Paper-Based Cash Payouts: Why They Don’t Survive an AUSTRAC Audit
From our independent review work across Australian pubs, clubs, and RSLs, the single most reliable predictor of an adverse AUSTRAC finding is paper-based cash payout records. The venue can have a written program, trained staff, and a sincere intent to comply — and still fail an audit because the records cannot answer the questions an AUSTRAC reviewer asks. Here is what we see, why paper does not survive, and what the transition path looks like.
What AUSTRAC Asks For at the Payout
An AUSTRAC compliance assessment, an independent evaluation, or any structured review of the payout process is built around a few standard requests. The reviewer picks a window — commonly 90 days — and asks the venue to produce, for selected payouts inside that window, a complete record of the decision.
“Complete” is a defined concept under the AML/CTF Rules and AUSTRAC’s published guidance. It means the venue must be able to demonstrate, for each tested payout:
- The patron was identified to the standard the program prescribes.
- The patron’s risk tier at the time of the payout was known and was applied.
- PEP and sanctions screening was current and the result considered.
- Source-of-funds and source-of-wealth enquiry was made where ECDD applied.
- Structuring and behavioural monitoring had been considered before the payment.
- Any escalation that should have happened did happen, with a record of who decided what.
- The payment method, amount, time, and processing staff member were recorded.
- The records have not been altered since.
This list is not aspirational. It is the file the reviewer is entitled to ask for, and a venue that cannot produce it has a finding before the reviewer has even read what was produced.
Where Paper-Based Records Fail
Paper-based records do not fail because paper is bad. They fail because the standard the records must meet is operational, integrated, and tamper-evident — and paper, however carefully kept, is none of those three.
Tamper evidence is not possible
A paper record can be edited after the fact and there is no way to prove from the document that it has not been. AUSTRAC’s standard for record reliability assumes the record can demonstrate its own integrity. Paper cannot.
Records do not integrate with risk profile
A paper payout log says the patron was paid. It does not say what the patron’s risk tier was, what their screening status was, what the structuring monitor said. Those records live in different systems, or not at all. Reconstructing the decision after the fact requires combining records that were never linked, and the venue can rarely do it cleanly.
Search is impractical
The reviewer asks for the file on patron X across a 90-day window. With paper, that is hours of work, sometimes days, and it routinely turns up gaps that were not visible when the records were filed. With each gap the reviewer asks: was that lost, or never created? Paper cannot answer.
Cross-reference between payouts is missing
Structuring detection requires comparing payouts across patrons, across machines, across days. On paper, that comparison happens by hand or not at all. By the time a clerk would have spotted the pattern, the cash has been paid out and the patron has been gone for weeks.
Compliance officer escalation is invisible
A program that requires high-risk payouts to be escalated to the compliance officer needs an audit trail of the escalation. Paper-based escalation — a phone call, a side conversation, an email — produces no record that the escalation happened, who was involved, what was decided, when. The reviewer marks the escalation as “not evidenced” even where it actually happened.
Tipping-off control is structurally absent
SMR existence under the AML/CTF Act is contained to the compliance family by section 123. A paper SMR file, a shared drive, a printed log that sits in the compliance officer’s office — none of these enforce containment. Anyone with physical access can see what was filed, on whom, and when. The venue cannot demonstrate to AUSTRAC that tipping-off controls operated.
The Findings We Make in the Field
RCA Group conducts independent reviews of AML/CTF programs in pubs, clubs, and RSLs across Australia. Where the venue still operates paper-based or spreadsheet-based payout records, the findings we make are remarkably consistent. The five most common:
Finding 1 — Records do not reconcile
The payout log, the EGM data, the cage records, and the patron file do not agree. We find different amounts, different times, different patron names against the same payout depending on which record we read. This is not because anyone has done anything wrong. It is because the records were created independently and never integrated.
Finding 2 — Risk tier is not present at the payout
The patron has a risk profile somewhere — in a folder, in a spreadsheet, in the compliance officer’s head. It was not visible to the staff member who processed the payout. The payout therefore could not have been risk-tier-aware. We mark the venue’s program as “documented, not operational” and recommend a system change.
Finding 3 — Screening is months out of date
The venue runs PEP and sanctions screening as a quarterly batch task. The 90-day validity window the program prescribes is routinely exceeded. High-value payouts to medium-risk patrons happen against screening data that has expired. The venue did not know this until we showed it.
Finding 4 — Structuring detection is reactive
The venue notices structuring after the fact, when an end-of-month report flags clustering. By then the cash is paid, the patron has not returned, and the venue files a delayed SMR for transactions that happened weeks ago. The SMR is filed; the program failed to prevent the harm.
Finding 5 — Tipping-off boundary is porous
Staff outside the compliance family can see what SMRs have been filed and on whom — through shared drives, printed logs, conversations in the venue. We have to record this as a structural breach risk under section 123 even where no actual tipping-off has occurred. The venue carries criminal exposure it does not need to carry.
None of these findings are a judgment of the people running the venue. They are findings about the records architecture. A venue running paper-based payout records will produce these findings in any independent review — ours, AUSTRAC’s appointed external auditor’s, or the regulator’s own.
The Transition Path — What to Know
For venues that recognise their current paper-based or spreadsheet-based payout records will not survive a serious review, the transition path is well understood. From our work with venues making this move, three principles matter most:
1. Move the program, not just the records
Digitising a paper log produces a digital paper log. The audit problem does not change. The transition is to an AML/CTF program platform where risk profiling, screening, transaction monitoring, ECDD workflow, SMR pipeline, and audit trail all sit together. The records emerge as a by-product of the program operating, not as a separate task.
2. Cut over cleanly, do not parallel-run forever
Paper plus a new platform, run in parallel, doubles the workload and creates two records of the same event that disagree. Set a cut-over date, plan the data migration, train the staff to the new workflow, and stop using paper for AML/CTF records on day one of the new system. The transition discipline is what produces a clean record set.
3. Bring the historical records into the new system
AUSTRAC’s seven-year retention applies to records created before the cut-over too. A clean platform plus a shoebox of old paper still produces audit problems for the old period. The migration plan should include either ingestion of historical records into the new platform or a documented archive that the new platform can index and reference.
Venues that follow these three principles transition cleanly, in our experience, in 6 to 12 weeks depending on size and complexity. Venues that try to digitise records without changing the program remain at the same risk level — and remain exposed to the same findings on the next review.
Frequently Asked Questions
Are paper-based payout records explicitly prohibited?
The AML/CTF Act does not prohibit paper records. It requires records that are reliable, retained for seven years, and produceable to AUSTRAC. Paper records can in principle meet the retention requirement; they almost never meet the reliability and produceability requirements at the standard a real review applies.
What about a spreadsheet?
A spreadsheet has the same problems as paper, plus a worse one: edits are silent and undetectable. A spreadsheet record cannot demonstrate it has not been altered. AUSTRAC reviewers treat spreadsheet-only records as equivalent to no records for the purpose of testing program operation.
Our cage staff are diligent and the paper records are accurate. Is that enough?
Diligence is not the issue. The records architecture is. Even perfect paper records produce findings on integration, reconciliation, real-time monitoring, and tipping-off containment. These findings are about what the records cannot do, not about what the staff did.
How much will a transition cost?
Less than the AUSTRAC penalty risk if the program continues to fail reviews. We do not advise on procurement, but the platforms that operate in this market in Australia are priced for community venues, not for casinos.
If we are scheduled for an AUSTRAC compliance assessment, is it too late to transition?
No. A genuine and documented transition project, in progress, is a much better story to tell AUSTRAC than a static paper-based system that has not changed despite known issues. Engage early, document the plan, and demonstrate that the venue is taking the issues seriously. The regulator’s response to a venue making genuine improvements is materially different from its response to a venue that has done nothing.
Get an Independent Review — or Move to a Platform That Survives One
RCA Group provides independent AML/CTF reviews for Australian pubs, clubs, and RSLs — the kind of review AUSTRAC will eventually do, conducted privately first so you can fix what we find before the regulator does.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au
- AUSTRAC, Record keeping overview — austrac.gov.au
- AUSTRAC, Independent evaluation guidance — austrac.gov.au
- AUSTRAC, Written notices to appoint external auditor — austrac.gov.au