Across independent reviews and AUSTRAC compliance assessments in the pub and club sector, transaction monitoring produces predictable findings. The underlying problem is structural: a payout ledger is a record, not a monitoring system. Monitoring requires continuous aggregation across time, across venues, and across patrons, with outputs that route directly to the compliance officer in time to act.
Records exist, but they are not tamper-evident. The regulator cannot tell if a record was edited after the event.
Evidence is scattered across paper logs, spreadsheets, gaming machine reports, and CCTV, with no single chain linking them.
Records lack the metadata regulators ask for: who, when, on what basis, and with which supporting evidence.
Records do not survive the seven-year retention requirement. Older records have been moved, archived, or lost in system migrations.
Audit trail entries are disconnected from the compliance decisions they support. A CDD record exists and an SMR exists, but the path between them is undocumented.
No silent overwrites. Corrections are new entries linked to originals
The audit trail must produce on demand for AUSTRAC. It must also stay invisible to the patron, structurally contained from floor staff for SMR-linked entries, and free of personal data exposure beyond what is necessary. ComplyIQ enforces all three boundaries by design.
Audit trail is an internal compliance artefact, not a customer-facing feature. Patrons do not see the audit entries that record their CDD, screening, or monitoring activity. Section 123 of the AML/CTF Act constrains what may be revealed to anyone, including the patron themselves.
A floor staff member can see the audit entries they generated, including their CDD records, training completions, and payouts they processed. They cannot see the enterprise audit view or the compliance officer’s investigative drill-throughs. Role-based access is structural.
Audit entries linked to a suspicious matter report sit behind a containment boundary. Only the compliance family (compliance officer, group compliance officer, super-admin) sees them. Floor staff and venue managers do not see SMR-linked audit entries by design.
The compliance officer’s view is the only one that crosses the full audit trail. Drill-through from a single event to its causes and consequences happens in the compliance officer’s workflow, not at the payout window. Investigations stay where they belong.
The audit trail receives a record of every action in every other module, including CDD, screening, monitoring, SMR, training, and program management. It is the connective layer that allows every module’s output to be verified, reconstructed, and produced for the regulator. The audit trail module is one of seven modules that operate together as the ComplyIQ platform.
Every identification and ongoing-CDD action chained into the audit trail.
Every screen, candidate, resolution, and ECDD action chained.
Every detection, alert, and resolution chained with linked evidence.
Every SMR draft, filing, and supporting evidence chained with s.123 containment.
Every recorded event is hashed and linked into a chain. If anyone edits a past event, even a comma in a narrative, the hash for that event changes, and every subsequent hash in the chain becomes invalid relative to the original. The change is detectable on inspection. The protection is structural, not policy-based.
The retention clock starts at the AUSTRAC-defined event date, not the system save date. Records are kept in immutable storage for the full seven years and remain queryable and exportable for the entire window. The venue does not need to plan archiving, manage retention policies, or worry about migration cliffs.
The compliance officer runs an export from the platform, including the original event, actor, decision basis, supporting evidence, and chain-verification artefact. The package is structured for AUSTRAC information requests and can be produced without IT involvement. Friday-night reconciliation is not part of the workflow.
The Australian Privacy Principles allow access requests in defined circumstances, but section 123 of the AML/CTF Act constrains what may be disclosed. Where access is requested, the platform produces the appropriate subset, such as CDD data supplied by the patron, and withholds the rest, such as screening, monitoring, and SMR-linked entries. The decision matrix is built in.
The audit chain extends across the group. A patron acting at three venues in the group produces one timeline, not three. Group compliance officers see the consolidated view. Venue compliance officers see their own venue plus group-relevant escalations. The cross-venue chain is what makes group-level monitoring defensible.
Yes, and that is the point. Records are not edited to remove mistakes. They are annotated with a follow-up entry that explains the correction. AUSTRAC sees the original record, the correction, and the reasoning. This is materially better for the venue than a record that looks edited or a missing record entirely.
Book a demo to see hash-chain verification, decision-linked evidence, cross-module drill-through, and AUSTRAC-ready exports operating together, with seven-year retention built in and section 123 containment enforced.
