Whistleblower Reform Is an Executive Duty, Not a Compliance Exercise
Your whistleblowing hotline is answering a phone most of your employees will never use.
Close to a third of all fraud tips arrive instead as a quiet word with a line manager, in a corridor, off the record. Under the draft Protected Disclosures Bill, 2026, that quiet word can start a legal clock your organisation cannot see, and the clock runs out in five days.
The deadline is the smallest of the new risks. The Bill makes it a criminal offence to unlawfully reveal a discloser’s identity, punishable by up to ten years, and to subject a discloser to occupational detriment, punishable by up to fifteen. Under the Act currently in force, penalising a whistleblower carries no criminal consequence at all.
That tells you what kind of legislation this is. It moves whistleblower handling out of the human resources file and into the criminal law, with prescribed deadlines, a state held record of every disclosure, and liability attached to individuals.
What the Bill actually does
The Minister of Justice and Constitutional Development, Mmamoloko Kubayi, gazetted the Bill on 9 April 2026 after Cabinet approved its release for comment. It arises from the Zondo Commission recommendations and the National Anti-Corruption Advisory Council report of August 2025.
It is not an amendment. It repeals and replaces the Protected Disclosures Act 26 of 2000 in full, which means every internal whistleblowing policy drafted against that Act is written against a statute being retired.
Public comment closed on 14 May 2026. The Department declined to extend it, with the Minister saying a further extension would not be in the interest of whistleblowers or the justice system, and that the public would have another opportunity once Parliament opens its own process. Government will refine the Bill before tabling it. It remains a draft, and nothing described here is yet an obligation.
It has stayed in that state through the fifth anniversary of Babita Deokaran’s murder on 23 August.
The gap between a hotline and an investigative asset
Picture the arrangement many organisations have. An outsourced tip-off line on a poster in the staff canteen. Reports forwarded to a compliance manager or the head of internal audit. A summary tabled at the next audit committee meeting, which may be six weeks away. No named designated officer, no documented turnaround commitment, and confidentiality treated as a professional courtesy rather than a legal duty.
Now test that against the draft Bill.
Five days from receipt to conduct a preliminary investigation and determine whether the disclosure is protected. Written acknowledgement to the discloser falls in the same five day window. The current Act allows 21 days simply to acknowledge receipt. A quarterly reporting cycle cannot meet five days, and neither can a channel monitored by one person who takes leave.
There is a drafting wrinkle worth watching. Section 14 ties the five day written acknowledgement to disclosures made to authorised persons other than the discloser’s own employer, while the five day preliminary investigation carries no such limit. Until Parliament settles that, plan for both.
Ten days to decide whether to investigate further or refer the matter elsewhere, with written notice to the discloser. That requires somebody with delegated authority to make the call, not a committee that meets monthly.
Compulsory referral to the South African Police Service where the designated officer reasonably believes the matter involves a criminal offence or an imminent risk to life, health, safety or the environment. Somebody must be competent to recognise when that threshold is crossed, and the decision must be recorded.
Anonymity that survives contact with reality. A disclosure identifying a specific transaction inside a team of six is not anonymous because the reporting form omitted a name. Genuine anonymity is a design question, not a checkbox on a portal.
Confidentiality that is criminal and personal. The offence of unlawfully revealing a discloser’s identity attaches to the authorised person who handles the report, which means an individual as readily as the organisation. The Bill permits sharing with colleagues who are competent to deal with the disclosure. It reaches the manager who wants to handle the matter properly and mentions where it came from to a trusted colleague who is not one of them. A policy document is not training, and under the Bill that distinction carries a sentence.
The numbers behind all of this are not marginal. In the Association of Certified Fraud Examiners’ Occupational Fraud 2026: A Report to the Nations, drawn from 2,402 cases across 143 countries, web-based reporting at 46 percent and email at 34 percent both overtook the telephone hotline at 23 percent for the first time in the study’s thirty year history. In 2016, telephone hotlines accounted for 40 percent of formal reports.
The same report found that 32 percent of tips went directly to a supervisor rather than through any formal channel. That is close to one disclosure in three arriving at a desk with no case number, no acknowledgement letter, and no record anywhere that the five day period has started to run.
Evidence, not complaints
This is where forensic practice and compliance practice diverge. A disclosure mishandled at intake is frequently unusable afterwards. If the record does not capture who received the report, when, in what form, and what was done with it, you lose the ability to rely on it in a disciplinary hearing, a civil recovery, or a criminal referral. The allegation may be entirely correct and still fail, because the chain that would prove it was never built.
Poor intake also warns the subject. Documents move and devices are wiped. By the time a formal investigation begins, the evidence that existed on the day the report was made no longer does. A concern raised in a corridor and set aside leaves no audit trail at all, which is exactly what collapses under scrutiny.
The organisations that get this right treat the reporting channel as the first link in a chain of custody rather than a complaints inbox. The ACFE data shows what that is worth. Organisations with a formal reporting mechanism recorded a median fraud loss of USD 100,000 against USD 150,000 without one, and a median duration of 11 months against 17.
The disclosure becomes a state record
One provision has attracted less attention than the rest, and it is the database.
The Bill requires the Director-General of the Department of Justice to develop and maintain a central electronic database of disclosures. Authorised persons must upload prescribed information about each disclosure received, including its date, its status, and any referrals made. No personal information about the discloser may be uploaded.
Read that as an operational fact rather than an administrative one. The database is not public, and access is restricted to registered authorised persons. What changes is that the record leaves your control. Once a disclosure is logged, you lose the option of managing the matter entirely internally and quietly closing it, and the Director-General must carry the numbers into the Department’s annual report.
The Bill pairs this with a complaints mechanism overseen by a retired judge, designated by the President in consultation with the Chief Justice, with power to request information and to enter premises. A discloser can go to that judge on three grounds: a reasonable belief that they face retaliation, that their identity is about to be revealed, or that their protection has been revoked. Your handling of the matter becomes reviewable by somebody outside your organisation.
The part that is not about paperwork
The draft expands occupational detriment to include emotional and psychological trauma, and extends protection to related persons, meaning family members, household members, close associates, colleagues, and anyone who helped make the disclosure. The Bill’s protections would reach people who do not work for you.
The reason that provision exists is a matter of public record.
Babita Deokaran, a senior finance official in the Gauteng Department of Health, flagged approximately R850 million in suspicious payments to Tembisa Hospital service providers about three weeks before she was shot outside her Johannesburg home on the morning of 23 August 2021. She was 53. In August 2023, six men were convicted of her murder under a plea and sentence agreement and sentenced to between six and 22 years. Whoever ordered the killing has not been brought to justice.
Marius van der Merwe, a former Ekurhuleni Metropolitan Police Department officer, testified before the Madlanga Commission as Witness D on 14 November 2025. He was shot outside his Brakpan home on 5 December 2025, in front of his family. In March 2026, a specialised task team arrested a suspect believed to be the gunman, who has appeared in court and has not been convicted. Police said they were still pursuing the person who ordered the killing.
What the critics say
Civil society has been direct about the draft’s limits. A coalition led by Corruption Watch argues that it does not match the lived reality whistleblowers face, lacks emergency financial aid and immediate support timelines, and lacks a framework for suspending accused individuals while an investigation runs. It wants an independent Whistleblower Regulatory Authority accountable to Parliament rather than the Executive.
OUTA welcomed the Bill as an acknowledgement that the current framework has failed, while arguing that Parliament must strengthen it because the imbalance of power between an employer and a whistleblower survives any statute. The Public Servants Association supported the Bill but objected to public servants being excluded from the proposed financial award, which allows a court to grant a discloser up to a quarter of a monetary sanction imposed on a convicted employer.
Employers’ advisers have raised the opposite concern. The Bill shifts the onus in retaliation disputes, so that once a discloser shows they made a protected disclosure and suffered a detriment linked to it, the employer must prove the action it took was not connected to the disclosure. Attorneys advising employers have warned this will be hard to answer where a disclosure is used to delay a disciplinary process. The Bill addresses that in part by removing the good faith test and replacing it with defined exclusions, so protection falls away where a disclosure is knowingly false, made for private gain, or made solely or substantially to avoid dismissal.
Those arguments will be settled in Parliament. They change nothing about what sits in front of your board. Whatever version of this Bill is eventually passed, the question it puts to you is already answerable today.
If a disclosure arrived at your organisation this morning naming a member of your executive, who would receive it, would that person know they had five days, and could you name them today?