Preparing for an AUSTRAC Audit — Lessons from the Field
We conduct independent reviews for Australian pubs and clubs all year round. Some of our clients have subsequently faced AUSTRAC compliance assessments. Here is what we have learned about the gap between a venue that is audit-ready and one that is not — and the specific things that make the difference.
What an AUSTRAC Audit Actually Tests
An AUSTRAC compliance assessment — often called an audit — is not a test of whether your venue has a compliance program document. It is a test of whether the program is actually operating. The distinction matters: many venues we review have a well-written program on file that bears little resemblance to what is happening on the floor.
AUSTRAC tests three things: design (is the program adequate for the venue’s risks?), implementation (is the program actually being followed?), and evidence (can the venue produce records to prove it?). A weakness in any of the three produces findings.
Our Observation
The most common finding we produce in our own independent reviews is the implementation gap. The program describes a risk-based approach; the records show identification triggered only at a single dollar threshold. The program mentions ECDD; the records show no meaningful distinction between CDD and ECDD in practice. The program requires compliance officer escalation for HIGH risk patrons; the records show no escalations ever happening.
Venues that pass AUSTRAC assessments comfortably have closed these gaps before the assessment arrives. Venues that face findings are the ones where implementation has drifted from design over time without anyone noticing.
What Actually Triggers an AUSTRAC Audit
AUSTRAC compliance assessments are not random. From what we have seen across our clients, the common triggers are:
- SMR pattern signals. A venue submitting unusually few suspicious matter reports relative to its turnover, or no SMRs at all, draws attention. So does a sudden spike.
- State regulator referral. AUSTRAC works alongside state liquor and gaming regulators (L&GNSW, VGCCC, OLGR) and other agencies. A finding from a state regulator can prompt a federal compliance review.
- Targeted thematic reviews. AUSTRAC announces sector-wide focus areas. The pubs and clubs assessments rolled out from 2024 were thematic — venues did not have to do anything to be selected, only operate gaming machines in a covered jurisdiction.
- Public information. Media coverage, ASIC filings, or court actions involving a venue or its directors can put a venue on AUSTRAC’s radar.
- Whistleblower or third-party complaint. Disgruntled staff or patrons, banks closing accounts, or competitor reports.
Most venues we review never see a formal trigger. They get an assessment notice because they are operating in scope and AUSTRAC has resourcing for the round. Audit-readiness is therefore a posture, not a response.
Five Things AUSTRAC Will Ask For — and What Good Answers Look Like
1. “Show Us Your Current AML/CTF Program and the Version History”
Good answer: current version on file, dated, approved by a senior manager with approval record, prior versions archived with amendment logs, review cycle documented, independent review reports with remediation tracking.
Common weak answer: current version exists, no version history, no approval records visible, no evidence of periodic review.
What we see in reviews: around half the venues we review cannot produce a complete version history of their program. They have the current version, but the evolution of the program — which tells the story of how it has been maintained — is missing.
2. “Show Us Your Risk Assessment”
Good answer: documented risk assessment specific to the venue, analysing customer, service, geographic, and channel risk. Explicitly linked to the controls in the program. Dated, recently reviewed, evidence of updates when material changes occurred.
Common weak answer: generic paragraph in the program describing “the risks” in broad terms, not specific to the venue, no evidence of update.
What we see: risk assessments are the most under-invested part of AML/CTF compliance in pub and club venues. Many programs have a section titled “Risk Assessment” that is in fact a short summary, not a structured assessment. This is the single most fixable gap we identify in our reviews.
3. “Show Us CDD Records for the Following Five Payouts”
AUSTRAC will typically nominate specific recent payouts and request the corresponding CDD records.
Good answer: complete records for each payout — identification details, verification method, staff member, date and time, outcome, any flags raised, ongoing monitoring settings applied.
Common weak answer: records for some payouts, gaps for others, inconsistent field completion, photocopies retained from before the March 2026 reforms without a clear retention plan.
What we see: record quality varies wildly within a single venue. A minority of records are impeccable. A minority are effectively missing. Most fall somewhere in between — technically present but incomplete in ways that do not become obvious until a sample is pulled.
4. “Show Us Your SMR History and the Decision Records Behind Each One”
Good answer: SMRs filed, AUSTRAC reference numbers recorded, internal escalation records, decision rationale for each SMR, supporting transaction and CCTV records linked.
Common weak answer: some SMRs on file, no internal escalation records showing how the suspicion was formed and assessed, no decision rationale for SMRs not filed (which also matters — AUSTRAC wants to see that the venue assessed matters that could have gone either way).
What we see: most venues that file SMRs keep the filed SMR itself. Far fewer keep the decision trail behind it — the escalation record, the compliance officer’s assessment, the reasoning. AUSTRAC increasingly wants to see the reasoning, not just the filed report.
5. “Show Us Your Staff Training Records”
Good answer: training records showing attendance, content delivered, dates, refresher cycle, attestation by each staff member, specific coverage of the 2026 reforms in recent training.
Common weak answer: spreadsheet of staff names with a “trained” column, no content records, no evidence that training covered the specific procedures described in the program.
What we see: training records are the easiest to improve and the most commonly overlooked. A proper training record is not a tick in a spreadsheet — it is evidence that a specific staff member received specific content on a specific date and attested to understanding it.
The Preparation Habits That Distinguish Audit-Ready Venues
1. They Treat the Program as a Living Document
Audit-ready venues revisit their AML/CTF program at least annually. Not just a review signature — an actual walk-through of what has changed, what has been learned, what needs updating. Programs that have not been substantively reviewed in 18+ months are almost always non-compliant in some respect.
2. They Rehearse Their Own Assessments
The strongest venues conduct internal self-assessments between external independent reviews. They pick five random payouts and check the CDD records. They look at their SMR history and read each decision trail. They spot gaps and fix them before the external review finds them.
3. They Act on Independent Review Findings
When we deliver an independent review report, the distinction between audit-ready and audit-exposed often comes down to what the venue does next. Venues that build a remediation plan, assign owners, track progress, and close findings systematically are audit-ready by the next review. Venues that file the report and move on are not.
4. They Invest in the Compliance Officer Role
Audit-ready venues have compliance officers with real authority, real training, and real time allocation. Not a manager with the title bolted on top of everything else they do. The compliance officer’s depth shows in assessments — in interviews, in the decision trail, in the quality of SMRs and ECDD records.
5. They Use Technology That Produces Defensible Records
Manual systems produce inconsistent records. Dual-tool setups (AML/CTF in one tool, state gaming compliance in another) produce incomplete records when a question spans both layers. Audit-ready venues increasingly run integrated compliance platforms that capture every relevant event in one place.
The State Audit Running in Parallel
Pub and club venues do not just face AUSTRAC. State gaming regulators — Liquor & Gaming NSW, VGCCC, OLGR, CBS — conduct their own audits under state gaming law. In practice, a well-prepared venue is ready for both.
State audits often focus on incident register completeness, Gaming Plan of Management alignment (where applicable), self-exclusion enforcement, RCG training currency, and responsible gambling procedures. Many of these records overlap with AML/CTF records. A venue that has invested in integrated compliance technology produces both sets of records without duplication.
Our Methodology
When we conduct an independent review, we look at the same things AUSTRAC will look at. We examine the program, we sample records, we interview staff, and we test whether the operational reality matches the documented design. We then deliver a report with specific findings, ranked by severity, with practical remediation recommendations.
The purpose is not to produce a clean certificate. It is to surface the gaps before AUSTRAC does, so the venue has time to remediate on its own terms rather than under enforcement pressure.
We work with pubs and clubs across NSW, Victoria, Queensland, and other states. We also deliver staff training — the onsite, practical kind that produces real attestation records and addresses the specific risks of the venue rather than generic AML/CTF theory.
If You Are Facing an Assessment
If AUSTRAC has contacted your venue about an upcoming assessment, the time to engage is now, not after the information request arrives. A pre-assessment review by an independent party surfaces gaps early, lets you remediate on your own timeline, and produces evidence of active compliance management that supports your position in the subsequent assessment.
If you are not currently facing an assessment, the time to prepare is also now. The venues we see in the best shape during AUSTRAC engagement are the ones that treat every day as audit-readiness day.
Get in Touch
If your venue is approaching an independent review cycle, facing an AUSTRAC engagement, or simply wants to know where it stands against current standards, contact us. We can scope a review or training engagement to your specific situation.