obtain documents — taking material you are not authorised to access can create separate liability that the WPA does not cover.
• ☐ Keep your own secure copy of what you disclose and when, and get an acknowledgement of receipt.
• ☐ Think about your employment position. Detrimental action protection exists but it is a remedy after the fact, not a shield that prevents anything happening.
• ☐ Think about your family and your finances. There is no statutory support service and no physical protection scheme under the WPA.

Be realistic: 527 out of 73,545 is the historical record. The 2025 amendments should improve it materially — once they are in force.

7. Where this is genuinely uncertain

Commencement. We could not confirm whether the 2025 amendments are in force. Sources through mid-2026 continue to describe them in future or conditional terms. This is the central uncertainty in this article and it is decisive for anyone acting now.

The scope of the s.6 change in practice. Removing the proviso is significant, but how enforcement agencies and courts apply it to genuinely classified material has not been tested.

Whether the further announced amendments will strengthen or narrow protection is contested. The stated aim is preventing abuse; civil society's concern is dilution. Both positions are argued in good faith and this article does not pick between them.