AUSTRAC Obligations for Gaming Venues — Everything You Need to Know

Table of Contents

1. Who Is Regulated — The Reporting Entity Test
2. Enrolment with AUSTRAC
3. Program Obligations (Part A and Part B)
4. The Risk-Based Approach
5. Customer Identification Obligations
6. Transaction Monitoring
7. Reporting Obligations — SMR, TTR, IFTI
8. Record Keeping (7-Year Retention)
9. Staff Training and Awareness
10. Compliance Officer Appointment — 30 May 2026
11. The 31 March 2026 Reforms
12. Governance, Review, and Independent Audit
13. Enforcement Powers and Penalties
14. AUSTRAC + State Gaming Law (Dual Compliance)
15. Frequently Asked Questions
16. Partners & Next Steps

Who Is Regulated — The Reporting Entity Test

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) does not regulate industries by name. It regulates specific activities, which the Act calls designated services. Any business that provides one or more designated services is automatically classified as a reporting entity.

For gaming venues, the relevant designated service is set out in section 6 of the Act:

This single provision brings every pub, club, hotel, and RSL with gaming machines into AUSTRAC’s jurisdiction. The classification applies automatically. It does not require AUSTRAC to issue a notice. It does not require a licence review. The moment your venue pays out a gaming machine win, you are providing a designated service, and you are a reporting entity with all the obligations that status carries.

Scope Points That Matter

Enrolment with AUSTRAC

Every reporting entity must be enrolled with AUSTRAC. Enrolment is a free, online registration that identifies your venue as a regulated entity and provides AUSTRAC with the contact information it needs for supervision.

Enrolment is completed through AUSTRAC Online. Failure to enrol is itself a compliance failure and exposes your venue to civil penalties. Many venues assume that because they have never received a notice from AUSTRAC, enrolment does not apply to them. This is incorrect — the obligation is self-executing.

Program Obligations — Part A and Part B

Part 7 of the AML/CTF Act requires every reporting entity to have a written AML/CTF program. The program has two parts, and both are mandatory.

Part A — General Program

Part A is the operational program that covers how your venue identifies, mitigates, and manages money laundering and terrorism financing risks. It must address:

Part B — Employee Due Diligence

Part B addresses the internal risks posed by your own staff. It must cover pre-employment screening, ongoing employee due diligence, fit-and-proper person assessments (particularly for the compliance officer and senior managers), and the management of internal risks such as collusion or compromised staff.

The Risk-Based Approach

AUSTRAC’s supervisory model is risk-based. This means your obligations do not demand identical controls for every patron or every transaction. Instead, you must calibrate your controls to the specific risks you face.

For gaming venues, the risk-based approach produces four categories of analysis:

Risk-to-Control Mapping

Once your risk assessment identifies the risk exposures, your program must describe the controls that address them. A common mapping for pubs and clubs:

• LOW risk — standard CDD, routine monitoring, standard training
• MEDIUM risk — enhanced CDD (ECDD), more frequent monitoring, source-of-funds enquiry at elevated thresholds
• HIGH risk — compliance officer escalation, senior management awareness, restrictions on services, enhanced monitoring with defined review intervals

Customer Identification Obligations

Customer due diligence (CDD) is the process of identifying your patrons and verifying their identity before — or when required, during — the provision of a designated service.

When CDD Is Triggered

Your venue’s AML/CTF program sets the triggers for identification. Typical triggers include:

• A payout above a venue-specific threshold (commonly $5,000 for pubs)
• A cumulative payout total for a single patron over a defined period
• A suspicious behaviour trigger regardless of amount
• A patron assessed as medium or high risk
• A PEP or sanctions match triggering identification requirements

Note that these are your program’s triggers. AUSTRAC expects the triggers to be risk-based and appropriate for your venue. A program that never triggers identification is not risk-based.

Sight-and-Record (Post 31 March 2026)

From 31 March 2026, venues must adopt a sight-and-record approach to customer identification. Photocopying, scanning, or photographing patron IDs is no longer permitted.

1. Sight the patron’s original, unexpired, government-issued ID in person
2. Record the minimum necessary details: full name, date of birth, residential address, document type, document number, expiry date
3. Record verification details — the staff member who sighted the document, date, time, outcome
4. Return the document to the patron

Enhanced Customer Due Diligence (ECDD)

ECDD applies when standard identification is not sufficient given the patron’s risk profile. ECDD requirements may include additional identity documents, a source-of-funds enquiry, a source-of-wealth enquiry, compliance officer review, or senior management sign-off.

Transaction Monitoring

Your venue must actively monitor transactions to identify patterns suggestive of money laundering, terrorism financing, or other criminal activity. The March 2026 reforms formalised specific structuring patterns that must be monitored:

Beyond structuring, effective monitoring should also cover:

• Minimal gameplay relative to cash-out amount (bill-stuffing indicator)
• Unusual hours for large payouts
• Third-party collection attempts
• Behavioural anomalies flagged by staff
• Repeat patterns across sessions or days

Reporting Obligations — SMR, TTR, IFTI

Three types of reports may need to be filed with AUSTRAC. For typical pub and club operations, only one (the SMR) is frequently relevant, but all three are worth understanding.

Suspicious Matter Reports (SMRs)

An SMR is filed when your venue suspects, or has reasonable grounds to suspect, that a person or transaction may relate to money laundering, terrorism financing, tax evasion, or other serious criminal activity.

Filing deadlines: 24 hours for terrorism-related matters; 3 business days for all other suspicious matters. The clock starts when the suspicion is formed, not when the underlying transaction occurred.

Tipping-off (s123): It is a criminal offence to tell the patron, or anyone who might tell the patron, that an SMR has been filed, is being prepared, or is being considered. Penalties include up to 2 years imprisonment. SMR information must be restricted to the compliance officer and senior management on a strict need-to-know basis.

Threshold Transaction Reports (TTRs)

A TTR is required for cash transactions at or above AUD $10,000. For pubs and clubs, TTRs are practically irrelevant because payout thresholds (typically $5,000 maximum per transaction) prevent most single transactions from reaching $10,000. Larger club venues should still have TTR procedures in place for edge cases — for example, membership refunds, promotional payouts, or cash-handling scenarios unrelated to gaming.

International Funds Transfer Instructions (IFTIs)

IFTIs apply to entities that send or receive international funds transfers. This is rarely relevant to a pub or club operating only gaming machines. It can become relevant for venues that operate international promotions, accept international membership payments, or handle foreign-currency transactions.

Record Keeping — 7-Year Retention

Your venue must keep records of its AML/CTF activities for a minimum of seven years. The seven-year clock runs from the date of the transaction, the date of the customer interaction, or the date the record was created — whichever is applicable.

Secure storage is mandatory for records containing personal information. Encryption at rest for digital records, access controls, and secure physical storage for any remaining paper records are all consistent with Australian Privacy Principle 11.

Staff Training and Awareness

Every staff member who could be involved in providing a designated service — which in practice means anyone handling payouts, cash, patron identification, or gaming-floor supervision — must receive AML/CTF training.

New staff must be trained before they handle any designated service. Refresher training must be delivered at least annually, and more often when procedures change materially. Records must be kept — attendance, content, attestation — for the full seven-year retention period.

Generic online training that is not tailored to your venue is unlikely to meet AUSTRAC’s expectations. Training must reflect the specific risks your staff will actually encounter.

Compliance Officer Appointment — 30 May 2026

The March 2026 reforms introduced a formal requirement for every reporting entity to appoint a nominated compliance officer. All existing entities must have the appointment in place by 30 May 2026.

The 31 March 2026 Reforms

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) received Royal Assent on 10 December 2024. For existing reporting entities including pubs and clubs, the reforms commenced on 31 March 2026.

Every program written before 31 March 2026 must be reviewed against these changes. An unrevised program is almost certainly non-compliant in at least three respects, and an outdated program itself is cited by AUSTRAC as evidence of non-compliance.

Governance, Review, and Independent Audit

AUSTRAC expects active governance around your AML/CTF program. It is not enough to have a program document. The program must be approved, reviewed, updated, and independently tested.

Senior Manager Approval

Your program must be approved by a senior manager with real authority over your venue’s operations. In most pubs and clubs this is the general manager or CEO. The approval must be documented and must reflect that the senior manager has read, understood, and endorsed the program.

Ongoing Review

Your program must be reviewed at least annually, and whenever material changes occur in your operations, services, or risk environment. A review is a structured assessment, not a signature.

Independent Review

Every two to three years — more often if your risk environment has changed significantly — your program must be independently reviewed. The reviewer must be independent of your venue’s day-to-day compliance operations. For most pubs and clubs, this means engaging an external specialist.

Enforcement Powers and Penalties

AUSTRAC is not a passive regulator. It holds a broad suite of investigative and enforcement powers, and it uses them.

Investigative Powers

• Request information, documents, and records under section 167
• Conduct risk-based compliance assessments
• Enter premises with consent or warrant
• Interview staff and directors
• Require production of AML/CTF program, risk assessments, and related documents

Enforcement Tools

• Remedial directions — require specific corrective action within defined timeframes
• Enforceable undertakings — binding commitments to remediate identified deficiencies
• Civil penalty proceedings — court-imposed fines up to $33 million per contravention
• Infringement notices — for lesser contraventions
• Criminal referral — for tipping-off and other offences carrying criminal sanctions

AUSTRAC Is Only Half the Picture — State Gaming Law Runs in Parallel

Federal AML/CTF compliance is mandatory, but it is not the full picture. Every gaming venue in Australia also faces a second layer of obligations under state gaming legislation — administered by a different regulator, with different audit cycles, different records, and different penalties.

Meeting your AUSTRAC obligations does not discharge your state obligations. Meeting your state obligations does not discharge AUSTRAC. A venue that runs these as two separate programs, with two separate tools and two separate teams, ends up doing the same work twice — and usually misses something in the gap between them.

ComplyIQ is designed for this reality. The same platform that operationalises your AUSTRAC program also captures your state-level incident records, GPoM compliance, responsible gambling actions, and self-exclusion management. One source of truth. One set of training. One audit trail. One support team.

For the full NSW state picture, see our forthcoming NSW Gaming Compliance Guide. Other state pillars (VIC, QLD, SA) are in production.

Frequently Asked Questions