Do Pubs Need AML Compliance? Yes. Here Is Why.
If your venue has gaming machines and pays out winnings, you are a reporting entity under Australian law. AML/CTF compliance is not optional, it is not just for casinos, and the penalties for getting it wrong are severe.
The Short Answer
Yes. If your pub operates gaming machines, you need a full AML/CTF compliance program. This is not a grey area. It is federal law.
Every pub, hotel, club, and RSL in Australia that operates gaming machines and pays out winnings is classified as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act). That single classification triggers a comprehensive set of legal obligations that apply to your venue right now, today, regardless of your size.
The reason is straightforward. Paying out a gaming machine win is a designated service under the Act. It does not matter whether the payout is $50 or $5,000. The moment you hand cash or process a transfer for a gaming machine win, you are providing a designated service, and you are subject to AUSTRAC regulation.
What Obligations Does This Create?
Being a reporting entity is not a label you can ignore. It creates specific, enforceable legal obligations. Here is what the law requires of your venue:
1. AML/CTF Program
You must have a written AML/CTF program that covers customer identification, risk assessment, transaction monitoring, and suspicious matter reporting procedures. This program must be tailored to your venue. A generic template downloaded from the internet does not meet the standard. Your program must reflect how your venue actually operates, the services you provide, and the risks you face.
2. Customer Identification (Know Your Customer)
You must identify and verify the identity of customers before providing designated services in certain circumstances. For gaming venues, this is driven by your risk assessment and payout thresholds. You need procedures for collecting identification documents, verifying them, and keeping records.
3. Risk Assessment
You must assess the money laundering and terrorism financing risks your venue faces. This is not a one-off exercise. Your risk assessment must be reviewed and updated regularly, particularly when your operations change or new risks emerge.
4. Transaction Monitoring
You must monitor transactions for suspicious patterns. This includes watching for structuring (customers deliberately splitting payouts to avoid thresholds), unusual payout frequencies, and other indicators that something may not be right.
5. Suspicious Matter Reports (SMRs)
If you form a suspicion that a transaction or customer behaviour may be related to money laundering or terrorism financing, you must report it to AUSTRAC. SMRs have strict timeframes: 24 hours for terrorism-related suspicions, 3 business days for all others. Failure to report is an offence. Tipping off the customer that a report has been made is a criminal offence under section 123 of the Act.
6. Record Keeping
You must retain all compliance records, including customer identification documents, transaction records, and SMR documentation, for a minimum of seven years. These records must be accessible and retrievable if AUSTRAC requests them.
7. Staff Training
All staff involved in providing designated services must receive AML/CTF training appropriate to their role. This is not a one-time induction. Training must be ongoing and updated when procedures or legislation change.
8. Independent Review
Your AML/CTF program must be independently reviewed on a regular basis to ensure it remains effective and up to date. The reviewer must be independent of the person who wrote or manages the program.
9. Compliance Officer
You must appoint a compliance officer responsible for overseeing your AML/CTF program. The March 2026 reforms have introduced a 30 May 2026 deadline for all reporting entities to have a nominated compliance officer registered with AUSTRAC.
The Misconceptions That Get Venues Into Trouble
“I am too small for this to apply to me”
Size is irrelevant. The AML/CTF Act does not exempt small venues. If you have one gaming machine and you pay out one win, you are providing a designated service and you are a reporting entity. A 10-machine pub in a country town has the same legal obligations as a 400-machine club in Sydney. The scale of your compliance program should reflect your risk profile, but the obligation to have one is absolute.
AUSTRAC has made clear that small venues are not invisible. In fact, smaller venues can be more attractive to those seeking to launder money precisely because they assume no one is watching.
“That is for casinos, not pubs”
This is the most dangerous misconception in the industry. Casinos have additional obligations because of the scale and nature of their operations, but the core AML/CTF obligations apply equally to every venue that provides a designated service. The Act does not distinguish between a casino payout and a pub payout. Both are designated services. Both trigger the same reporting obligations.
The legislation is clear: if you pay out gaming machine winnings, you are regulated. The venue type does not matter. The dollar amount does not matter. The obligation is the same.
“We have never had a problem, so we must be fine”
The absence of an AUSTRAC investigation does not mean you are compliant. It means you have not been investigated yet. AUSTRAC takes a risk-based approach to enforcement, but they are actively expanding their focus on gaming venues. When they do investigate, they look back years. If your records are incomplete, your program is outdated, or your staff have not been trained, the fact that “nothing happened” in the past will not protect you.
“Our gaming machine supplier handles compliance”
No, they do not. Your gaming machine supplier provides the machines. Compliance with the AML/CTF Act is the responsibility of the reporting entity, which is the venue operator. No supplier, industry body, or third party can discharge your obligations for you. You can engage consultants and use technology to help you comply, but the legal responsibility sits with your venue.
The March 2026 Reforms: What Changed
The AML/CTF regime is not static. The reforms that took effect in March 2026 introduced several changes that directly affect gaming venues:
- Simplified customer identification — new risk-based approach to customer due diligence, replacing the old 100-point system with a more flexible framework
- Updated risk assessment requirements — venues must now assess a broader range of risk factors and update their assessments more frequently
- Compliance officer registration — all reporting entities must have a nominated compliance officer registered with AUSTRAC by 30 May 2026
- Enhanced record keeping — expanded requirements for what records must be kept and how they must be stored
- Strengthened enforcement powers — AUSTRAC has been given additional tools to investigate and enforce compliance
If your AML/CTF program was written before March 2026 and has not been updated, it almost certainly does not meet the current requirements. The reforms were substantial, and a program that was compliant under the old rules may have significant gaps under the new ones.
What Should You Do Right Now?
If you are reading this and realising your venue may not be fully compliant, here is where to start:
1. Check your AML/CTF program
Do you have one? Is it tailored to your venue? Has it been updated since the March 2026 reforms? If the answer to any of these is no, that is your first priority.
2. Appoint a compliance officer
The 30 May 2026 deadline is approaching. If you have not nominated and registered a compliance officer with AUSTRAC, do it now.
3. Train your staff
Every staff member who handles gaming machine payouts needs AML/CTF training. Not a generic online module, but training that covers your venue’s specific procedures and their obligations under the Act.
4. Get an independent review
If you have not had your program independently reviewed in the last two years, or if it has never been reviewed, commission one. An independent review will identify gaps before AUSTRAC does.
5. Put systems in place
Compliance is not a once-a-year activity. You need systems for ongoing customer identification, transaction monitoring, risk assessment, and suspicious matter reporting. Manual processes on paper are error-prone and difficult to defend in an investigation.
About ComplyIQ
ComplyIQ is purpose-built compliance technology for pubs and clubs with gaming machines. We help venues manage customer identification, risk assessment, transaction monitoring, and suspicious matter reporting through a single platform designed for venue staff.
See How ComplyIQ Works
Book a demo and see how ComplyIQ helps pubs and clubs meet every AUSTRAC obligation through a single platform built for venue staff.