How Often Do You Need an AUSTRAC Independent Review?
This is the most common question we get from venue managers and compliance officers across Australia. And it deserves a straight answer — not a vague “it depends” wrapped in legal disclaimers.
So here it is: you should be getting an independent review of your AML/CTF program at least every one to two years. That is the practical minimum. Some venues need them more often than that.
Let us explain why, when, and what a proper review actually looks like.
What the Law Actually Requires
Part 11 of the AML/CTF Rules requires reporting entities — which includes every pub and club operating gaming machines — to have their AML/CTF program independently reviewed on a periodic basis. The rules do not prescribe an exact frequency in months, but they make clear that the review must be regular and that the program must remain effective and up to date.
AUSTRAC’s guidance consistently points to a cycle of no more than two years. In practice, we recommend annually for most venues — particularly those with higher gaming volumes, multiple sites, or a history of compliance issues.
The key word in the legislation is “independent.” The person conducting the review cannot be the same person who wrote the program or who manages compliance day to day. That is not a technicality. It is the whole point. An independent review exists to catch the things your internal processes miss.
When You Need a Review Outside the Regular Cycle
Beyond your scheduled reviews, there are several situations where you should be commissioning an independent review sooner rather than later.
After Significant Changes to Your Operations
If you have renovated your gaming room, added or removed machines, changed your payout procedures, or undergone an ownership or management change, your AML/CTF program may no longer reflect how your venue actually operates. A review ensures your program matches your reality — because AUSTRAC does not care what is written in a document that sits in a drawer. They care about what happens on the floor.
After a Compliance Incident or Near-Miss
If you have had a suspicious matter that was not reported on time, a staff member who did not follow identification procedures, or a payout that slipped through without proper checks — that is a signal. An independent review after an incident helps you understand whether it was an isolated mistake or a symptom of a systemic gap in your program.
When Your Bank Asks for One
This is increasingly common. Banks conducting their own AML/CTF due diligence on commercial customers are asking gaming venues to demonstrate their compliance posture. A current independent review report is often the fastest way to satisfy your bank’s requirements and maintain your banking relationship. If your bank is asking questions, do not wait — get ahead of it.
After Major Regulatory Changes
The AML/CTF regime is not static. The March 2026 reforms introduced significant changes to customer identification, risk assessment, and reporting obligations. If your program was written before those reforms took effect, it needs to be reviewed against the new requirements. A program that was compliant eighteen months ago may have gaps today.
When AUSTRAC Directs You To
AUSTRAC has the power to direct a reporting entity to commission an independent review. If that happens, you are already on their radar. Treat it with the seriousness it deserves, and engage a reviewer who will do thorough, defensible work — not someone who will hand you a ticked checklist.
When Changing Compliance Service Providers
If you are transitioning from one compliance provider to another — whether that is the firm that wrote your program, your training provider, or your technology platform — an independent review at the point of transition gives you a clean baseline. It identifies what the outgoing provider may have missed and gives the incoming provider a clear picture of where things stand.
What Actually Happens During a Proper Review
A meaningful independent review is not a desktop exercise. It is not someone reading your program document, ticking boxes on a template, and emailing you a report.
At RCA Group, our reviews are conducted onsite at your venue. We walk the gaming floor. We observe your staff during payout procedures. We check whether your identification and verification processes work in practice, not just in theory. We review your transaction records, your suspicious matter reporting history, your training records, and your risk assessments.
A proper review covers:
- Program adequacy — Does your AML/CTF program address all the obligations relevant to your designated services? Is it current with the latest legislative requirements?
- Implementation and effectiveness — Is the program actually being followed on the floor? Do staff know what to do when a patron presents for a large payout?
- Customer identification procedures — Are you collecting and verifying the right documents at the right thresholds? Are your records complete and accessible?
- Risk assessment — Is your ML/TF risk assessment current? Does it reflect your actual customer base, services, and geographic risk factors?
- Transaction monitoring — Are you monitoring for suspicious patterns? Do you have systems to detect structuring?
- Reporting — Are suspicious matter reports being submitted within the required timeframes?
- Training — Have all relevant staff completed AML/CTF training? Is it role-appropriate and current?
- Record keeping — Are you retaining records for the required seven-year period? Are they stored securely and retrievable?
The output is a detailed report with findings, risk ratings, and practical recommendations — not generic advice, but specific actions tailored to your venue.
The Difference Between a Real Review and a Box-Ticking Exercise
Not all independent reviews are created equal. And the consequences of a superficial review can be severe.
The Mounties Group enforcement action is a case worth studying. Mounties had commissioned five independent reviews over the relevant period. Five. On paper, that looks like a venue taking compliance seriously. But every one of those reviews was a desktop-only exercise. The reviewers examined documents but never set foot in the venues. They never observed how staff actually handled payouts, identification, or suspicious matter escalation.
When AUSTRAC investigated, they found systemic failures that those five reviews should have identified — failures in customer identification, transaction monitoring, and suspicious matter reporting. The reviews had provided false assurance.
The lesson is straightforward: a review that does not examine how your program operates in practice is not worth the paper it is printed on. If your reviewer has not visited your venue, has not spoken to your staff, and has not observed a payout, they have not conducted an independent review. They have conducted a document review. Those are not the same thing.
How Often Is Right for Your Venue?
As a general guide:
- Every 12 months — venues with higher gaming revenue, multiple gaming rooms, a history of compliance findings, or those operating in higher-risk environments
- Every 18 to 24 months — smaller venues with stable operations, a clean compliance history, and well-established procedures
- Immediately — after any trigger event listed above (operational changes, incidents, regulatory reforms, bank requests, AUSTRAC direction)
If you have not had a review in more than two years, you are overdue. If you have not had one since the 2026 reforms, your program may have gaps you do not know about. Either way, the best time to act is now.
How we can help
RCA Group specialises in independent reviews and hands-on AML/CTF training for pubs and clubs with gaming machines.
If you are due for a review — or you are not sure — get in touch with us.