What AUSTRAC Actually Expects From Your Gaming Payout Process
The gaming machine payout is the moment a pub or club performs the designated service that brings the venue inside the AML/CTF Act. Everything AUSTRAC tests — identification, risk-based controls, record-keeping, suspicious matter handling — intersects at that single transaction. This is what AUSTRAC actually expects, decision by decision, at the payout itself.
The Payout Moment Is the Designated Service
Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), a designated service is what makes a business a reporting entity. For pubs and clubs, the relevant designated service is item 7 of table 3 in section 6 of the Act: paying out to a person an amount won on a gaming machine. The instant a venue pays a patron a winning, it is providing a designated service and the venue is a reporting entity.
Every obligation that flows from the Act — AML/CTF program, customer due diligence, ongoing monitoring, suspicious matter reporting, threshold transaction reporting, record keeping — exists because of what happens at the payout. AUSTRAC’s testing of a pub or club always traces back to this moment.
What AUSTRAC examines is therefore not “is your program documented” in the abstract. It is “does the documented program produce the right outcome at the payout, every time, for every patron, with a defensible record”. A program that reads well on paper but does not control behaviour at the payout window is the most common audit failure pattern we see.
Identification Requirements at the Payout
The post-March 2026 reform regime made identification requirements at the payout more prescriptive, not less. Three things AUSTRAC now expects are operational at the payout window, every time:
Sight-and-record (no copies)
A staff member must sight an acceptable identification document and record specified information. They cannot retain a copy of the document — the post-March 2026 changes prohibit copying. The record must capture document type, issuing authority, expiry, the patron’s name and date of birth, and the staff member who sighted it. The record must be retained for seven years.
The $5,000 cash payout threshold
Cash payouts at or above the venue’s prescribed threshold trigger mandatory identification before the payout proceeds. Most pubs and clubs apply a $5,000 threshold, which corresponds to the practical maximum payout configuration on most gaming machines. Above this threshold the payout cannot be made in cash without ID; a non-compliant payout is a breach.
Risk-based identification regardless of amount
Identification is not only triggered by a dollar threshold. The venue’s AML/CTF program must specify risk-based identification triggers: medium-risk patrons, high-risk patrons, structuring patterns, frequency patterns, and identified PEPs all require ID before the payout proceeds even where the amount is below the threshold.
For a complete walk-through of customer identification expectations including ECDD and PEP triggers, see the AML/CTF compliance guide for pubs and clubs.
Risk-Based Controls Before the Payment
AUSTRAC expects a risk-based program. That means the controls applied at the payout are calibrated to the risk presented by the patron and the transaction, not applied uniformly. The program must produce a defensible answer to four questions before the payment is made:
- What is this patron’s risk tier? — LOW (CDD), MEDIUM (ECDD), or HIGH (escalated). The tier drives identification depth, source-of-funds enquiry, and whether the compliance officer is required to authorise the payout.
- Has this patron been screened? — PEP and sanctions screening within the venue’s prescribed validity window (typically 90 days for PEP, ongoing for sanctions). A match without resolution should not be paid out without compliance officer review.
- Is there a structuring pattern? — A daily Celery-style aggregation across the venue (and across the group, if applicable) that flags amount clustering, velocity spikes, or split payouts. Detected structuring escalates the payout for review.
- Are there other behavioural indicators? — Refusal to provide ID, agitation about identification, offering ID for a different person, requesting splits to stay below the threshold, or known venue-specific risk patterns.
The controls listed above are not independent. They feed each other. A patron flagged as high risk for one reason inherits enhanced controls for every other dimension. A program that treats them as separate checklists rather than as a connected risk picture will pass each check individually and fail the holistic test that AUSTRAC actually applies.
Record-Keeping Standards at the Payout
AUSTRAC requires seven-year retention of records that establish the payout decision was lawful and risk-based. At the moment of payout, the venue must capture and retain:
The minimum record set
- Patron identification (sighted and recorded, no copy retained)
- Risk tier at the time of payout
- Screening status (PEP, sanctions) and the date last screened
- Source-of-funds and source-of-wealth declarations where required
- Structuring or behavioural alerts considered (and disposition)
- The staff member who processed the payout
- The compliance officer who authorised, where escalation was triggered
- Method of payment (cash, EFT, cheque)
- Amount and timestamp
Paper-based or spreadsheet-based records do not meet this standard. The record must be tamper-evident, time-stamped, retain editing history, and be producible to AUSTRAC on request in a format that allows the regulator to reconstruct the decision. A binder of paper logs that has been edited, has gaps, or cannot be cross-referenced to patron and screening records is a finding waiting to happen.
Tipping-Off and SMR Handling at the Payout
If a payout triggers a suspicion of money laundering, terrorism financing, or any predicate offence, the venue must not tip off the patron. Section 123 of the Act creates a criminal offence for tipping-off — including by manner, body language, refusing the payout in a way that signals suspicion, or visible escalation that the patron can interpret.
This puts a difficult requirement on staff and systems at the payout window. The system must allow:
- Suspicion to be recorded discreetly, without changing the visible patron-facing behaviour at the payout.
- Compliance officer escalation that does not produce a visible delay or a queue.
- Storage of suspicion records in a workflow that is invisible to staff outside the compliance family (no SMR existence visible to general staff or to managers outside the SMR-authorised role family).
- An auditable record of who knew what, when — not just for AUSTRAC, but for the venue’s defence in any subsequent prosecution for tipping-off.
For a deep dive on SMR handling specifically, see our plain English guide to suspicious matter reports and the upcoming SMR pillar guide.
Common Audit Findings on Payout Processes
From AUSTRAC enforcement actions, published compliance assessments, and the audit findings AML/CTF consultants see in the field, the same patterns appear repeatedly:
Identification at the wrong threshold
A program that identifies only above a dollar threshold and never on a risk basis. Or a program that identifies on threshold but does not enforce the prohibition on retaining ID copies introduced in March 2026.
Risk tier not actually used at payout
Risk profiles maintained in one system but invisible at the payout window. Staff process the payout without seeing the patron’s risk tier or screening status. The program is documented; the program is not operational.
Structuring detection that runs after the fact
A daily report that flags structuring after the patron has left the venue. By the time the alert is generated, the payout is paid, the cash is gone, and the only remaining defence is “we noticed yesterday.” Structuring detection must inform the payout, not just the audit log.
Records that cannot be reconstructed
AUSTRAC asks for the file on a specific patron over a specific period. The venue produces records from three different systems that do not reconcile. Disposition of alerts is in email; identification is on paper; payout records are in the EGM system. The reporting entity cannot demonstrate what it knew at the time of the payout.
Compliance officer escalation that does not happen
The program specifies that high-risk payouts require compliance officer authorisation. The records show that escalations are rare and that staff process high-risk payouts under their own authority. Either the program is wrong about escalation triggers or staff are bypassing them. Both findings sit on the venue.
What a Defensible Payout Process Looks Like
A defensible payout process is one where every payout produces a record that AUSTRAC can read forward and the venue can defend backward. Specifically:
- Patron identification, risk tier, and screening status are visible at the payout window in the same view that processes the payment.
- Threshold and risk-based identification triggers are enforced by the system, not left to staff judgment alone.
- Structuring and velocity detection runs in real time and informs the payout, not after it.
- Escalation paths to the compliance officer are built into the workflow, with an audit trail that records who escalated, when, and what the outcome was.
- SMR creation is invisible to the patron and to non-compliance staff, with tipping-off controls enforced by role-based access not by training alone.
- Records are tamper-evident, time-stamped, and produceable to AUSTRAC in a format the regulator can read directly.
This is not a list of features. It is a description of what a single payout produces. A platform that delivers all of these for every payout is what AUSTRAC expects. ComplyIQ’s gaming compliance software is built around this design — the payout is the core event, every other function in the system feeds it or is fed by it.
Frequently Asked Questions
What is the AUSTRAC threshold for identifying a patron at payout?
The most common threshold applied at pubs and clubs is $5,000 cash, which aligns with the practical maximum payout on most gaming machines. The venue’s AML/CTF program must specify the threshold and the risk-based circumstances in which identification is required regardless of amount.
Can we keep a copy of a patron’s ID document at the payout?
No. Since the March 2026 reforms, retaining a copy of an identification document is prohibited. The venue must sight the document, record specified information, and not retain a copy.
If a patron refuses to provide ID at the payout, can we make the payout?
Where identification is required (by threshold or by risk), no. The payout must not proceed. The refusal itself is a behavioural indicator and may warrant SMR consideration.
How long must payout records be retained?
Seven years from the date of the transaction or from the cessation of the customer relationship, whichever is later.
Does an ID scanner at the door satisfy AUSTRAC identification requirements at the payout?
An ID scanner can be a useful capture mechanism, but it does not by itself satisfy AML/CTF identification. The information captured must meet the AML/CTF Rules requirements, must be linked to the patron’s risk profile and screening status, and must be available at the moment of the payout. ID scanning is one input to CDD; it is not the AML/CTF program.
What if the structuring detection identifies a pattern only after the payout?
The detection still results in an SMR if grounds for suspicion exist. But it is also a finding against the program: the program is not preventing the harm it is designed to prevent. Real-time detection that informs the payout is the defensible standard.
One Platform. Every Payout. Every Audit Trail.
ComplyIQ is built around the payout as the central event. Patron identification, risk tier, screening status, structuring detection, SMR workflow, and the seven-year audit trail all converge at the payout window in a single view. Built for Australian pubs and clubs. AUSTRAC and state gaming compliance in one platform.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au
- AUSTRAC, AML/CTF program development — austrac.gov.au
- AUSTRAC, Customer due diligence — austrac.gov.au
- AUSTRAC, Record keeping — austrac.gov.au
- AUSTRAC, Written notices to appoint external auditor — austrac.gov.au