What an Independent AML Review Actually Reveals — 5 Patterns from 50+ Reviews
RCA Group has now completed independent reviews of more than fifty Australian pubs, clubs, and RSLs. The findings cluster into recognisable patterns that repeat across venues of different sizes, ownership structures, and gaming room configurations. Here are the five we encounter most often, why they form, and what an honest review process actually finds — from the file room and the floor, not from the brochure.
Why These Five Patterns Recur
The recurrence is not coincidence. Australian pubs, clubs, and RSLs share a structural similarity: hospitality-first operations, hospitality-first staffing, AML/CTF retrofitted onto an existing venue model. The compliance program is documented later, by people who write programs for a living, but the program runs through the venue’s hospitality staff who are not compliance professionals.
This produces a predictable gap between the documented program and the program in operation. The five patterns we describe below all sit in that gap. None is a moral failing of the venue or its operators — they are structural symptoms of compliance retrofit. Knowing they exist is the first step toward closing them.
Pattern 1 — The Risk Profile That Lives in a Folder
What we find
The venue has a documented patron risk-profiling process, with risk tiers, escalation triggers, and ECDD procedures. The risk profiles themselves exist in a spreadsheet, a folder, or a notebook held by the compliance officer. At the gaming machine payout window, the staff member processing the payment cannot see the patron’s risk tier and proceeds as if the patron is low risk by default.
Why it forms
Two systems, two sources of truth. The compliance officer maintains the risk profile in their preferred tool. The payout staff uses the EGM cage system that does not have the field. No one designed a connection. So the risk profile is real but invisible at the moment that should be informed by it.
What we recommend
Stop treating “documented” and “operational” as the same word. A risk profile must be readable at the payout window in the same view that processes the payment. Where the existing systems do not allow this, that is the change to make — not another iteration of the program document.
Pattern 2 — PEP Screening Past Its Validity
What we find
The program prescribes PEP and sanctions screening with a 90-day validity window. The actual screening is run quarterly by the compliance officer pulling a report from a screening service. By the time the next screen is run, the validity window has been exceeded for many medium-risk patrons. High-value payouts to those patrons happen against expired data.
Why it forms
“Quarterly batch” is human-rhythm scheduling. “Within 90 days” is calendar-rhythm requirement. Without a system that reminds against the actual validity date per patron, the human rhythm slips and the program drifts out of compliance with itself.
What we recommend
Track the validity date per patron, not against a quarterly cycle. Screen on demand when a patron approaches a screening trigger (size, risk, frequency) rather than as a periodic batch. The screening service supports it; the venue program needs to use that capability.
Pattern 3 — Structuring Detection That Runs Tomorrow
What we find
The program includes structuring detection. The detection runs as an end-of-day or end-of-week report. By the time the report flags amount clustering, velocity spikes, or split payouts, the cash has been paid, the patron has left, and the venue’s only remaining option is to file a delayed SMR. The risk-prevention purpose of detection is not achieved.
Why it forms
Reporting and monitoring get conflated. A report of yesterday’s payouts is not transaction monitoring; it is an audit log. Real-time monitoring requires the system that processes the payout to also be the system that runs the detection rules — before the payment, not after it.
What we recommend
Move structuring detection to the payout window. The system that pays the patron must check, at the moment of payment, whether the cumulative pattern across the day, the week, and the venue group meets the program’s structuring threshold. If it does, the system escalates before the cash is handed over.
Pattern 4 — SMRs in Email or Shared Drives
What we find
SMRs are drafted in Word, stored on a shared drive, and emailed to AUSTRAC. The shared drive is accessible to the bookkeeping assistant, the venue manager, and a long-departed compliance officer whose access was never revoked. Section 123 tipping-off control is structurally absent — not because anyone has tipped off, but because the records architecture does not contain the SMR existence to the compliance family.
Why it forms
Section 123 is rarely prosecuted, so it gets less operational attention than it warrants. The compliance officer trusts the people they work with. The shared drive is convenient. Access lists drift. None of these are conscious failures — they are entropy.
What we recommend
Move SMRs into a system with role-based access where the compliance family is a defined role, the access list is auditable, and revocation is a single action. The structural containment is the section 123 control; everything else is hope.
Pattern 5 — Training Records Without Training Content
What we find
The venue has training records. The records show that staff completed AML/CTF training on a specific date. They do not show what the training covered, who delivered it, what assessment was applied, or whether the staff member demonstrated competence. The records satisfy the “training was delivered” question and not the “is the staff member trained” question.
Why it forms
Compliance teams optimise for the audit question they expect, which historically has been “did training happen.” AUSTRAC’s recent emphasis on competence outcomes has shifted the question to “are staff actually trained for the role they perform.” Records that satisfied the old question are now insufficient.
What we recommend
Capture what the training covered, the assessment, the result, and the certification expiry per staff member. Track refresher cadence by role rather than by individual year-anniversary. New staff should not access the gaming floor before their AML/CTF training and assessment is complete.
The Pattern Behind the Patterns
Read together, the five patterns reveal a single underlying issue: the AML/CTF program operates as documentation in one place and as venue activity in another, and the connection between the two is human rather than structural. Where the human chain holds, the program is operational. Where the chain breaks, the program is documented but not operational, and the venue is exposed.
The way to address this systemically is to stop relying on the human chain. The program logic must be embedded in the venue’s operating system — the platform that processes the payouts, captures the identifications, runs the screening, escalates the alerts, and produces the records. When the program logic is structural rather than procedural, it does not drift.
This is what we mean when we recommend, after a review, that the venue move from documented compliance to operational compliance. It is not a software pitch — it is the structural answer to the structural problem we have found in fifty-plus venues.
What an Independent Review Looks Like
A typical RCA review covers seven domains: governance, risk assessment, customer due diligence, ongoing monitoring, suspicious matter reports, training, and record keeping. We work to the same structure AUSTRAC uses in compliance assessments, so the venue’s review experience matches what the regulator’s would.
The review takes two to four days on site for a single venue, longer for multi-venue groups. The deliverable is a documented findings report with each finding categorised by severity, with remediation recommendations and a suggested sequence. We provide an executive summary suitable for a board or owner, and a working document the compliance officer can use as a remediation roadmap.
The point of the review is not to satisfy a regulator before the regulator has even appeared. The point is to find what the venue does not yet know about its own program, in time to fix it.
Frequently Asked Questions
Are these patterns specific to small venues?
No. We see the same patterns in single-pub operators and in club groups with twenty venues. The smaller venues have less complexity but the same structural issues; the larger groups have more complexity but the same root cause.
Will an independent review trigger AUSTRAC scrutiny?
The opposite. Documented evidence of an independent review and remediation activity is exactly what AUSTRAC wants to see in a regulated entity. A venue that has done an independent review and acted on the findings is in a stronger position with the regulator than a venue that has not.
Can we self-review using your framework?
You can, and we encourage venues to use the AUSTRAC compliance checklist as a self-assessment starting point. The benefit of an independent review is that an outside reviewer is not blind to the things the venue assumes are working but are not. Self-assessment finds what you know to look for; an independent review finds what you do not.
How does the review interact with our existing compliance officer?
Our review supports, not replaces, the compliance officer. The reviewer’s findings give the compliance officer leverage to drive remediation that may have been hard to prioritise with management before the report existed. The compliance officer remains responsible for the program; we are providing the independent perspective the program is required to have.
What does a review cost?
Cost depends on venue size, group complexity, and the depth of review. Single-venue independent evaluations are typically scoped against the AML/CTF Act’s independent evaluation requirement and are commercially reasonable for community venues, not casino-pricing. Contact RCA for a scope and quote.
Get an Independent Review — Find What You Don’t Yet Know
RCA Group provides independent AML/CTF reviews for Australian pubs, clubs, and RSLs — the kind of review AUSTRAC eventually does, conducted privately first so you can fix what we find before the regulator does.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, Independent evaluation — austrac.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au
- AUSTRAC, Tipping off offence guidance — austrac.gov.au
Related articles
- The Importance of Regular AML/CTF Independent Reviews
- What is an Independent Review?
- Why Use RCA Group for Your AML/CTF Independent Review
- Independent AML/CTF Reviews: Enhancing Your Compliance Framework
- AUSTRAC Compliance Report: A Guide for Your Organisation
- Strengthening Financial Security: The Vital Role of AML/CTF Independent Reviews
- Ensuring AML Compliance for Pubs and Clubs: Annual Reviews and AUSTRAC Requirements
- Compliance Report and Independent Review
- AUSTRAC Compliance Requirements: A Guide for Pubs and Clubs