AML/CTF Program Template for Gaming Venues — What a Defensible Program Actually Contains
Most pubs and clubs have an AML/CTF program. Most of those programs were built from a generic template, lightly customised, and have not been touched since. AUSTRAC’s published guidance and the post-March 2026 reform package have raised the standard for what a defensible program looks like. Here is the structure a current, defensible program follows — section by section — with what each section must contain.
The Two-Part Structure (Part A and Part B)
The AML/CTF Rules require a written program with two parts:
- Part A — the risk-based framework, controls, governance, oversight, training, and ongoing-customer-due-diligence procedures. This is the high-level program that addresses how the entity manages its ML/TF risk.
- Part B — customer identification procedures specific to the entity’s operations. This is the operational document that staff actually follow when identifying customers.
Both parts must be approved by the governing body (board, owner, partnership) and maintained current. A program that is missing one part or that has not been formally approved fails the basic test before any other content is examined.
Part A — What It Must Contain
1. ML/TF risk assessment
A documented assessment of the money-laundering and terrorism-financing risks the entity faces. Considers customer types, channels (in-person at gaming machines), products and services (gaming machine payouts), and geographic factors. Specific to the venue, not generic. Reviewed at least annually and after material changes.
2. Risk-based AML/CTF framework
The framework that translates risk into controls. Risk-tier definitions (LOW / MEDIUM / HIGH), the criteria that place a patron in each tier, and the controls that flow from each tier (identification depth, ECDD requirements, screening cadence, escalation triggers).
3. Customer identification (cross-reference to Part B)
Part A references the operational identification procedures contained in Part B. The cross-reference is explicit: where Part B is amended, Part A is updated to point to the current version.
4. Ongoing customer due diligence
Re-screening cadences (typically 90 days for PEP, ongoing for sanctions), risk-profile refresh triggers, and the operational mechanism for updating patron risk over time.
5. Transaction monitoring
Detection patterns (structuring — amount clustering, velocity spikes, split payouts; wealth-gap inconsistency; behavioural indicators), the timing of detection (real-time vs batch), the alert disposition workflow, and the escalation path to the compliance officer.
6. Suspicious matter reports
Grounds for suspicion, deadlines (24 hours terrorism financing, 3 business days otherwise), the SMR pipeline from staff observation to AUSTRAC submission, tipping-off controls under section 123, and the file retention process.
7. Threshold transaction reports
The TTR threshold ($10,000 cash), the reporting deadline, and the operational mechanism for capture and submission. For most pubs and clubs the practical $5,000 cash payout cap means TTRs are rare, but the procedure must exist.
8. Compliance reports
Process for compiling and submitting the annual compliance report to AUSTRAC by 31 March each year.
9. Record keeping
What records are kept, where, in what form, and for how long. Seven-year retention is the minimum. Records must be tamper-evident, time-stamped, and produceable to AUSTRAC in a usable format.
10. AML/CTF training
Training delivered to staff who handle the designated service, refresher cadence, training records (content covered, assessment, certification expiry per staff member), and the requirement that new staff complete training before working in the gaming room.
11. Compliance officer
The designated AML/CTF compliance officer by name, role description, authority, time allocation, reporting line, and the alternate where applicable. Sufficient independence to perform the role.
12. Governance
Board (or governing body) approval of the program, frequency of board reporting on AML/CTF matters, independent evaluation cadence, and the mechanism for program update and re-approval.
Part B — What It Must Contain
Part B is the operational identification procedure. It is the document staff actually use. It must include:
Identification thresholds
The dollar threshold at which identification is required (commonly $5,000 cash payout). The risk-based triggers that require identification regardless of amount. The post-March 2026 prohibition on retaining ID copies.
Acceptable identification documents
Australian driver’s licence, passport, proof-of-age card, foreign passport with appropriate corroboration. Document standards (current, not damaged, photo matches). What to do where the patron cannot present a primary document.
Information to capture
Full name, date of birth, address (where required), document type and issuer, expiry, photo verification. The fields that must be captured at sight, with no copy retained.
Procedure where identification fails
The patron cannot or will not provide acceptable ID; the document does not match the patron; the document appears altered. The program must specify the operational response, including non-payment of the threshold-triggering payout and SMR consideration.
ECDD identification
Where ECDD applies (medium- or high-risk patrons), additional identification requirements: source-of-funds enquiry, source-of-wealth enquiry, and the documentation expected to support the response.
Operational practicalities
Where identification happens (cage, dedicated payout window, manager’s office), who can conduct it, how the record is captured (system, not paper), how privacy is preserved, and how tipping-off is avoided where the identification is risk-driven.
Common Template Failings
Generic risk assessment
A risk assessment that could apply to any pub in Australia is not a risk assessment. It is a document. A real risk assessment names the venue’s specific products, customers, and risk drivers and addresses each.
Risk tiers documented but not used
Part A defines LOW / MEDIUM / HIGH tiers. The operational reality treats every patron the same. A program where the tiers exist on paper but do not change behaviour at the payout window is a documented program, not an operational program.
Stale ECDD procedures
ECDD procedures written before the post-March 2026 reforms still reference identification copying or thresholds that have changed. A program that has not been updated since 2023 is showing its age and is no longer current.
Compliance officer named but unsupported
The program names a compliance officer with no time allocation, no authority, and no operational support. A name on a page is not a compliance officer.
Training procedures with no content reference
“Staff will be trained on AML/CTF” is not a training procedure. The procedure must specify what is covered, by whom, how it is assessed, and how completion is recorded.
Frequently Asked Questions
Can we use a template program?
A template is a starting point, not a destination. The template must be customised to the specific venue, with the venue’s risk assessment, the venue’s actual operating model, and the venue’s named compliance officer. A template adopted without customisation is not a venue-specific program and will not survive review.
How long should the program document be?
Long enough to cover the obligations comprehensively, short enough that staff can find what they need. Most defensible programs for a single-venue pub or club run 30 to 60 pages including Part A, Part B, and annexes. Group programs can be longer.
Who should write the program?
An AML/CTF consultant, working with the compliance officer and the board. The consultant brings the technical knowledge of the Act and Rules; the compliance officer brings the operational context of the venue. Programs written without venue input read like generic documents.
How often should the program be reviewed?
Annually at minimum, plus whenever there is a material change — legislation update, ownership change, venue expansion, new risk identified, or post-event review after an incident. The review date and reviewer must be recorded.
Does the program need to be approved by the board?
Yes. The Act requires governing-body approval. For a community club this is the board; for a hotel partnership it is the partners; for a corporate operator it is the relevant approving body. The approval must be minuted.
Operationalise the Program, Not Just Document It
ComplyIQ takes Part A and Part B beyond documentation into operational reality. Risk tiers visible at the payout. Real-time monitoring against the program’s detection patterns. SMR pipeline with section 123 controls. Audit trail produced as a by-product. Built for Australian pubs and clubs.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, AML/CTF programs overview — austrac.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au
- AUSTRAC, Customer identification (Chapter 4 of the Rules) — austrac.gov.au