Tipping-Off Offence Australia — Section 123 Explained for Gaming Venues
Section 123 of the AML/CTF Act creates a criminal offence with a two-year prison maximum. It applies to a venue staff member who discloses, directly or indirectly, that a suspicious matter report has been or will be filed. The offence is rarely prosecuted but the structural compliance obligation it creates is the most demanding part of running an AML/CTF program in a pub or club. Here is what section 123 actually says, where the lines are, and how to build a venue program that does not put staff or the venue at risk.
What Section 123 Says
Section 123 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) makes it an offence for a person to disclose to another person any of the following:
- That a suspicious matter report has been, or will be, filed with AUSTRAC.
- Information from which the existence of an SMR could reasonably be inferred.
- The contents of an SMR.
The offence is committed where the person making the disclosure knows or is reckless as to whether the disclosure is to someone other than a person within a defined permitted circle — broadly, AUSTRAC, the police, the venue’s compliance officer, the AUSTRAC-authorised governing body, the venue’s external auditor or independent evaluator, and the venue’s lawyer for legal advice purposes.
The penalty is up to two years imprisonment, a substantial fine, or both. The offence sits on the individual who makes the disclosure — not on the venue as an entity, although the venue carries reputational and licensing exposure if its staff are prosecuted.
Why Section 123 Is Different From Most Compliance Obligations
Most AML/CTF obligations are about the venue doing something positive: identifying, monitoring, recording, training. Section 123 is about the venue ensuring something does not happen. That is a structurally harder obligation to satisfy.
The challenge is amplified by the operating environment of a pub or club:
- Staff turnover is high. Casuals, part-timers, and shift workers move through the venue at higher volume than in many regulated industries.
- Information flows through informal channels. A “did you hear about that patron last night” conversation in the staff room is normal social behaviour. It can also be a section 123 disclosure.
- The compliance officer is often part-time or a manager wearing multiple hats. Containing SMR information to a single person who is also visible on the floor is difficult.
- Patrons are regulars. A patron who is the subject of an SMR is likely to interact with the same staff member tomorrow night. The staff member must continue to interact normally.
This is why section 123 is the obligation we see venues fail most often on a structural basis. Not because anyone deliberately tipped off; because the venue’s operating model did not contain the information well enough to prevent it.
What Counts as Tipping-Off — The Lines That Matter
Direct disclosure
Telling the patron, the patron’s friend, or anyone else outside the permitted circle that an SMR has been or will be filed. This is the obvious case and the easiest to identify. It is also the rarest in practice — most staff would not deliberately do this.
Indirect disclosure
Behaviour or communication from which an SMR’s existence could reasonably be inferred. This is where most accidental breaches occur. Examples:
- Refusing to serve a patron in a way that signals “we know about you.”
- Treating a patron differently from prior interactions in a visible, unexplained way.
- Asking the patron unusual questions that they understand reflect a record being checked.
- Refusing a payout with a vague “we can’t right now” that the patron interprets as compliance suspicion.
Disclosure within the venue but outside the permitted circle
Telling other staff, the venue manager, the bar supervisor, the security officer, or anyone else not within the compliance family that an SMR exists. The Act’s permitted circle is narrower than people assume. A floor manager who is not the appointed compliance officer is generally not within the permitted circle.
Information that lets a reasonable person infer
The standard is what a reasonable person could infer. Saying “the compliance officer wants me to flag any payout for John Smith” lets a reasonable person infer there is a flag on John Smith. The fact that the word “SMR” was not spoken does not save the disclosure.
The Permitted Circle — Who You Can Tell
Section 123 permits disclosure to:
- AUSTRAC.
- An authorised person within AUSTRAC.
- The Australian Federal Police, state and territory police, and other authorised law enforcement agencies in defined circumstances.
- The venue’s appointed AML/CTF compliance officer.
- Persons within the venue with responsibility for the AML/CTF program (typically the governing body or designated executives).
- The venue’s external auditor or independent evaluator (in their professional capacity).
- A lawyer providing legal advice on the matter.
The permitted circle does not by default include venue managers, duty managers, bar supervisors, gaming room supervisors, security officers, accountants, payroll administrators, board members not on the compliance committee, family members, or staff outside the compliance role family. If a person is not in the listed permitted circle, they should not know about the SMR.
How to Structure a Venue Program That Survives Section 123
Building section 123 compliance into the venue’s operating model means designing for containment from the start, not relying on staff judgment to keep things quiet.
Role-based access in the platform
SMR records, draft narratives, and supporting evidence should sit in a system that only the compliance family can see. Floor staff, managers outside the compliance role, and administrative staff should have no access path. This is structural containment — not a policy that someone can ignore.
Staff-safe patron view
Staff at the payout window need to see enough to do their job (risk tier, identification status, banned-patron flags) but not enough to infer SMR existence. The patron’s risk tier is one signal; the existence of an SMR is a different signal that should be invisible at the payout interface.
Invisible escalation
When a high-risk payout requires compliance officer authorisation, the escalation should not produce a visible queue, an unusual delay, or a phone call that the patron sees. The system should support an authorised payout that proceeds normally from the patron’s perspective even where compliance officer review is happening behind the scenes.
Training that addresses indirect disclosure
Most venue AML/CTF training covers direct disclosure. Few cover indirect disclosure thoroughly. Staff need to understand that body language, refusing service in unusual ways, asking the patron questions about their wins, or treating a regular patron differently can all amount to tipping-off. The training should walk through realistic scenarios, not just recite the section.
Documented permitted-circle list
The venue should maintain a written, dated list of who is currently within the permitted circle (compliance officer, governing body members on the AML committee, current external auditor). When someone leaves the role, the access changes the same day. When someone joins, they receive section 123 training before their access is granted.
Audit trail of access
The platform should record who viewed each SMR, when. If a section 123 question ever arises, the venue can produce evidence of who knew what and when — both to defend the venue and to identify any breach quickly.
What Goes Wrong in the Field
From AML/CTF program reviews and AUSTRAC enforcement publications, the recurring section 123 failures in pub and club venues fall into a few patterns:
- Shared drives or email folders where SMRs sit, accessible to administrative staff outside the compliance family. The breach is structural; it does not require anyone to read the file.
- Compliance committee minutes that record SMR discussions in detail, then circulate to board members not on the AML committee.
- Banned-patron lists that conflate state-issued exclusions (which are legitimate to share with floor staff) with AML-driven flags (which are not). Staff cannot tell from the flag itself whether the patron is excluded for state reasons or because of an SMR.
- Conversations between the compliance officer and the venue manager where the compliance officer assumes the manager is in the permitted circle. Often they are not.
- Staff feedback at handover — “watch out for this one” said in the staff room. Even where the staff member did not say “SMR,” the inference is plain.
None of these involve a deliberate intent to tip off. All of them create section 123 exposure on the individual involved and reputational exposure on the venue.
Frequently Asked Questions
What is the maximum penalty for tipping-off?
Two years imprisonment, a fine of up to 120 penalty units (currently around $39,600 for an individual), or both. The penalty applies to the person who made the disclosure.
Can the venue be prosecuted, or only the individual?
The offence sits on the individual who made the disclosure. The venue carries reputational, licensing, and regulator-relationship consequences but is not the primary subject of section 123 prosecution.
What if a staff member needs to consult about a suspicion before any SMR has been filed?
Consultation with the compliance officer and within the documented permitted circle is allowed. Consultation outside the permitted circle — including with most colleagues — is not. If the question is “should we file an SMR” the conversation belongs in the compliance family.
If the patron asks why their payout is being delayed, what do we say?
Honest, neutral, non-specific responses that do not reveal compliance review. Standard verification language (“we routinely verify identification on payouts of this size, this will take a few minutes”) is acceptable. Anything that reveals the verification is patron-specific or risk-driven is not.
Does section 123 apply after the SMR is filed, or only before?
Both. The prohibition applies whether the SMR has been filed, is in the process of being filed, or is being considered for filing. The patron-facing standard is the same throughout.
How do other staff know to deny a payout to a flagged patron without being told why?
The system should produce an instruction without a reason. The platform tells the staff member “escalate this payout to compliance officer for authorisation” without explaining why. The staff member follows the instruction; the reason stays in the compliance family.
Section 123 Compliance Built Into the Platform
ComplyIQ is built with section 123 containment as a core design principle. Role-based access keeps SMR existence inside the compliance family. Staff-safe patron views show what staff need without revealing what they should not know. Invisible escalation lets compliance officer review happen without producing a patron-visible delay. The venue’s section 123 obligation becomes a structural property of the system, not an exhortation in a training deck.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), section 123 — legislation.gov.au
- AUSTRAC, Tipping off offence guidance — austrac.gov.au
- AUSTRAC, Suspicious matter reports — austrac.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au