State + Federal Compliance — Why Gaming Venues Need Both
Every Australian venue with gaming machines answers to two regulators, not one. AUSTRAC runs the federal AML/CTF regime. Your state gaming regulator runs everything else. Meeting one does not discharge the other — and that is where most compliance programs break down.
Two Regulators, One Venue
There is a common misconception that AML/CTF compliance is the big compliance obligation and state gaming law is a second-order concern. This is wrong in both directions. AUSTRAC obligations are live, enforceable, and carry civil penalties up to $33 million per contravention. State obligations are also live, also enforceable, and in some states carry obligations that can shut your gaming operations down if breached.
The two regimes cover different ground. AUSTRAC is focused on money laundering and terrorism financing risk — who your patrons are, how cash moves through your venue, and whether you detect and report suspicious activity. State regulators are focused on harm minimisation, responsible gambling, incident management, and the integrity of gaming operations themselves.
Both layers apply to every venue. Both carry real consequences. And both expect a documented program, trained staff, retained records, and active monitoring. A venue that treats either layer as secondary is setting itself up for avoidable risk.
You do not satisfy AUSTRAC first and then state. You satisfy both continuously, every shift, every payout, every incident. A well-designed compliance program addresses both layers as a single coherent operation, not two separate programs.
What Each Layer Requires
Federal — AUSTRAC (AML/CTF Act 2006)
AUSTRAC’s regime applies to every venue with gaming machines because paying out gaming machine winnings is a designated service under section 6 of the AML/CTF Act. The core federal obligations:
- Enrolment with AUSTRAC
- Written AML/CTF program (Part A and Part B)
- Customer identification and enhanced due diligence
- Transaction monitoring (including structuring detection)
- Suspicious matter reporting (3 business days, or 24 hours for terrorism)
- Record keeping for a minimum of 7 years
- Staff training
- Compliance officer appointment by 30 May 2026
- Independent review at least every 2–3 years
State — Your State Gaming Regulator
State obligations vary by jurisdiction, but every state imposes a separate, parallel compliance framework with its own regulator, records, and audit cycle.
NSW — Liquor & Gaming NSW
- Digital Incident Register (mandatory since July 2024)
- Gaming Plan of Management (10 sections, annual review)
- Responsible Conduct of Gambling (RCG) training for staff
- Self-exclusion program management
- Responsible gambling code of practice
VIC — VGCCC
- Responsible gambling code of conduct
- Pre-commitment obligations
- Unclaimed winnings register
- Self-exclusion program management
- Gaming machine entitlement compliance
QLD — OLGR
- 8 compliance program standards under the Gaming Machine Act 1991
- Responsible gambling code of practice
- Gaming machine monitoring
- Incident reporting
SA — Consumer and Business Services
- Mandatory facial recognition for venues with 30+ machines
- 24-hour unclaimed credit rule
- Approved Gaming Machine Manager requirements
- Barring and self-exclusion framework
Where the Two Regimes Overlap — and Where They Don’t
The overlap is real but partial. Understanding where the regimes overlap helps you design a compliance program that does not duplicate work unnecessarily, and understanding where they diverge prevents you from assuming one satisfies the other.
Overlap
- Staff training — both regimes require staff training, and the content has some shared ground (recognising problem behaviours, escalation procedures, record keeping)
- Record retention — federal requires 7 years; state regimes typically require similar durations for incident records and training logs
- Patron identification — federal CDD and state self-exclusion checks often involve the same ID documents at the same moments
- Incident handling — a serious gaming incident may trigger both a state incident register entry and a federal SMR
Divergence
- Reporting targets — SMRs go to AUSTRAC; gaming incidents go to your state regulator; tipping-off rules apply to one but not the other
- Risk frameworks — AUSTRAC is ML/TF risk; state is harm-minimisation risk (responsible gambling)
- Audit cycles — AUSTRAC independent reviews are typically 2–3 years; state audits and inspections follow different cycles, and some are unannounced
- Penalty consequences — federal civil penalties up to $33M; state consequences include licence conditions, operating restrictions, and in serious cases suspension of gaming machine operations
Why Two Separate Programs Fail
Many venues have evolved their compliance practice in layers. State obligations came first — most venues have been running incident registers, GPoMs, and RCG training for years. AUSTRAC has been enforcing more aggressively against gaming venues only recently, and for many venues the AML/CTF program was bolted on separately.
The result, in too many venues, is two parallel programs:
- One tool (or spreadsheet) for the state incident register
- A different tool for AUSTRAC transaction monitoring
- A third for training records
- A compliance officer who oversees one side
- A venue manager who oversees the other
- Patron records in two places
- Audit trails split across systems
A patron is self-excluded under state rules. The self-exclusion is recorded in the state system. The AML/CTF system does not know. The patron comes back, uses a different name, receives a payout, triggers identification — and the staff member has no visibility that this is a self-excluded patron. Two systems, two sets of knowledge, one avoidable breach.
Audit trails that split across systems are another recurring failure. When AUSTRAC or a state regulator asks for “everything relating to this patron,” the answer has to be assembled from multiple tools. It is slow, error-prone, and in practice it is often incomplete.
What Single-Platform Compliance Looks Like
The alternative is simple in principle: one platform that captures every compliance-relevant event, applies the appropriate federal and state framework to it, and produces a single audit trail.
Patron Record
One patron profile carries both the AML/CTF risk tier (LOW/MEDIUM/HIGH), federal CDD/ECDD status, and state-level flags (self-exclusion, RSA/RCG history, incident history, barring orders). Staff see the full picture at every interaction.
Payout Workflow
Every gaming machine payout is recorded as a designated service (federal) and, where applicable, checked against state self-exclusion and barring registers simultaneously. Structuring detection runs on the same data. Record retention satisfies both regimes.
Incident Management
A serious patron incident is logged to the state incident register (with the state-specific fields and timing required) and simultaneously assessed as a potential SMR candidate. If it meets both thresholds, both reports are produced from the same source record.
Staff Training
One training module covers both AML/CTF obligations and responsible gambling obligations. One attestation record satisfies both regulators. One refresher cycle keeps both current.
Audit Trail
One immutable audit trail, filterable by federal or state lens. When a regulator asks for a patron history, you produce it in minutes, not days.
The Cost Argument
Running two separate compliance platforms is not free. Most venues paying for an AML/CTF tool and a state gaming tool are paying twice — for two licences, two implementations, two training investments, two support contracts, and two data migrations every time a system is upgraded.
A single platform that covers both regimes is typically cheaper than the combined cost of separate tools, and the savings compound every year through reduced staff time spent reconciling data between systems.
The biggest cost of a dual-tool setup is staff time. Hours spent reconciling records, answering the same regulator question from two systems, and explaining why two audit trails say slightly different things. Single-platform compliance gives those hours back.
Support Matters More Than Most People Realise
Compliance technology is only as good as the team behind it. When AUSTRAC asks a question, when L&GNSW schedules an inspection, when an SMR decision is sitting on a Sunday evening, the last thing you need is to log a ticket and wait two business days for a response.
At ComplyIQ, support is a team of people who know your venue, know the regulatory landscape, and respond the same day. No ticket queues. No offshore triage. Real conversations with people who understand what compliance failure actually costs a pub or club.
Where to Start
If your venue currently runs parallel compliance programs, the first question is not “should we consolidate.” It is: “where is data falling through the gap?” Almost every dual-program venue has at least one blind spot — a patron flag that does not cross between systems, a record that one regulator would accept and the other would not, a training attestation that covers one layer and not the other.
Find the blind spots first. Then consolidate. That is what ComplyIQ helps venues do.
For the full federal picture, read our Complete Guide to AML/CTF Compliance for Pubs & Clubs or AUSTRAC Obligations for Gaming Venues. State-specific guides are in production.
Our Partners
- The AML Company — writes tailored AML/CTF programs for gaming venues.
- RCA Group — independent reviews and onsite staff training.
One Platform. AUSTRAC + State. Built for Pubs and Clubs.
ComplyIQ is the only Australian compliance platform that covers both your AUSTRAC obligations and your state gaming obligations in one system. Simpler operations. Fewer missed obligations. Lower combined cost than running separate tools. A real support team that knows your venue.
Running two separate tools for federal and state obligations is what creates the gaps. Gaming compliance software in Australia built for both layers — like ComplyIQ — closes them with one workflow, one audit trail, and one support team.