The Complete Guide to AML/CTF Compliance for Pubs & Clubs
Your venue has gaming machines. That makes you a reporting entity under Australian law. Here is everything you need to know about your Anti-Money Laundering and Counter-Terrorism Financing obligations — in plain English.
Table of Contents
What Is AML/CTF Compliance?
AML/CTF stands for Anti-Money Laundering and Counter-Terrorism Financing. It is a set of legal obligations designed to prevent criminals from using legitimate businesses to disguise the proceeds of crime or fund terrorist activities.
In Australia, these obligations come from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), which is administered by AUSTRAC — the Australian Transaction Reports and Analysis Centre. AUSTRAC is both the regulator and Australia’s financial intelligence agency.
When most people think of AML/CTF, they think of banks. But the Act covers any business that provides a designated service — and that includes gaming machine payouts.
If your pub, club, hotel, or RSL has gaming machines, you have the same category of legal obligations as a bank or a casino. The scale is different, but the obligations are real, and AUSTRAC is actively enforcing them.
AML/CTF compliance is not a one-off task. It is an ongoing program of identification, monitoring, reporting, record keeping, and training that must be embedded in your venue’s daily operations. The good news: once you understand the framework, it is manageable. This guide walks through every obligation, step by step.
Why Pubs and Clubs Are Reporting Entities
Under the AML/CTF Act, any business that provides a designated service is classified as a reporting entity. For pubs and clubs, that designated service is paying out gaming machine winnings.
It does not matter how many machines you have. It does not matter how small your venue is. It does not matter that you are a community club and not a commercial casino. If you pay out gaming machine winnings, you are a reporting entity, and every obligation in this guide applies to you.
The Designated Service: Gaming Machine Payouts
Section 6 of the AML/CTF Act defines designated services. For gaming venues, the relevant designated service is the payment of winnings from a gaming machine. This is what triggers your status as a reporting entity and brings you within AUSTRAC’s regulatory jurisdiction.
Note that this applies to all gaming machine payouts, regardless of the amount. A $50 payout is a designated service just as much as a $5,000 payout.
The distinction matters because many venue operators assume AML/CTF is “a casino thing” or “a bank thing.” It is not. AUSTRAC has made it clear — through guidance, compliance assessments, and enforcement actions — that pubs and clubs are firmly within scope.
This also means your venue must be enrolled with AUSTRAC. If you have gaming machines and you are not enrolled, that is itself a compliance failure. Enrolment is free and can be done through austrac.gov.au.
The 6 Core AUSTRAC Obligations
Every reporting entity must meet six core obligations. These are not optional. They are not “best practice.” They are legal requirements, and failure to meet any of them can result in civil penalties, remedial directions, or criminal prosecution.
1. AML/CTF Program (Part A and Part B)
Your venue must have a written AML/CTF program. This is the foundation document that describes how your venue will meet all of its obligations. It has two parts:
Part A — General
Covers your venue’s approach to customer identification and verification, risk assessment and ongoing due diligence, transaction monitoring, suspicious matter reporting, record keeping, staff training and awareness, and oversight and governance.
Part B — Employee Due Diligence
Covers pre-employment screening, ongoing employee due diligence, ensuring staff in relevant roles are fit and proper, and processes for identifying and managing internal risks.
A generic template downloaded from the internet is not sufficient. Your AML/CTF program must reflect your venue’s specific risk profile, size, customer base, payout volumes, and operating environment. AUSTRAC has penalised venues for having programs that are clearly not tailored to their operations.
The program must be approved by a senior manager, reviewed regularly, and updated whenever your operations or risk environment change. Under the March 2026 reforms, your program must also be overseen by a nominated compliance officer.
2. Customer Identification (CDD and ECDD)
CDD stands for Customer Due Diligence — the process of identifying your patrons and verifying their identity. ECDD is Enhanced Customer Due Diligence, which applies when the risk is higher.
In a pub or club context, customer identification is triggered when a patron requests a gaming machine payout that meets certain criteria. These triggers are risk-based, not purely dollar-based.
When Is Identification Required?
- Most venues set a payout threshold (commonly $5,000) above which identification is always required
- Your AML/CTF program may require identification at lower thresholds based on risk
- A patron’s cumulative payout total may trigger identification even if individual payouts are small
- Suspicious behaviour should trigger identification regardless of the payout amount
The key principle: risk drives identification, not just dollar amounts.
Sight and Record (Post March 2026)
From 31 March 2026, venues must adopt a sight-and-record approach to customer identification:
- Sight the patron’s original ID document in person
- Record the minimum necessary details: full name, date of birth, residential address, document type, document number, and expiry date
- Record your verification process — note that you sighted the document, when, and the outcome
- Return the document — do not photocopy, scan, or photograph it
CDD vs ECDD
The level of due diligence depends on the patron’s assessed risk:
LOW Risk = Standard CDD: Sight and record one form of government-issued photo ID. Record the details. Verify the patron’s identity.
MEDIUM Risk = ECDD: Enhanced due diligence. May require additional identity documents, source of funds enquiry, or more detailed risk assessment.
HIGH Risk = ECDD+: Escalation to the compliance officer. Additional scrutiny, possible senior management involvement, ongoing monitoring.
3. Transaction Monitoring
Your venue must actively monitor transactions to identify patterns that may indicate money laundering, terrorism financing, or other criminal activity. Staff observation alone is not enough.
What to Monitor For
Structuring is the practice of deliberately breaking transactions into smaller amounts to avoid detection thresholds. Three common patterns:
- Amount clustering — multiple payouts just below a threshold (e.g., four payouts of $4,900 in one week)
- Velocity spikes — a sudden increase in a patron’s payout frequency or volume
- Split payouts — a patron requesting a single large win be paid out in multiple smaller amounts
Beyond structuring, your monitoring should also look for minimal gameplay with large cash-outs, unusual hours for large payouts, third-party payout collections, and changes in patron behaviour patterns.
A venue processing hundreds of payouts per week cannot rely on staff memory to detect patterns. Automated transaction monitoring flags anomalies that human observation would miss, especially across shifts and over time.
4. Suspicious Matter Reporting (SMRs)
A Suspicious Matter Report (SMR) is a report filed with AUSTRAC when you suspect, or have reasonable grounds to suspect, that a person or transaction may relate to money laundering, terrorism financing, tax evasion, or other serious criminal activity.
Unlike identification triggers, suspicious matter reporting has no minimum amount. A $20 payout can require an SMR if the circumstances are suspicious. Suspicion is the only trigger.
Common Triggers in Pubs and Clubs
- A patron requesting multiple payouts just under the identification threshold
- Bill-stuffing — feeding large amounts of cash into a machine with minimal gameplay, then cashing out
- A patron who is nervous, evasive, or gives inconsistent information when asked for identification
- Third-party collections — someone attempting to collect another person’s payout
- Reluctance or refusal to provide identification when required
- Any transaction or behaviour that just does not feel right
Filing Deadlines
24 hours if the suspicious matter relates to terrorism financing. 3 business days for all other suspicious matters. The clock starts when the suspicion is formed, not when the transaction occurs.
It is a criminal offence to tell the patron — or anyone who might tell the patron — that an SMR has been filed, is being prepared, or is being considered. Penalties include up to 2 years imprisonment. SMR information must be restricted to the compliance officer and venue manager on a strict need-to-know basis.
5. Record Keeping
You must keep records of your AML/CTF activities for 7 years. This is not negotiable, and the records must be retrievable.
What Records to Keep
- Customer identification records — the details you recorded during CDD/ECDD
- Transaction records — payout amounts, dates, patron details, method of payment
- SMR records — copies of all SMRs filed, supporting documentation, decision-making records
- Risk assessments — patron risk ratings and the basis for those ratings
- Training records — who was trained, when, what the training covered
- AML/CTF program — current and all previous versions, along with records of reviews
- Compliance officer appointment — documentation of appointment and qualifications
Records containing personal information must be stored securely, consistent with Australian Privacy Principle 11 (APP 11). Appropriate access controls, encryption for digital records, and secure physical storage for paper records.
6. Staff Training
Every staff member who could encounter a designated service must receive AML/CTF training. This is not a one-off induction item — it is an ongoing obligation.
What Training Must Cover
- Your venue’s specific AML/CTF program and procedures
- How to identify suspicious behaviour and transactions
- The internal escalation process
- The tipping-off offence and why they must never discuss SMRs
- Customer identification procedures (sight and record)
- Record keeping requirements relevant to their role
- Your venue’s risk indicators
Generic online training is not sufficient. AUSTRAC expects training to be tailored to your venue and the specific risks your staff are likely to encounter.
New staff must be trained before they are involved in any AML/CTF-relevant activity. Refresher training should be conducted at least annually. Document everything — training records are one of the first things AUSTRAC will ask for.
Compliance Officer Appointment
Under the March 2026 reforms, every reporting entity must appoint a compliance officer.
What the Role Involves
- Overseeing the venue’s AML/CTF program
- Receiving and assessing suspicious matter escalations from staff
- Filing SMRs with AUSTRAC within required deadlines
- Conducting or coordinating patron risk assessments
- Managing customer identification and enhanced due diligence
- Ensuring staff training is delivered and documented
- Acting as the primary point of contact for AUSTRAC
All existing reporting entities must have a compliance officer appointed by 30 May 2026. The person must be a “fit and proper person” with adequate training, experience, and authority to fulfil the role effectively.
Risk Assessment
Risk assessment is the engine that drives your entire AML/CTF program. It determines which patrons need enhanced due diligence, which transactions are flagged, and where your monitoring resources should be focused.
Your risk assessment must be venue-specific and consider customer risk, service/product risk, geographic risk, and channel risk.
Risk-to-Tier Mapping
LOW Risk = Standard CDD. Normal identification procedures. Standard monitoring.
MEDIUM Risk = ECDD. Enhanced due diligence. Additional identity verification. Source of funds enquiry may be required.
HIGH Risk = ECDD+. Compliance officer escalation. Senior management awareness. Ongoing enhanced monitoring.
Risk is not static. A patron who was low risk six months ago may become medium or high risk based on changes in their behaviour or new information. Your risk assessment process must include regular reviews and the ability to escalate when circumstances change.
Your program should include a process for screening patrons against PEP (Politically Exposed Persons) and sanctions lists, particularly for patrons who reach higher payout thresholds or are assessed as medium or high risk. A 90-day review cycle is common practice.
The March 2026 Reforms
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) received Royal Assent on 10 December 2024. For existing reporting entities like pubs and clubs, the reforms commenced on 31 March 2026.
Key Changes for Pubs and Clubs
- Sight and record — replaces photocopying patron IDs
- Expanded penalties — up to $33 million per contravention for corporations
- Compliance officer requirement — every reporting entity must appoint one by 30 May 2026
- Structuring detection — explicit obligation to detect amount clustering, velocity spikes, and split payouts
- Enhanced reporting — new requirements around SMR quality and timeliness
If your AML/CTF program was written before the reforms commenced, it almost certainly needs to be reviewed and updated. An outdated program is a non-compliant program.
What Happens If You Don’t Comply
AUSTRAC is not a passive regulator. It actively investigates, assesses, and enforces compliance.
Recent Enforcement Actions
- Crown Resorts — $450 million in civil penalties (2023)
- SkyCity Adelaide — $67 million in civil penalties (2024)
- Mounties Group — civil penalty proceedings commenced against this registered club group, demonstrating enforcement is not limited to casinos
Consequences include civil penalties up to $33 million per contravention, remedial directions, enforceable undertakings, criminal sanctions for tipping-off, and public reputational damage.
Independent Reviews
Your AML/CTF program must be independently reviewed to ensure it remains adequate and effective. This must be conducted by a person who is independent of your venue’s day-to-day compliance operations.
What an Independent Review Involves
- Assessment of whether your program is adequate for your risk profile
- Review of whether your program is being effectively implemented
- Testing of your identification, monitoring, and reporting processes
- Evaluation of staff training and records
- A written report with findings and recommendations
Reviews should be conducted at minimum every two to three years, or more frequently if your risk environment has changed significantly.
An independent review is only valuable if you act on its recommendations. Document the findings, create an action plan, and keep records of what you have done to remediate identified gaps.
Frequently Asked Questions
Do pubs need AML compliance?
Yes. If your pub has gaming machines, you are a reporting entity under the AML/CTF Act 2006. This applies regardless of size, location, or the number of machines.
What is a designated service for gaming machines?
The payment of winnings from a gaming machine. Every time your venue pays out a gaming machine win — regardless of the amount — you are providing a designated service.
How often should staff be trained on AML/CTF?
New staff must be trained before processing payouts. All relevant staff should receive refresher training at least annually. Keep records of all training.
What triggers a suspicious matter report?
Suspicion is the only trigger — there is no dollar threshold. You must file an SMR whenever you suspect a person or transaction may relate to money laundering, terrorism financing, or other criminal activity.
Do I need to photocopy patron IDs?
No. From 31 March 2026, venues must adopt the sight-and-record approach. Sight the original document, record the essential details, and return it. Do not photocopy, scan, or photograph.
What is the penalty for not filing an SMR?
Civil penalties of up to $33 million per contravention for corporations. For tipping-off, criminal penalties of up to 2 years imprisonment.
Who needs to be appointed as compliance officer?
A named “fit and proper person” with adequate training, experience, and authority. Deadline: 30 May 2026. Typically the venue manager or a dedicated compliance officer.
What is the difference between CDD and ECDD?
CDD (Customer Due Diligence) is the standard identification process. ECDD (Enhanced Customer Due Diligence) is a more thorough process applied when the risk is higher — requiring additional documents, source of funds enquiry, or compliance officer escalation.
Need an AML/CTF program written?
The AML Company (theamlcompany.com.au) builds tailored AML/CTF programs specifically for pubs and clubs.
Need your program reviewed?
RCA Group (rcagroup.com.au) provides independent reviews of AML/CTF programs and delivers venue-specific staff training.
Need compliance technology?
ComplyIQ brings customer identification, risk assessment, transaction monitoring, suspicious matter reporting, record keeping, and staff training into one platform — purpose-built for pubs and clubs with gaming machines.
For venues that need to manage federal AUSTRAC obligations alongside state gaming regulation in one place, see ComplyIQ’s gaming compliance software for Australian pubs and clubs.
For an overview of how ComplyIQ delivers each AML/CTF capability — transaction monitoring, patron risk profiling, SMR workflow, sanctions and PEP screening, audit trail — see the ComplyIQ solutions overview.
Related Deep-Dives
Topical articles that go deeper on the most-asked questions from pub and club operators about the 2026 AML/CTF regime:
- What Happens on 31 March 2026 — The Complete AML/CTF Guide for Pubs & Clubs
- You Can’t Keep Copies of ID Anymore — Here’s What Changed
- The $5,000 Cash Payout Threshold Is Here — What Your Venue Needs to Know
- Crown $450M, SkyCity $67M, Mounties Next — What AUSTRAC Penalties Mean for Your Venue
- What Is a Suspicious Matter Report? A Plain English Guide for Venue Staff
- Structuring: How to Spot Patrons Splitting Payouts to Avoid Detection
- Do Pubs Need AML Compliance? Yes — Here’s Why
- AML/CTF Compliance in Australia: Practical Answers for Reporting Entities
More AML/CTF Articles
- AML/CTF Program Requirements — What AUSTRAC Actually Expects
- Your AUSTRAC Compliance Checklist — 10 Things Every Venue Manager Should Review Monthly
- Tipping Off — The Criminal Offence Your Staff Might Not Know About
- Why We Partnered with RCA Group — And What It Means for Your Venue
- Your Mate’s Not a Compliance Expert — Why Industry Experience Matters
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) — Parliament of Australia
- AUSTRAC, AML/CTF tips for pubs and clubs with gaming machines — austrac.gov.au
- AUSTRAC, Suspicious matter reports — austrac.gov.au
- AUSTRAC, AML/CTF programs — austrac.gov.au
- AUSTRAC, Record-keeping overview (Reform) — austrac.gov.au
- Privacy Act 1988 (Cth), Australian Privacy Principles 3 and 11 — legislation.gov.au
- OAIC, Privacy guidance for reporting entities under the AML/CTF Act — oaic.gov.au