AML/CTF Program Requirements — What AUSTRAC Actually Expects

The Program Is Not Optional

Every reporting entity in Australia must have a written AML/CTF program. For pubs and clubs with gaming machines, this is not a best-practice guideline or an industry expectation. It is a specific legal requirement under Part 7 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

If your venue does not have a written program, you are already non-compliant — before you even consider the individual obligations the program is meant to address. AUSTRAC has penalised entities for having outdated programs, generic programs, and programs that exist only on paper. The program has to be real, tailored, and lived.

This post walks through exactly what AUSTRAC expects your AML/CTF program to contain, how it should be structured, and the most common failures we see in programs written before the March 2026 reforms.

Part A: The General Program

Part A is the operational heart of your program. It describes how your venue will identify, mitigate, and manage the money laundering and terrorism financing risks it faces.

AUSTRAC expects Part A to cover seven distinct areas. Missing any one of them is a compliance failure.

1. Your Venue’s ML/TF Risk Assessment

Your program must document a risk assessment that considers the specific money laundering and terrorism financing risks your venue faces. This is not a generic statement that “gaming machines carry ML/TF risk.” AUSTRAC expects a structured analysis of customer risk, service and product risk, geographic risk, and delivery channel risk, all as they apply to your specific venue.

A risk assessment for a 12-machine suburban pub is a different document from a risk assessment for a 400-machine metropolitan club. Both are required. Both must be tailored. Both must be reviewed when circumstances change.

2. Customer Identification Procedures

Your program must describe the procedures your venue uses to identify patrons, verify their identity, and apply enhanced due diligence when required. This section must include your approach to sight-and-record (mandatory from 31 March 2026), the triggers that require identification, and the tiered approach to CDD and ECDD.

3. Ongoing Customer Due Diligence

Identification at a single point in time is not sufficient. Your program must describe how your venue monitors patrons over time, reassesses their risk, and updates their information when new facts emerge. A patron who was low risk when they first received a payout may become medium or high risk based on later behaviour, and your program must describe how this transition is identified and managed.

4. Transaction Monitoring

Your program must describe the systems and procedures you use to monitor transactions for suspicious patterns. AUSTRAC specifically expects coverage of structuring detection — including amount clustering, velocity spikes, and split payouts — under the March 2026 reforms.

5. Suspicious Matter Reporting

Your program must describe the internal process for escalating suspicious matters, the role of the compliance officer, the filing deadlines (24 hours for terrorism-related matters, 3 business days otherwise), and the mechanisms that prevent tipping-off. The tipping-off offence under section 123 of the AML/CTF Act is a criminal offence, and your program must describe how information about SMRs is restricted.

6. Record Keeping

Your program must describe the records you keep, how long you keep them (minimum seven years), how they are secured, and how they are retrieved if AUSTRAC requests them. This includes customer identification records, transaction records, SMR records, risk assessments, training logs, and copies of your program itself.

7. Staff Training and Awareness

Your program must describe how staff are trained, how often refresher training is delivered, what the training covers, and how training is documented. Generic online modules are not sufficient. Training must be tailored to your venue’s specific procedures and risk indicators.

Part B: Employee Due Diligence

Part B is shorter than Part A but no less important. It addresses the internal risks posed by your own staff and how your venue manages them.

Part B is where many venues fall short. A one-page statement that “we check staff references” is not a Part B program. AUSTRAC expects a documented process that reflects the actual risks your venue faces and the controls you have in place to manage them.

What “Tailored to Your Venue” Actually Means

The single most common failing in AML/CTF programs is that they are generic. A template downloaded from an industry body, lightly edited with the venue name, does not meet AUSTRAC’s expectations. AUSTRAC has specifically called out programs that “do not reflect the operations of the reporting entity” as non-compliant.

What Tailoring Looks Like in Practice

A tailored program reflects the specific facts of your venue:

• Your machine count and mix — high-denomination versus low-denomination, linked jackpots, maximum bet limits
• Your typical patron base — member demographics, walk-in rates, regular attendance patterns
• Your geographic location — proximity to transport hubs, cash-intensive businesses, or known risk indicators
• Your operating hours — 24-hour operation versus limited hours affects risk differently
• Your payout procedures — who authorises, what thresholds apply, how cash and EFT payouts are handled
• Your staff model — number of staff, use of contractors, shift patterns, training access
• Your existing controls — CCTV coverage, gaming machine monitoring systems, access controls

A program that describes these facts specifically, and then explains how your venue’s controls address the risks that arise from them, is a tailored program. A program that speaks in generalities about “our venue” and “our patrons” without specifics is not.

The 2026 Updates Your Program Must Reflect

The March 2026 reforms introduced substantive changes that every program written before 31 March 2026 must incorporate. If your program predates the reforms and has not been revised, it is almost certainly non-compliant in at least three ways.

Governance: Approval, Review, and Updates

A program is not a static document. AUSTRAC expects active governance around it.

Senior Manager Approval

Your program must be approved by a senior manager with authority over your venue’s compliance function. In most pubs and clubs, this is the general manager or CEO. The approval must be documented and reflect that the senior manager has read, understood, and endorsed the program.

Regular Review

Your program must be reviewed at least annually, and whenever there is a material change in your venue’s operations, services, or risk environment. A review is not a rubber stamp. It is a structured assessment of whether the program continues to be adequate and effective for your current operations.

Independent Review

Every two to three years, your program must be subjected to an independent review conducted by a person outside your venue’s day-to-day compliance operations. The independent reviewer assesses whether your program is adequate, whether it is being implemented effectively, and whether there are gaps that need to be remediated.

Common Mistakes That AUSTRAC Flags

1. The Program Was Written Once and Never Updated

A program written in 2019 and never revised cannot be compliant in 2026. The legislation has changed, enforcement expectations have shifted, and your venue has almost certainly changed too. A program with no review history is a red flag.

2. The Program Is Generic

Industry templates, downloaded programs, and programs that make no reference to your specific venue, machines, patrons, or procedures will not meet AUSTRAC’s expectations. The document must speak to your venue, not any venue.

3. The Program Exists on Paper but Not in Practice

A well-written program is meaningless if your staff have never seen it, the procedures are not followed, and the records it describes are not kept. AUSTRAC assessments look for evidence of implementation, not just existence.

4. Part B Is Missing or Minimal

Many programs focus exclusively on Part A and treat Part B as an afterthought. A one-paragraph Part B that says “we check references” is not compliant. Part B requires the same rigour as Part A.

5. No Documented Risk Assessment

A program without an underlying risk assessment is a program without a foundation. The risk assessment drives every other element — what triggers ECDD, what patterns to monitor, what training to deliver. Without it, the program is disconnected from reality.

6. No Evidence of Training

A training section that describes a training program but produces no records of actual training delivered is a failure. AUSTRAC will ask for training logs, attendance records, and evidence that staff were trained before being involved in designated services.

7. The Compliance Officer Is Not Identified

Under the 2026 reforms, your program must identify the compliance officer, describe the appointment process, and document the authority and resources available to the role. A program that does not name a compliance officer and describe their responsibilities is non-compliant.

Program, Not Checklist

The final mindset shift — and the most important one — is that AML/CTF is a program, not a checklist. A program is a system of interrelated procedures, controls, and governance. A checklist is a list of one-off tasks that can be ticked off.

Checklists fail because they do not account for the dynamic nature of AML/CTF compliance. A patron’s risk changes. A staff member’s role changes. Legislation changes. Your operations change. A checklist written a year ago does not reflect any of these changes. A program, properly governed and regularly reviewed, does.

Where to Start

If your program is outdated, generic, or missing entirely, start by commissioning a tailored program that reflects the March 2026 reforms. This is not a document you should write yourself from a template. The quality of the program directly affects your venue’s compliance risk, and a poorly written program can create more exposure than having none at all.

Once the program is in place, layer on the operational infrastructure: the technology to monitor transactions, the training to equip staff, the procedures to document decisions, and the independent review cycle to keep everything honest.

For a full overview of the compliance framework your program sits within, see our Complete Guide to AML/CTF Compliance for Pubs & Clubs.

Our Partners

ComplyIQ is compliance technology — we automate the day-to-day operation of your AML/CTF program. But the program itself, the training, and the independent review all sit with trusted partners:

• The AML Company — writes and maintains tailored AML/CTF programs for gaming venues. If your program predates the 2026 reforms or was never tailored to your venue, this is where to start.
• RCA Group — conducts independent reviews and delivers venue-specific staff training. Their reviews are onsite and hands-on, which is what AUSTRAC expects from an independent reviewer.