Every two years, Australian pubs and clubs with gaming machines are required to commission an independent review of their AML/CTF compliance program. It is not optional — AUSTRAC mandates it under Part 7.3 of the AML/CTF Rules. These reviews are the single best mechanism for identifying gaps before AUSTRAC does.
At RCA Group, we have conducted hundreds of independent reviews across gaming venues of all sizes — from single-site pubs to multi-venue club groups. While every venue is different, the compliance gaps we find are remarkably consistent. The same issues appear again and again, often not because venues do not care, but because the obligations are complex and the guidance has historically been unclear.
With the March 2026 AML/CTF reforms now in effect, the bar has moved. Programs need updating, roles need formalising, and the days of treating compliance as a set-and-forget exercise are over. Here is what we consistently find when we walk through the door.
1. The compliance program has not been updated for the 2026 reforms
This is the most common gap we are seeing right now. The AML/CTF Act reforms that took effect in March 2026 introduced significant changes to how reporting entities must structure their programs. New risk assessment requirements, updated customer due diligence obligations, and revised reporting thresholds all need to be reflected in your written program.
Many venues are still operating under programs that were last updated in 2023 or 2024. Some have not been touched since they were first written.
Why it matters: Your compliance program is the foundation document that AUSTRAC assesses during any examination. If it does not reflect current law, everything built on top of it is potentially deficient.
What to do: Commission a full program review and rewrite against the 2026 reforms. If your program predates March 2026, it needs to be rebuilt from the ground up against the current Rules.
2. No formally appointed compliance officer
Under the reforms, AUSTRAC now requires reporting entities to have a fit and proper compliance officer appointed by 30 May 2026. This is not a suggestion. It is a hard deadline with specific requirements around the person’s qualifications, independence, and authority within the organisation.
What we frequently find is one of three scenarios: no one has been formally appointed at all, the role has been given to someone without appropriate training or authority, or the compliance officer exists on paper but has no practical involvement in day-to-day compliance activities.
Why it matters: AUSTRAC expects the compliance officer to have genuine oversight of the program. A name on a form is not enough.
What to do: Formally appoint a compliance officer who meets the fit and proper requirements before the May deadline. Ensure they have completed appropriate AML/CTF training specific to gaming venues. Document the appointment, their responsibilities, and their reporting line.
3. Risk assessments that do not reflect the venue
The ML/TF risk assessment is supposed to be a living document that reflects the genuine risks facing your specific venue. What we commonly find are generic, template-driven assessments that could apply to any venue in the country. They do not account for the venue’s location, patron demographics, gaming machine configuration, payout volumes, or proximity to high-risk areas.
Why it matters: Your risk assessment drives your entire compliance response. If it understates your risk, your customer identification procedures, monitoring arrangements, and staff training will all be calibrated too low.
What to do: Review your risk assessment against your venue’s actual operating environment. Document your reasoning. Update whenever there is a material change to your operations.
4. Customer due diligence fails in practice
Most venues have written procedures for customer identification. The problem we consistently find during an AML/CTF independent review is the gap between what the program says and what actually happens on the gaming floor.
Staff might know they need to collect ID for large payouts, but they are unsure about the threshold. They might collect identification but have no systematic way to store it, retrieve it, or link it to the patron’s transaction history.
Why it matters: Customer due diligence is not just about collecting a document — it is about verifying identity, assessing risk, and maintaining records that demonstrate you have met your obligations.
What to do: Test your procedures. Have someone walk through the actual process a staff member follows when a patron presents for a significant payout. Check that identification records are stored securely and retrievable.
5. Suspicious matter reporting is underreported
Suspicious matter reports (SMRs) have no dollar threshold — if a staff member forms a suspicion, the obligation to report is triggered regardless of the amount involved. Yet many venues have never filed an SMR.
The confusion often stems from a fundamental misunderstanding: staff think suspicious activity means obvious criminal behaviour. In reality, it can be as simple as a patron who always pays out just below the identification threshold, or a regular whose spending patterns change dramatically without explanation.
Why it matters: Failure to report a suspicious matter is a serious contravention of the AML/CTF Act. A venue with zero SMRs over an extended period is itself a red flag — it suggests the venue is not looking, not that there is nothing to find.
What to do: Ensure your compliance officer understands the SMR obligation and the reporting timeframes. Train all gaming staff on practical indicators of suspicious behaviour. Establish a clear internal escalation pathway.
6. Training records are incomplete or missing
AUSTRAC requires that all staff involved in providing a designated service receive AML/CTF training. The training must be relevant to their role, delivered within a reasonable timeframe of commencing duties, and refreshed regularly.
What we find: training was delivered once, years ago, with no refresher. New starters have not been trained before being rostered on the gaming floor. And critically, there are no records to prove training occurred at all.
Why it matters: If you cannot demonstrate that staff were trained, AUSTRAC will treat them as untrained. The record is the evidence.
What to do: Implement a training program with recorded completions, assessment results, and scheduled refreshers. Keep records for a minimum of seven years.
7. Record-keeping does not meet the seven-year requirement
Reporting entities must retain records relating to customer identification, transactions, and compliance activities for seven years. We regularly find venues where records are fragmented across multiple systems, stored insecurely, or simply missing for certain periods.
Why it matters: AUSTRAC can request records going back seven years. If you cannot produce them, you are in contravention. This is also critical for venues that need to be bank-ready.
What to do: Centralise your record-keeping. Know exactly where every compliance record lives. Test your retrieval process — if AUSTRAC asked for a patron’s identification records from three years ago, could you produce them within 24 hours?
An independent review is a health check, not a penalty
The purpose of an AML/CTF independent review is not to catch you out. It is to identify gaps while there is still time to fix them. The venues that take reviews seriously are the ones that sleep well when AUSTRAC comes calling.
The 2026 reforms have raised the standard. If your venue has not had a comprehensive review against the current requirements, now is the time.
How we can help
RCA Group specialises in independent reviews and compliance training for pubs, clubs, and RSLs with gaming machines. We identify the gaps.
If your independent review is due — or overdue — get in touch with RCA Group. We will tell you where you stand.