Customer Identification for Gaming Venues — The Complete Guide
Who needs to be identified, when, how, and what records must be kept. The definitive guide to CDD, ECDD, sight-and-record, and PEP screening for Australian pubs, clubs, and RSLs — written for the post-March 2026 regime.
Table of Contents
- What Customer Identification Means
- When CDD Is Triggered
- Sight-and-Record (Post 31 March 2026)
- Standard CDD
- Enhanced CDD (ECDD)
- PEP and Sanctions Screening
- Ongoing Customer Due Diligence
- Record Retention and Privacy
- Common Failures
- State Overlap — Self-Exclusion and Barring
- Frequently Asked Questions
- Partners & Next Steps
What Customer Identification Means
Customer Due Diligence (CDD) is the process of identifying and verifying the identity of a patron before — or when required, during — the provision of a designated service. In gaming venues, CDD is triggered when a patron requests a payout that meets specific criteria in the venue’s risk-based program.
CDD is not “taking a photo of the patron’s licence.” That practice is expressly prohibited from 31 March 2026. CDD is a process of sighting an original document, recording specific details, and keeping a documented record of the verification that can be produced to AUSTRAC or an independent reviewer for seven years.
The purpose of CDD is to connect a payout to a real, identifiable person. It is the foundation of every other AML/CTF control. A venue that cannot identify who received a payout cannot meaningfully assess the patron’s risk, monitor for structuring, or file a substantive SMR.
When CDD Is Triggered
Your venue’s AML/CTF program sets the specific triggers for customer identification. AUSTRAC does not prescribe a single dollar threshold — the Act requires a risk-based approach — but practical triggers for pub and club environments typically include:
Common CDD Triggers
- Payout threshold — commonly $5,000 for pubs, reflecting the maximum per-transaction payout cap
- Cumulative total — identification may be required when a patron’s total payouts reach a threshold over a defined period, even if no single payout is large
- Risk-based triggers — any patron assessed as medium or high risk
- Suspicious behaviour — identification should be triggered whenever suspicious behaviour is observed, regardless of amount
- PEP or sanctions hit — identification must be performed (or reaffirmed) when a PEP or sanctions screening hit is raised
- Self-exclusion breach — identification may be required to confirm whether a patron is subject to an active self-exclusion
A $2,000 payout to a patron exhibiting suspicious behaviour may require identification. A $4,500 payout to a long-standing member with no risk indicators may not. Dollar thresholds are a practical starting point; risk-based judgment is the actual standard.
Sight-and-Record (Post 31 March 2026)
The most significant identification change introduced by the March 2026 reforms is the shift from photocopy-based identification to a sight-and-record approach.
From 31 March 2026, photocopying, scanning, or photographing patron IDs is not permitted. The identification process is to sight the original document, record the required details, and return the document to the patron. Venues holding existing archives of ID copies should apply their retention and privacy framework to those records.
The Sight-and-Record Process
- Sight the patron’s original, unexpired, government-issued photo ID document in person
- Verify that the photo matches the patron and the document is genuine
- Record the minimum necessary details in your compliance system
- Record verification details — the staff member, date, time, outcome
- Return the document to the patron
Details to Record
Required CDD Data
- Full legal name
- Date of birth
- Residential address
- Document type (e.g., NSW driver licence, Australian passport)
- Document number
- Document expiry date
- Verification method (sighted original)
- Name of the staff member who performed the verification
- Date and time of verification
- Outcome and any flags raised
Acceptable Documents
Acceptable photo ID documents for CDD include:
- Australian state/territory driver licence (photo card)
- Australian passport
- Foreign passport
- Proof-of-age card issued by an Australian state/territory
- Australian government-issued photo identity card (for example, PhotoCard NSW)
A document must be current (not expired), original (not a photocopy), and must bear a photograph that is clearly the patron. Damaged or tampered documents should not be accepted, and the issue should be logged.
Standard CDD
For patrons assessed as LOW risk, Standard CDD applies. The process:
- Sight one acceptable photo ID document
- Record the required details
- No additional procedures required beyond the standard sight-and-record
Standard CDD is the baseline. Every identified patron goes through at minimum this process. The distinction from ECDD is in the depth and breadth of verification — not in the first-pass sight-and-record step.
Enhanced CDD (ECDD)
For patrons assessed as MEDIUM or HIGH risk — or where specific circumstances warrant additional scrutiny — ECDD applies. ECDD is not a replacement for Standard CDD; it is an overlay.
ECDD May Require
Additional Identity Documents
A second form of identification, typically a document from a different category (for example, a utility bill or bank statement to corroborate residential address). The purpose is not volume — it is corroboration.
Source of Funds Enquiry
Asking the patron (and recording their response) about the source of the funds being played or paid out. This is uncomfortable to ask in a pub or club context but is part of ECDD when the risk profile warrants it. The answer is itself a data point — a plausible answer reduces risk, an implausible or evasive answer increases it.
Source of Wealth Enquiry
For higher-risk patrons, understanding the broader source of the patron’s wealth — occupation, business interests, inheritance, investment income. This is typically a compliance-officer-led enquiry rather than front-line staff.
Compliance Officer Review
HIGH risk patrons should be escalated to the compliance officer for review. The compliance officer may impose additional restrictions, require further ECDD steps, or — in extreme cases — decline to provide services.
Senior Management Approval
For the highest-risk categories (PEPs, sanctions-adjacent parties, patrons with substantive red flags), senior management should be informed and approve continued service where appropriate.
The Tier Mapping
- LOW Risk = Standard CDD — one photo ID, sight-and-record, standard monitoring
- MEDIUM Risk = ECDD — additional verification, source-of-funds enquiry, more frequent review
- HIGH Risk = ECDD+ — compliance officer escalation, senior management awareness, enhanced monitoring, possible service restrictions
PEP and Sanctions Screening
Politically Exposed Person (PEP) and sanctions screening is an overlay on CDD that checks whether a patron falls into a higher-risk category requiring additional scrutiny.
Who Is a PEP?
A PEP is an individual who holds (or has held) a prominent public function — heads of state, senior politicians, senior judicial or military officials, senior executives of state-owned enterprises, and senior international organisation officials. PEP status also extends to close family members and known close associates.
PEPs are not inherently suspicious. Most PEPs are legitimate, public-facing figures. But PEP status increases the risk profile and triggers ECDD obligations as a matter of AML/CTF best practice.
When to Screen
PEP Screening Triggers
- Cumulative payouts reach a threshold (commonly $10,000)
- Patron assessed as MEDIUM or HIGH risk
- Patron otherwise identified for ECDD
- Periodic re-screening every 90 days for flagged patrons
What to Screen Against
- Domestic PEPs — Australian PEPs
- Foreign PEPs — higher risk under the Act
- International organisation PEPs
- Close associates and family members
- Sanctions lists — Australian sanctions (DFAT), UN Security Council, and applicable international sanctions
A PEP match triggers ECDD — enhanced due diligence and monitoring. It does not automatically require refusing service. The compliance officer reviews the match, assesses the risk, and decides the appropriate controls. Most PEP matches result in continued service with enhanced oversight.
Sanctions Matches
Unlike PEP matches, a positive sanctions match typically does require refusal of service. Providing a designated service to a sanctioned person can constitute a separate offence under Australian sanctions law, independent of AML/CTF obligations. Sanctions hits require immediate escalation to the compliance officer and, in most cases, senior management and legal advice.
Ongoing Customer Due Diligence
Identification at a single point in time is not sufficient. Your program must include ongoing customer due diligence — regularly reassessing patron information, monitoring for changes in behaviour, and refreshing verification data periodically.
Ongoing CDD Activities
- Periodic risk re-assessment — revisiting each identified patron’s risk tier at defined intervals
- Re-verification — confirming key details (for example, address) have not changed
- PEP re-screening — typically a 90-day cycle for flagged patrons
- Behavioural monitoring — flagging changes in patron activity that warrant risk tier changes
- Event-driven review — re-reviewing a patron when an SMR is filed, an alert fires, or external information changes
A patron who was LOW risk at first identification can become MEDIUM or HIGH risk based on later behaviour. A patron who was HIGH risk but has been monitored for an extended period without concern may be reassessed downward. Your program must describe how these transitions are identified, recorded, and actioned.
Record Retention and Privacy
CDD and ECDD records must be retained for a minimum of seven years from the date of the last designated service provided to the patron. Records must be:
- Stored securely, consistent with Australian Privacy Principle 11 (APP 11)
- Encrypted at rest where digital
- Access-controlled — limited to staff with a role-based need
- Audit-logged — access to identification records should itself be logged
- Retrievable within reasonable time on regulator request
- Destroyed securely at end-of-retention — paper shredding, secure deletion for digital records
Holding patron ID copies beyond the sight-and-record reform is a live privacy issue. Existing archives should be triaged — records still within retention continue to be held under APP 11; records past retention should be destroyed on a documented schedule.
Privacy Obligations
Gaming venues handling patron identification data are subject to the Privacy Act 1988 and the Australian Privacy Principles. Key obligations:
- APP 3 — collect only what is necessary
- APP 5 — notify patrons of collection purpose and use
- APP 11 — protect personal information with reasonable steps
- APP 12 — provide access on request (subject to AML/CTF tipping-off exceptions)
- APP 13 — correct personal information on request
Common Failures
“We Just Photocopy IDs”
This is no longer compliant and has not been since 31 March 2026. Venues still photocopying patron IDs are in breach of the sight-and-record requirement. Existing archives of photocopies create ongoing privacy exposure that must be managed carefully.
Generic Thresholds That Ignore Risk
Programs that trigger CDD only at a single dollar threshold (for example, $5,000) and never at lower amounts regardless of behaviour fail the risk-based test. A well-designed program includes behavioural triggers that can operate below the dollar threshold.
No Record of Verification Details
Venues that record the patron’s name and licence number but not the verifying staff member, date, time, or method of verification have an incomplete record. AUSTRAC expects the verification to be documented end-to-end.
ECDD Not Actually Enhanced
Programs that describe ECDD but apply it identically to Standard CDD are not compliant. ECDD must add meaningful additional scrutiny — second documents, source-of-funds enquiry, compliance officer review — not just a different label on the same process.
No Periodic Re-Review
Programs that identify a patron once and never revisit the assessment fail the ongoing CDD obligation. Risk tiers must be reviewed periodically and event-driven.
Sanctions Screening Treated As Optional
Sanctions screening is not optional for MEDIUM or HIGH risk patrons, or for patrons reaching escalation thresholds. A sanctions match can trigger separate legal obligations beyond AML/CTF.
Records Held Across Multiple Systems
Venues running CDD in one tool, risk assessment in another, SMR workflow in a third, and state self-exclusion in a fourth end up with incomplete records when any regulator asks for “everything about this patron.” The patron’s full picture is not visible to any single staff member.
State Overlap — Self-Exclusion and Barring
CDD sits inside a federal framework, but much of the information it captures intersects with state-level identification obligations:
- Self-exclusion register checks — when a patron presents for identification, the self-exclusion register should be checked simultaneously
- Barring orders — some state schemes bar specific patrons from gaming; the barring flag should be visible at the CDD moment
- SA facial recognition — mandatory for 30+ machine venues; produces its own identification evidence that interacts with CDD
- RCG-related identification — responsible gambling interactions sometimes produce identification events that should also satisfy federal CDD where thresholds are met
When a patron is identified, the venue should simultaneously check federal risk (CDD/ECDD tier), PEP/sanctions status, state self-exclusion register, and any applicable barring orders. A single platform does this in one interaction. A dual-tool setup does it in four, often with gaps.
Frequently Asked Questions
Do we need to identify every patron?
No. CDD is triggered when specific conditions are met — typically a payout above a threshold, a cumulative total, a risk flag, or suspicious behaviour. Most patrons at most times do not require identification.
Is sighting the patron’s photo on a licence enough?
For Standard CDD on a LOW risk patron, a single current photo ID sighted in person and recorded is the minimum. For ECDD patrons, additional verification is required.
Can we refuse service if a patron refuses ID?
Yes, where CDD is triggered by your program and the patron refuses to provide identification. The refusal should also be logged and may itself be a suspicion indicator.
What if the patron’s address on their licence is out of date?
Record the address on the document plus the patron’s current address as stated. Note the discrepancy. A persistent discrepancy may warrant ECDD.
Do we need to re-identify a patron who was verified a year ago?
Your program sets the re-verification cycle. Typically, re-verification is required at defined intervals or when risk indicators change. An ongoing CDD program is not one-and-done.
How does CDD interact with member records?
Member information is typically not sufficient for CDD on its own. Membership captures some patron data but does not include the verification and record-keeping required by the Act. A member presenting for a payout above the CDD threshold needs formal identification.
What happens if a PEP match is raised?
The compliance officer reviews the match. If the match is genuine, ECDD applies — additional verification, source-of-funds enquiry, enhanced monitoring. Service generally continues with enhanced oversight; service is not automatically refused.
What about patrons who use venue kiosks or self-service features?
The designated service is the payout. A self-service kiosk that issues a payout is still a designated service transaction. Your program must describe how CDD is performed where kiosks are involved — typically, the kiosk flags the transaction and escalates identification to staffed service.
Need your CDD program written?
The AML Company (theamlcompany.com.au) drafts AML/CTF programs that include tailored CDD and ECDD procedures built to the March 2026 sight-and-record standard.
Need staff trained on the new sight-and-record process?
RCA Group (rcagroup.com.au) delivers onsite training for venue staff on customer identification, ECDD triggers, and the 2026 reforms.
Identification, PEP Screening, and Self-Exclusion — One Workflow.
ComplyIQ gives staff a single identification workflow that captures CDD data to the 2026 standard, runs PEP and sanctions screening, checks state self-exclusion and barring registers, and records every detail for 7-year retention. Simpler for staff. Fewer missed obligations. One audit trail across AUSTRAC and state regulators.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — Part 2 (Customer due diligence) — legislation.gov.au
- AUSTRAC, Customer due diligence — austrac.gov.au
- AUSTRAC, Politically exposed persons — austrac.gov.au
- DFAT, Consolidated list of sanctions — dfat.gov.au
- Privacy Act 1988 (Cth) — Australian Privacy Principles 3 and 11 — legislation.gov.au