AUSTRAC Audit Preparation — What to Expect and How to Be Ready
AUSTRAC compliance assessments are no longer rare for gaming venues. If your pub, club, or RSL has gaming machines, you are in scope. Here is what an AUSTRAC assessment looks like, what they will ask for, and how to be ready before they arrive.
What Is an AUSTRAC Compliance Assessment?
AUSTRAC conducts compliance assessments — sometimes called audits — to evaluate whether a reporting entity is meeting its obligations under the AML/CTF Act. For gaming venues, an assessment typically combines a document review, staff interviews, and in many cases an onsite visit.
The assessment is risk-based. AUSTRAC targets venues where risk indicators suggest heightened exposure: high transaction volumes, history of SMR filings (or notable absence of them), prior compliance concerns, referrals from other regulators, or sector-wide risk profiling. No venue is immune, but venues with clear risk signals are more likely to be assessed.
An assessment is not a negotiation. AUSTRAC arrives with a defined scope and expects access to specific documents, systems, and people. The preparation you do before the assessment determines how it goes.
How AUSTRAC Typically Engages
Initial Notification
Most assessments begin with a formal notification. AUSTRAC will write to your venue identifying the scope of the assessment, the information required, the timing, and the contact officer. The notification is usually accompanied by a detailed information request — often a list of 30–50 items.
Information Request
Typical information requests include your current AML/CTF program (Part A and Part B), your most recent ML/TF risk assessment, customer identification records for nominated patrons, SMR records and the decision-making underlying them, training records for the past 2–3 years, transaction monitoring records and alert history, records of any independent reviews and the actions taken in response, your compliance officer appointment documentation and fit-and-proper assessment, and your enrolment details with AUSTRAC.
Onsite Engagement
For larger venues or higher-risk assessments, AUSTRAC will attend in person. Onsite time typically includes staff interviews (venue manager, compliance officer, gaming floor staff), a review of physical records if any are still held in paper form, a walkthrough of gaming operations, and observation of payout and identification procedures.
Findings and Response
After the assessment, AUSTRAC produces findings. These may identify compliance strengths, compliance gaps, or formal breaches. Your venue is given the opportunity to respond. AUSTRAC then determines whether to close the matter, issue a remedial direction, seek an enforceable undertaking, or commence civil penalty proceedings.
What AUSTRAC Is Really Looking For
Behind the specific document requests, AUSTRAC is answering three questions:
1. Does this venue actually have a working compliance program?
Not “is there a document called an AML/CTF program in a drawer.” But: does the program reflect the venue’s actual risks, is it being implemented, are staff following it, and do the records match what the program says is happening?
2. Would this venue detect and report what it should?
AUSTRAC will look at your SMR history, the rate of SMRs relative to the venue’s size and profile, and the quality of the SMRs you have filed. A venue with no SMRs over several years of busy operation stands out as much as a venue that files poor-quality SMRs.
3. Is this venue’s evidence defensible?
AUSTRAC wants to see that decisions have been documented. Who escalated what, when, why, and what happened next. A compliance program without a decision trail is very hard to defend under scrutiny.
The Preparation Checklist
You prepare for an AUSTRAC assessment by running your compliance program well every day. But specifically, the following preparations pay off if an assessment arrives:
Document the Program Trail
Make sure you can produce the current version of your AML/CTF program, every previous version, the approval records, the review records, and the amendments history. “We’ve updated it” without a version history is a flag.
Reconcile Your Risk Assessment to Your Controls
Your risk assessment should explicitly drive your controls. AUSTRAC will ask: “your risk assessment identifies this risk — where in your controls do you address it?” If the link is not obvious, your program is not genuinely risk-based.
Know Your SMR Numbers
How many SMRs has your venue filed in the past 12 months? 24 months? What were they about? How long did each take to file from the moment of suspicion? A venue that cannot answer these questions at interview is in trouble.
Audit Your Own Records
Pick five randomly selected payouts from the past 90 days where identification should have been triggered. Can you produce the full CDD record? Pick five risk assessments. Can you show how the rating was arrived at? If you find gaps, AUSTRAC will too.
Check Training Records
Every staff member currently involved in payouts should have current AML/CTF training documented. Check that records exist, that they include content and attendance, and that refreshers have been delivered.
Review Your Independent Review Response
If your last independent review identified findings, what did you do about them? AUSTRAC will ask. An unaddressed finding from two years ago is worse than no review at all.
Stress-Test Your Incident Response
Walk through a hypothetical suspicious matter with your compliance officer. Who escalates, how, when, where does the record live, what happens if the compliance officer is on leave, how is tipping-off prevented? If the answers are uncertain, fix the process before AUSTRAC finds the gap.
Venues that scramble to build records in the weeks before an assessment typically fail. The records do not look contemporaneous, the gaps are obvious, and the effort signals that the program was not operating as described. Good preparation happens continuously over years.
The Role of the Compliance Officer in an Assessment
Under the March 2026 reforms, your nominated compliance officer is the primary point of contact for AUSTRAC. In an assessment, the compliance officer leads the document response, participates in interviews, and represents the venue’s compliance posture.
This is one reason the fit-and-proper assessment for the compliance officer matters so much. A compliance officer who cannot articulate the venue’s risk assessment, explain the SMR decision framework, or describe how transaction monitoring works is a problem AUSTRAC will not overlook.
If your compliance officer has been appointed in name but has not been resourced or trained to perform the role substantively, address that before an assessment arrives.
State Audits Run in Parallel
AUSTRAC is not the only regulator your venue answers to. State gaming regulators — L&GNSW, VGCCC, OLGR, CBS — conduct their own inspections and audits under state gaming law. A well-run venue prepares for both.
State audits typically cover your incident register, Gaming Plan of Management (in NSW), responsible gambling compliance, self-exclusion management, and staff RCG/RSA training. Many of these records overlap with AML/CTF records — particularly patron interactions, incident logs, and training. A single-platform compliance system produces both sets of records without duplication.
If AUSTRAC Finds Issues
Assessments that identify issues do not always escalate to enforcement. AUSTRAC’s graduated response includes guidance, remedial directions, and enforceable undertakings before civil penalty proceedings are considered. The earlier you engage, the better the outcome.
If findings are identified:
- Respond substantively — acknowledge what is accurate, challenge what is not, provide additional evidence where relevant
- Commit to a remediation plan with specific actions, owners, and deadlines
- Deliver against the plan and document every step
- Keep AUSTRAC informed as remediation progresses
A venue that responds quickly, remediates comprehensively, and engages openly is far less likely to face civil penalty proceedings than a venue that resists or delays.
Where ComplyIQ Fits
An AUSTRAC assessment tests whether your program is working in practice, not just whether a program document exists. ComplyIQ operationalises every element an assessor will test: enrolment records, CDD/ECDD workflows, transaction monitoring with alert audit trails, SMR filings with decision logs, 7-year retention of patron and transaction records, staff training attestation, and a single immutable audit trail across every event.
For the full obligation set, see our AUSTRAC Obligations for Gaming Venues pillar guide.
Our Partners
- The AML Company — program drafting and remediation support.
- RCA Group — independent reviews that pre-empt AUSTRAC findings and onsite staff training that produces defensible attestation records.
Be Ready Before the Letter Arrives.
ComplyIQ gives pubs and clubs the single platform that turns AUSTRAC obligations — and state gaming obligations — into day-to-day workflows with a complete audit trail. Fewer missed requirements, lower combined cost than running separate tools, and a support team who know your venue by name.
Audit-readiness is the by-product of running a complete compliance program day-to-day. See how ComplyIQ’s gaming compliance software turns AUSTRAC and state gaming obligations into the workflows your team already runs.