AUSTRAC Reporting Entity Obligations — The Definitive List
If your venue provides a designated service under the AML/CTF Act, you are a reporting entity. That status carries a defined and complete set of obligations — not negotiable, not optional, and not waivable. Here is the definitive list, in plain English, with the regulatory basis next to each obligation, so you can read it as a complete picture of what AUSTRAC expects rather than as a series of disconnected requirements.
Who Is a Reporting Entity?
Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) defines a reporting entity as a person who provides a designated service. Section 6 lists the designated services in three tables. For Australian pubs and clubs, item 7 of table 3 is the relevant service: paying out an amount won on a gaming machine.
Every Australian venue with electronic gaming machines is therefore a reporting entity. There is no minimum size threshold. There is no exemption for community clubs. There is no carve-out for venues that consider themselves “low risk.” The status applies the moment the venue makes its first gaming machine payout.
The Twelve Obligations — The Complete List
1. Adopt and maintain an AML/CTF program
Source: Part 7 of the Act. Reporting entities must have a written AML/CTF program with Part A (risk-based framework, controls, governance, oversight) and Part B (customer identification procedures). The program must be approved by the governing body and maintained current.
2. Conduct an ML/TF risk assessment
Source: Section 84 and AML/CTF Rules. The program must include an assessment of money-laundering and terrorism-financing risks specific to the entity’s customers, channels, products and services, and geographic factors. The assessment must be reviewed and updated.
3. Apply customer due diligence (CDD)
Source: Part 2 of the Act and Chapter 4 of the AML/CTF Rules. Identification of customers before or at the time the designated service is provided, with risk-based depth (CDD for low-risk, ECDD for medium and high-risk).
4. Apply ongoing customer due diligence
Source: Chapter 8 of the AML/CTF Rules. Re-assessment of risk over time, re-screening within validity windows, and updating of customer KYC information when triggers occur.
5. Monitor transactions for suspicion
Source: Part 7 (program obligation) and section 41 (SMR reporting). The program must operate transaction monitoring — structuring detection, velocity monitoring, behavioural indicators — and produce timely escalation when suspicions arise.
6. File suspicious matter reports (SMRs)
Source: Section 41 of the Act. Where suspicion of an offence (money laundering, terrorism financing, or a predicate offence) arises, the entity must file an SMR with AUSTRAC within 24 hours for terrorism financing and 3 business days otherwise.
7. File threshold transaction reports (TTRs)
Source: Section 43 of the Act. Cash transactions at or above $10,000 must be reported. For most pubs and clubs the practical $5,000 cash payout cap means TTRs are rare, but the obligation applies where the threshold is crossed.
8. File compliance reports
Source: Section 47 of the Act. Annual compliance report submitted to AUSTRAC describing the entity’s compliance with the Act and the operation of its AML/CTF program over the prior reporting period.
9. Maintain records
Source: Part 10 of the Act. Records of identification, transactions, SMRs, training, governance, risk assessments, and program updates must be retained for seven years from the date of the relevant event or the cessation of the customer relationship.
10. Train staff
Source: Part 7 (program obligation). All staff who deliver the designated service must be trained to recognise ML/TF indicators, escalate suspicions, handle ECDD, and operate within tipping-off restrictions. Training records must be retained.
11. Appoint an AML/CTF compliance officer
Source: Part 7 of the Act. A designated officer responsible for the day-to-day operation of the program, with sufficient authority and independence to carry out the role.
12. Conduct independent evaluation of the program
Source: Part 7 and AUSTRAC guidance. The program must be subject to independent evaluation at a frequency appropriate to the entity’s risk profile (typically every two to three years for community venues).
Reporting Obligations — The Filing Cadence
Of the twelve obligations, three involve filing reports to AUSTRAC. Their cadence is:
- SMRs — ad hoc, within 24 hours for terrorism financing and 3 business days otherwise from the moment of suspicion.
- TTRs — ad hoc, within 10 business days of the threshold transaction.
- Annual compliance report — once per year, by 31 March of the year following the reporting period.
Filing happens through AUSTRAC Online, the reporting portal. Reporting entities must register for AUSTRAC Online and maintain current contact details for the compliance officer and authorised report submitters.
What Triggers an AUSTRAC Compliance Assessment
Beyond the routine obligations, AUSTRAC may select a reporting entity for a compliance assessment. Triggers include:
- Random selection (sector-wide review programs).
- Industry-wide focus (e.g. pubs and clubs as a sector receiving heightened attention since 2022).
- Information from another regulator (e.g. state gaming regulator referrals).
- Patterns in the entity’s filings (anomalies in compliance reports, unusual SMR patterns or absence of SMRs in a sector that would expect them).
- Whistleblower information.
- Previous findings or undertakings.
An entity selected for a compliance assessment receives written notice, a request for documents, and a structured engagement that can take weeks to months depending on findings.
What Goes Wrong — The Common Pattern
Reporting entities rarely fail because they have no AML/CTF program. They fail because the program exists in documentation but does not operate. Specifically:
- The risk assessment is generic.
- CDD is performed but ECDD is not actually triggered for medium-risk patrons.
- Transaction monitoring runs after the fact rather than in real time.
- SMRs are filed but the storage architecture creates section 123 tipping-off risk.
- Training records show completion but not competence.
- Records exist but cannot be reconciled across the systems they live in.
A reporting entity that maps its current state honestly against the twelve obligations — with answers like “documented and operational”, “documented but not operational”, or “not documented” — can identify its actual exposure quickly. Most pubs and clubs find that they are documented but not operational on three to five obligations. That is the gap to close.
Frequently Asked Questions
Are these obligations the same for every reporting entity?
The list is the same. The depth varies with risk and entity size — a casino’s program is materially deeper than a single-pub program — but the obligation set is identical.
What happens if we miss the annual compliance report?
AUSTRAC issues reminders. Sustained non-filing leads to enforcement action. The compliance report is the easiest of the obligations to satisfy — missing it signals broader program issues to AUSTRAC.
Do we have to submit SMRs even where we are not sure?
The grounds for an SMR are “reasonable suspicion.” The threshold is lower than “knowledge” or “certainty.” Where reasonable suspicion exists, the obligation to file is triggered. AUSTRAC’s published guidance provides examples and is the right reference for the threshold.
What if our compliance officer leaves?
The reporting entity must appoint a replacement. There should be no period without a designated compliance officer. Where the officer is on extended leave the role can be delegated to a named alternate.
How does an independent evaluation differ from an AUSTRAC compliance assessment?
An independent evaluation is commissioned by the entity from an external party (commonly a consulting firm or audit firm) on the entity’s own initiative. An AUSTRAC compliance assessment is conducted by the regulator. Both test the same obligation set but the first is a private exercise the entity uses to find and fix gaps; the second is the regulator’s enforcement-tier engagement.
Twelve Obligations. One Platform.
ComplyIQ is built around the full reporting-entity obligation set. AML/CTF program operationalisation, CDD/ECDD, ongoing customer due diligence, transaction monitoring, SMR pipeline with tipping-off controls, threshold transaction reporting, training tracking, audit trail, governance support, and compliance officer workflow — in a single platform built for Australian pubs and clubs.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au
- AUSTRAC, AML/CTF programs overview — austrac.gov.au
- AUSTRAC, Independent evaluation — austrac.gov.au
- AUSTRAC, Annual compliance reports — austrac.gov.au