AML Risk Assessment for Gaming Machines — How to Do It Right
The risk assessment is the document the rest of the AML/CTF program is built on. Where it is good, the controls follow logically. Where it is generic, every downstream control is also generic and the program drifts away from the venue’s actual risk. Here is how to write a risk assessment that survives an AUSTRAC review — what to include, what to avoid, and how to keep it current.
The Statutory Basis
Section 84 of the AML/CTF Act and Chapter 8 of the AML/CTF Rules require reporting entities to identify, assess, and manage their ML/TF risk. The risk assessment is the document that satisfies this requirement and feeds the rest of the program. AUSTRAC’s published guidance describes the assessment as “the foundation” of the AML/CTF program — not a chapter of it.
For pubs and clubs, the assessment must cover four risk dimensions: customer types, channels, products and services, and jurisdictions. Each is examined for ML/TF risk and the combined picture drives the program’s controls.
The Four Risk Dimensions for a Gaming Venue
1. Customer (patron) risk
Who plays at the venue? What are the typical patron profiles — locals, tourists, regulars, casuals, members? What proportion are PEPs? What proportion are likely to fall into ECDD-trigger categories? Are there known patrons from higher-risk industries or with higher-risk backgrounds? The customer dimension shapes identification thresholds and ECDD triggers.
2. Channel risk
How does the patron interact with the designated service? In a pub or club this is almost always face-to-face at the gaming machine and at the payout window. Channel risk is comparatively low compared to remote or non-face-to-face channels — but it is not zero. Cash-handling and patron anonymity at small payouts are channel risks specific to the gaming-room context.
3. Product and service risk
Gaming machine payouts have specific risk characteristics. Cash-out at high frequency, the appearance of converting “dirty” cash to “clean” winnings, the practical $5,000 cap that creates incentive for structuring patterns, the irrelevance of TTR thresholds for most pubs given the cap. Each of these is a product-level risk driver that the assessment names.
4. Jurisdiction risk
The geographic reach of the venue’s customer base and the geographic risk of the venue’s location. A border venue in NSW may attract interstate or international patrons; a remote regional venue has different patron flows; a CBD venue near transport hubs has different jurisdiction exposure than a suburban club.
What a Good Risk Assessment Actually Says
A defensible risk assessment is venue-specific, evidence-backed, and operationally useful. Specifically:
- It names the venue. A risk assessment that does not include the venue’s name and operating profile is generic.
- It quantifies where it can. Number of EGMs, average and peak daily payouts, patron count, member-vs-non-member proportions, opening hours.
- It identifies the venue’s specific risk drivers. Cash-only payment patterns, proximity to vulnerable populations, history of incidents, banked-customer concentration.
- It documents the patron-risk distribution. Roughly what proportion of patrons fall into LOW, MEDIUM, HIGH risk tiers based on the venue’s actual experience.
- It links to controls. Each identified risk has a corresponding control documented in Part A of the program.
- It is dated. Last review date, next scheduled review, named reviewer.
- It captures change drivers. What would prompt a review (legislation change, ownership change, expansion, incident).
Common Risk-Assessment Failings
Generic risk descriptions
“Patrons may attempt to launder money through gaming machines” is not a risk assessment. It is the same sentence in every venue’s program. The assessment must say what the venue’s specific risk profile is.
Unquantified statements
“The venue has a small number of high-risk patrons” without numbers cannot be operationalised. How many? What does that mean for the program’s resourcing? The number changes the answer.
Risks identified but not controlled
The assessment lists structuring as a risk; the program does not include real-time structuring detection. The assessment lists PEPs; the program does not include automated PEP screening. The assessment becomes a list of acknowledged risks with no operational answer.
No review history
The risk assessment is dated 2022 and has not been touched since. The post-March 2026 reforms changed the regulatory landscape; the venue’s risk picture changed; the document did not. AUSTRAC reads the date.
Risk tiers that do not match
The assessment categorises patrons into LOW / MEDIUM / HIGH but the program’s controls treat all patrons identically. The tiers exist on paper; they do not change behaviour. AUSTRAC tests whether the documented risk profile matches the operational treatment.
How to Refresh the Assessment
The risk assessment is a living document. Annual minimum review, plus event-driven updates. Specifically:
- Pull the data. Recent payout volumes, patron counts, alert history, SMR history, ECDD case count. The assessment should be evidence-based.
- Re-examine each dimension. Customer, channel, product, jurisdiction. Has anything changed since the last review?
- Update the risk-tier distribution. Does the documented split (LOW/MEDIUM/HIGH proportions) match what the operational data shows?
- Cross-check against controls. For every risk named, is there a control? For every control in the program, is it justified by a named risk?
- Log the review. Date, reviewer, key changes from the prior version, board approval.
For multi-venue groups the assessment operates at both group and venue level. Group-level assessment captures the risks that span the estate (group-wide patron behaviour, multi-venue structuring); venue-level assessments capture the local risk picture that varies between venues.
What Auditors Test
An AUSTRAC compliance assessment, an independent evaluation, or a regulator-ordered external audit will test the risk assessment in three ways:
- Specificity. Is this assessment about this venue, or could it apply anywhere?
- Currency. When was it last reviewed? What changed?
- Coherence with controls. Do the controls in the program correspond to the risks identified in the assessment? If a risk is named without a control, why? If a control exists without a corresponding risk, why?
A risk assessment that fails any of the three is a finding. A risk assessment that passes all three is the foundation auditors expect.
Frequently Asked Questions
How long is a typical risk assessment document?
For a single-venue pub or club, 8 to 20 pages is typical. Multi-venue groups produce longer documents that include both group-level and venue-level sections.
Should the assessment quantify residual risk?
Yes — for each material risk, the assessment should describe the inherent risk, the controls applied, and the residual risk after controls. This is the basis on which the program’s effectiveness is judged.
Who should sign off on the risk assessment?
The compliance officer prepares it; the governing body approves it. The approval must be recorded with the date, the version, and the approver.
What is the minimum review cadence?
Annually. Plus event-driven reviews for material changes (legislation, ownership, venue expansion, incident, regulator engagement).
Can we use an industry template as a starting point?
Yes, but treat it as a starting point only. The customisation work — specifying the venue’s risks, quantifying them, mapping to controls — is the value. A template adopted without customisation is the most common cause of “generic risk assessment” findings.
From Risk Assessment to Operational Reality
ComplyIQ operationalises the risk assessment by making patron risk tier visible at the payout, applying tier-driven controls automatically, and producing the audit trail that demonstrates the program operates as the assessment requires. Built for Australian pubs and clubs.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), section 84 — legislation.gov.au
- AUSTRAC, Identify and assess your risks (Step 2) — austrac.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au