Everything Changing on 31 March 2026 for Pubs & Clubs
Australia’s biggest AML/CTF overhaul in 20 years takes effect on 31 March. Here’s every change that affects your venue — in plain English.
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 is the most significant reform since the original Act in 2006. New rules, new thresholds, new obligations. If your venue has gaming machines, every section of this guide applies to you.
AUSTRAC CEO Brendan Thomas has been clear: “Preparation is expected, perfection is not — but where risks remain unmanaged, regulatory action will follow.”
Here’s what you need to know.
1. The $5,000 ID Threshold
What changed
The customer due diligence (CDD) threshold for gambling service providers drops from $10,000 to $5,000. This is now a statutory requirement in the Act itself, not just a rule.
What it means: Any cash payout of $5,000 or more requires you to verify the patron’s identity before payment. No ID = no payout = breach.
Practical fix: Set your cash payout limit to $4,999.95. Over-limit payouts go via EFT or cheque.
2. Sight and Record — Stop Copying IDs
What changed
The Act no longer authorises copying or retaining copies of identification documents. The combined effect of sections 112–113 and updated OAIC privacy guidance means venues must adopt a “sight and record” approach.
What it means: Sight the original document, record the details (name, DOB, address, document type, number, expiry), record your verification steps and outcome. Do not photocopy, scan, or photograph the document.
Existing copies: ID copies made before 31 March 2026 remain valid records and must be kept for 7 years. New copies should not be made from this date.
3. Your AML/CTF Program — Complete Overhaul
What changed
The old Part A (general) / Part B (customer identification) program structure is eliminated. You now need a single, unified AML/CTF program that links your specific business risks directly to your controls.
Your new program must cover:
- Enterprise-wide risk management practices
- Customer due diligence protocols (initial and ongoing)
- Suspicious matter identification and reporting procedures
- Policies addressing new technologies
- Risk assessment triggers and review schedule
AUSTRAC is moving from prescriptive “tick the box” compliance to an outcomes-focused, risk-based approach. Your program should reflect your venue’s actual risks, not just copy a template.
4. Risk Assessments — Now Cover Three Risks
What changed
Risk assessments previously covered money laundering (ML) and terrorism financing (TF). From 31 March, you must also assess proliferation financing (PF) risk — the financing of weapons of mass destruction.
Your risk assessment must now evaluate:
- Money laundering (ML) — the risk you already assess
- Terrorism financing (TF) — the risk you already assess
- Proliferation financing (PF) — new requirement
If your PF risk exposure is low, existing controls may adequately address it without separate counter-proliferation procedures. But you must document the assessment.
5. Compliance Officer — Must Be “Fit and Proper”
What changed
Appointing an AML/CTF compliance officer is now an explicit statutory requirement with defined criteria. The officer must be “fit and proper” and you must notify AUSTRAC of the appointment.
Fit and proper criteria:
- Integrity and character — no serious criminal history
- Demonstrated competence appropriate to your venue’s complexity
- No bankruptcy or personal insolvency
- No material conflicts of interest
Key deadlines:
The compliance officer must report to your governing body at least once every 12 months. AUSTRAC expects periodic reassessment that the officer remains fit and proper.
6. Initial and Ongoing CDD — New Framework
What changed
Customer due diligence is now formally split into initial CDD and ongoing CDD, with risk-tiered requirements.
Initial CDD (before providing the service):
- Identify the customer
- Verify their identity
- Risk-rate them
- Screen for PEPs and sanctions
Ongoing CDD (during the relationship):
- Continuous monitoring appropriate to the customer’s risk level
- Must be fully implemented by 31 March 2026 — no transition period
Risk tiers:
Patrons verified under the old rules before 31 March 2026 don’t need to be re-verified. However, you must screen them for significant changes that could increase their risk level.
7. Sanctions Screening — Enhanced
What changed
New Rule 5-3 requires you to develop policies ensuring your services don’t contravene targeted financial sanctions under the Autonomous Sanctions Act 2011 and Charter of the United Nations Act 1945.
You must screen customers, beneficial owners, beneficiaries, and agents against sanctions lists. The scope has expanded from “money, property or virtual assets” to cover “any assets.”
8. Employee Due Diligence — New Explicit Requirement
What changed
There’s now an explicit requirement for personnel due diligence. You must assess the skills, knowledge, expertise, and integrity of staff who perform AML/CTF functions.
Staff in high-risk roles must receive increased due diligence checks and additional AML/CTF training compared to lower-risk roles.
9. Board & Governance Obligations
What changed
Your governing body (board, committee, or equivalent) must now oversee the AML/CTF program and take “reasonable steps” to ensure effective risk identification and mitigation.
A new Senior Manager role must be appointed to oversee high-risk relationship approvals and operational implementation.
This is a dynamic standard, not a static checklist. The board doesn’t need to approve every change, but it must demonstrate active oversight.
10. Reporting — Transitional Arrangements
What changed
SMR and TTR reporting obligations are substantively unchanged, but reports must now include more detailed personal, transactional, and contextual data.
The good news: you can continue using current SMR and TTR forms until 30 March 2029. Full transition to new forms required by that date.
The Full Timeline
What Are the Penalties?
AUSTRAC’s enforcement toolkit now includes:
- Civil penalty orders — up to $33 million per contravention
- Remedial directions — can restrict or shut down gaming operations
- Enforceable undertakings — legally binding remediation agreements
- Infringement notices — for minor breaches
- Criminal sanctions — up to 10 years imprisonment
Your 10-Point Action Plan
- Set your cash payout limit to $4,999.95 to stay under the new CDD threshold
- Update your AML/CTF program — merge Part A and Part B into a single, risk-based program
- Add proliferation financing to your risk assessment (even if it’s a low-risk finding)
- Appoint a fit and proper compliance officer and notify AUSTRAC by 30 May 2026
- Stop copying IDs — switch to sight and record immediately
- Implement ongoing CDD — no transition period for this one
- Review your sanctions screening process against the new Rule 5-3 requirements
- Assess your staff — identify high-risk roles and ensure appropriate training and due diligence
- Brief your board — governance oversight is now a statutory obligation
- Train your team — staff need to understand the new $5,000 threshold, sight-and-record, and when to escalate
References
- Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) — Parliament of Australia
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 — austrac.gov.au
- AUSTRAC, Summary of Changes for Current Reporting Entities — austrac.gov.au
- AUSTRAC, AML/CTF Compliance Officer (Reform) — austrac.gov.au
- AUSTRAC, Regulatory Expectations and Priorities 2025–26 — austrac.gov.au
- Home Affairs, Changes to AML/CTF Program Requirements — homeaffairs.gov.au
- Norton Rose Fulbright, Australia’s AML/CTF Reforms: A New Era — nortonrosefulbright.com
- OAIC, Privacy Guidance for Reporting Entities under the AML/CTF Act — oaic.gov.au
Don’t navigate these changes alone
ComplyIQ is built specifically for Australian pubs and clubs. We handle CDD, risk assessment, sanctions screening, SMR reporting, staff training, and audit trails — all in one platform.