The AUSTRAC Compliance Checklist for Pubs and Clubs

Items to verify

• The venue has a written AML/CTF program, approved by the governing body (board, owner, or partnership).
• The program has both a Part A (risk assessment, framework, controls, oversight) and a Part B (CDD procedures).
• An AML/CTF compliance officer has been formally appointed by name.
• The compliance officer’s role is documented, including authority, time allocation, and reporting line.
• The board (or governing body) has a documented mechanism for receiving compliance reports at a defined frequency.
• An independent evaluation of the program has been conducted in the past two years (or commissioned for the current cycle).
• For multi-venue groups: a group-level program exists, with venue-level adaptations documented.

Items to verify

• A documented ML/TF risk assessment exists for the venue.
• The risk assessment considers customer types, channels, products and services, and geographic factors.
• The risk assessment is dated and reflects current operations (not a historical snapshot).
• The risk assessment was reviewed in the past 12 months and after any material change in operations.
• The risk assessment drives the program — risk tier categories, identification triggers, screening requirements all flow from it.
• Patron risk profiles are operational, not theoretical — staff at the payout window can see risk tier in real time.

Items to verify

• Patron identification procedures meet Chapter 4 of the AML/CTF Rules — document type, issuer, expiry, name, date of birth captured.
• The post-March 2026 prohibition on retaining ID copies is reflected in the program and in operational practice.
• Cash payouts at or above the venue’s prescribed threshold (commonly $5,000) trigger mandatory identification before payout.
• Risk-based identification triggers exist for medium- and high-risk patrons regardless of dollar amount.
• Enhanced CDD (ECDD) procedures exist for medium- and high-risk patrons, including source-of-funds and source-of-wealth enquiry.
• A compliance officer escalation pathway exists for high-risk payouts.
• PEP and sanctions screening operates on a defined cycle (typically 90-day validity for PEP, ongoing for sanctions).
• Records of identification, screening, and ECDD are tamper-evident and time-stamped.

Items to verify

• Transaction monitoring runs continuously, not just retrospectively.
• Detection patterns are configured for amount clustering, velocity spikes, and split payouts (the three structuring patterns AUSTRAC explicitly references).
• Wealth-gap detection compares patron payouts to known patron profile.
• Behavioural indicators are documented and staff are trained to escalate them.
• Alerts produce a defined disposition (cleared, escalated, SMR drafted, SMR filed) with a recorded decision-maker and timestamp.
• Monitoring outcomes feed back into the patron’s risk profile.

Items to verify

• The SMR pipeline is documented from the moment of suspicion through to filing with AUSTRAC.
• The 24-hour deadline for terrorism financing and the 3-business-day deadline for other suspicions are tracked from the moment of suspicion (not from compliance officer review).
• SMR existence is contained to the compliance family by role-based access — section 123 tipping-off offence is structurally enforced, not just trained on.
• SMRs include narrative articulating the grounds for suspicion, not just the transaction details.
• Filed SMRs are retained for seven years with the supporting evidence.
• The program has been tested end-to-end with a tabletop scenario in the past 12 months.

Items to verify

• All staff who deliver the designated service (gaming machine payout) have completed AML/CTF training.
• Training covers ML/TF indicators, escalation, ECDD, and tipping-off.
• Refresher training is delivered at a defined frequency (typically annually).
• Training records are retained and produceable to AUSTRAC.
• New staff receive training before being permitted to handle gaming payouts.
• Training delivery is verifiable (not just self-attested).

Items to verify

• Records of identification, transactions, SMRs, training, governance, and risk assessment are retained for seven years.
• Records are tamper-evident — the venue can demonstrate they have not been altered.
• Records are time-stamped to the point of the original event, not the point of recording.
• Records can be searched and produced by patron, by date, by event type.
• Records are retrievable in a format AUSTRAC can use directly (not paper that must be transcribed).
• The governance log records every material program decision (policy approval, risk assessment update, compliance officer change, evaluation outcome).

How long does an honest self-assessment take?

For a single-venue pub or club, two to three hours of focused review by the compliance officer. For a multi-venue group, a day or two with each venue’s records to hand.

Is this the same checklist AUSTRAC uses?

AUSTRAC does not publish a single “compliance assessment checklist” but its compliance assessments test the same obligation set in the same structure. A venue that scores well against this list will score well against the regulator’s test.

What if we are missing items in multiple sections?

Do not panic and do not try to fix everything at once. Prioritise: tipping-off control (section 5) and identification at payout (section 3) are the highest-exposure items. Address those first. Build a documented remediation plan for the rest.

Does ComplyIQ check these items automatically?

The platform operationalises most of them by design — risk profiling at payout, real-time monitoring, ECDD workflow, SMR containment, audit trail. The governance and policy items still require human ownership; the platform supports them but does not replace the compliance officer’s judgment.