You open the mail and there it is — a letter from your bank asking you to provide evidence of AML/CTF compliance. Maybe it asks for your independent review report. Maybe it wants a copy of your compliance program. Maybe it uses language you have not seen before and gives you 30 days to respond.
We get this call every week. A venue manager, sometimes a club secretary or GM, ringing to ask what the letter means and what they need to do about it. The short answer: your bank is doing its own compliance homework, and it needs you to do yours.
The good news is that if your venue has been keeping up with its AUSTRAC obligations, you probably have most of what they need. If you have not — and plenty of venues are in that position — this is a solvable problem. Here is what you need to know.
Banks are reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, just like your gaming venue. They have their own obligations to AUSTRAC, and one of those obligations is understanding the money laundering and terrorism financing risks posed by their customers.
A pub or club with gaming machines is what banks call a higher-risk customer. Not because your venue is doing anything wrong — but because gaming is a designated service under the Act, and cash-intensive businesses attract more regulatory attention. Your bank needs to demonstrate to AUSTRAC that it knows who its customers are and what risks they present.
Three things are driving the increase in these requests:
When your bank is asking for AML compliance evidence, they are not being difficult. They are managing their own regulatory exposure. The question is whether you can give them what they need.
The exact wording varies between banks, but the request usually comes down to four things.
This is the big one. Under the AML/CTF Act, reporting entities must have their compliance program independently reviewed. For most gaming venues, this review should be conducted by a qualified external reviewer — not your compliance officer, not your accountant, and not the person who wrote your program.
Banks want to see a current independent review report because it tells them that a qualified third party has assessed your program and found it fit for purpose — or identified issues and recommended fixes. Either way, it demonstrates that your venue is actively managing its compliance obligations.
Your compliance program is the foundational document. It sets out how your venue identifies customers, assesses risk, monitors transactions, reports suspicious matters, and trains staff. Banks want to see that you have one, that it is current, and that it reflects the way your venue actually operates.
A program written five years ago and never updated will not satisfy this request. Neither will a generic template. Your program needs to be tailored to your venue, your risk profile, and your operations.
AUSTRAC requires that all staff who provide designated services — which includes anyone involved in gaming machine payouts — receive AML/CTF training. Banks want evidence that this training is happening: who was trained, when, and on what topics.
Training records should show initial training for new staff, ongoing refresher training, and any additional training triggered by changes to your program. A sign-in sheet from a session two years ago is not enough.
Your venue should have a documented risk assessment that identifies the money laundering and terrorism financing risks specific to your operations. This assessment informs your compliance program and should be reviewed regularly.
Banks want to see that you understand your own risk environment — the types of customers you serve, the volume and nature of transactions, and the controls you have in place.
Not all independent review reports are created equal. A bank-ready report needs to give your bank confidence that your venue is genuinely compliant — not just going through the motions.
Here is what separates a useful report from a weak one:
When a bank is asking for AML compliance documentation, the independent review report is usually the document that carries the most weight.
If you have received a bank letter and you are missing some or all of what they have asked for, do not panic. But do not ignore it either.
You need one written. This is not optional — it is a legal requirement under the Act. Engage a specialist AML/CTF consultancy to write a program tailored to your venue. Avoid generic templates. Your program needs to reflect your actual operations, customer base, and risk environment.
Get it reviewed and updated to reflect current operations and the 2026 reforms. A program that references outdated legislation or describes processes your venue no longer follows is a liability, not an asset.
Engage an independent reviewer as soon as possible. A good reviewer will assess your program, identify gaps, and provide a report you can send to your bank. If there are issues — and there usually are — the report will include recommendations, and your willingness to act on them demonstrates good faith.
Start documenting training now. Implement a training program that covers the required topics, record attendance and completion, and build an ongoing schedule.
Even if you do not have everything ready, acknowledge the request and outline your plan. Banks are more likely to work with a venue that is actively addressing gaps than one that goes silent. A response along the lines of “we have engaged a specialist firm to conduct an independent review and expect to provide the report by [date]” is far better than no response at all.
A letter from your bank is often the trigger that gets venues to take AML/CTF compliance seriously. That is not a criticism — most venue managers are busy running a hospitality business, and compliance obligations can feel abstract until someone asks for proof.
But the bank letter is actually a useful prompt. The documents your bank is asking for are the same documents AUSTRAC expects you to have. Getting them in order does not just satisfy your bank — it protects your venue from regulatory action, civil penalties, and the reputational damage that comes with an AUSTRAC enforcement outcome.
The venues that handle this well are the ones that treat compliance as an ongoing function, not a one-off project. Regular training, a current program, periodic independent reviews, and a genuine understanding of your risk environment — these are the building blocks.
RCA Group conducts independent reviews for pubs, clubs, and RSLs with gaming machines across Australia. We know what banks are looking for because we see these requests every week, and our reports are written to meet both AUSTRAC requirements and bank expectations.
If you have received a letter from your bank and need help putting your compliance house in order, get in touch with RCA Group. We will tell you exactly where you stand and what needs to happen next.
