14 October 2026
The Australian Transaction Reports and Analysis Centre (AUSTRAC) has intensified its anti-money laundering and counter-terrorism financing (AML/CTF) expectations for Australia's expanding online casino industry, with a slew of new guidance and obligations coming into force.
In refreshed regulatory guidance released on 14 October, AUSTRAC updated its indicators of suspicious activity for casinos, noting that "gaming machines, table games and poker machines can all be used to launder money." The list of recently added red flags includes operations using multiple accounts, unusual betting patterns, and transactions involving cryptocurrencies linked to criminal activity.
"Criminal groups have demonstrated a continued interest in the casino industry as a key avenue to launder illicit funds," AUSTRAC head Michael Callaghan said in a statement. "AUSTRAC expectations on casinos have been strengthened to address these concerns and keep the sector safe from criminal misuse."
The updated guidance is accompanied by a major overhaul of AML/CTF reporting and identification obligations for online gambling service providers. From September 2024, online casinos will be required to conduct applicable customer identification procedures (ACIP) before they can open a customer account, instead of waiting for those accounts to reach a threshold.
In addition, new regulations will soon lower the customer due diligence exemption threshold for digital gambling services from A$10,000 to A$5,000, meaning a significantly greater number of transactions will be subject to intensive AML/CTF scrutiny.
An AUSTRAC spokesperson confirmed that online casino services are subject to this threshold change, which was introduced as part of the AML/CTF Amendment Act 2024. "$5,000 is a meaningful and proportionate amount that takes into account the ML/TF risks in this sector," the spokesperson said.
Notable among the updated indicators of suspicious activity specifically relevant to online casino operators are:
- Multiple online gambling accounts linked to the same device, IP address, or payment method
- Odd or erratic betting patterns, such as a pattern of continuous play and multiple max bets
- Rapid, frequent or high-volume withdrawals
- Transactions involving certain cryptocurrencies identified as having a high prevalence of criminal use
- Use of cryptocurrencies bought on dark web trading sites or through platforms known for facilitating illicit activities
AUSTRAC's guidance notes that an aggravating factor in assessing these indicators is the use of multiple accounts, multiple devices, or the opening and closing of accounts within a short time frame.
The new obligations apply to online casinos, and their land-based counterparts, as online gambling services have been progressively subject to the CDD, ACIP and other obligations since 2018, as their AML/CTF practices have gradually been found insufficient on national security grounds.
On this, AUSTRAC spokesperson added: "AUSTRAC's focus generally correlates with the level of ML/TF and inherent risk in the sector, and this will continue."
As of mid-2026, around 50 licensed online gambling companies have AML/CTF plans, as part of broader arrangements with casinos and other businesses by AUSTRAC.
For online casino operators, ACIP before providing any designated service such as an account means:
- Verifying the customer's identity
- Conducting an identity verification
- Checking the photo and document against a "live photo"
- Taking ID independently (not relying on third-party databases)
- Collecting a declaration that the customer will provide true and accurate information and that providing false information is a crime
Responsibility for ensuring ACIP is satisfied ultimately lies with the regulator. Service providers will now need to exercise extra diligence when opening an account or processing withdrawals.
AUSTRAC guidance notes operators have argued some requirements can be challenging to satisfy, such as needing live photos via mobile verification.
The deadline for ensuring all online casinos have ACIP in place is 28 September 2024. Operators that allow account creation without this identification verification will face penalties. There is no grace period for ACIP provisions.
The new CDD threshold comes into effect 12 months after the changes, on 13 October 2026. Until then, the A$10,000 threshold remains in place, meaning players can deposit up to A$9,999.99 without disclosure. Operators found breaching threshold requirements will be penalized accordingly.
Notably, casinos are now required to complement location, membership, and identity requirements when conducting CDD, in guidance consistent with approaches already reflected in AML/CTF regulations. Further clarification will be released on this in the coming months, AUSTRAC notes.
The increased focus on online casinos, and gambling operations more generally, is in response to the sector being used by criminal groups to exploit regulatory gaps and launder significant funds, an AUSTRAC spokesperson told industry media.
"The online gambling sector has experienced rapid growth over the past 18 months, which has expanded the AML/CTF risks that the sector poses. This has prompted AUSTRAC to ensure the sector is required to identify and manage those risks, for example by verifying the identities of customers and the source of funds," an AUSTRAC spokesperson said.
Addressing operators, the AUSTRAC spokesperson highlighted that physical casinos are subject to targeted regulations. Digital casinos should not have less stringent requirements than land-based venues regarding due diligence. New casinos should also consider not offering services to players who cannot or have been banned from entering physical casinos.
For online casino operators, the next 12 months will be busy as the changes are rolled out.
"One impact will be on operations; processes and regulatory frameworks need to be updated and systems are subject to review," one industry insider told reporters.
At a minimum, the changes will require casinos to:
- Review and update codes of practice to identify AML/CTF responsibilities
- Ensure policies have the right requirements to identify and manage AML/CTF risks
- Educate staff on compliance requirements
- Record training sessions
- Ensure board and senior management stay informed
- Align regulatory approaches with human oversight
- Ensure timely regulatory reporting
It is also prudent for casinos to consider:
- Private industry improvements to combat financial crimes
- Reputation risk management beyond financial compliance
- Updating ID verification frameworks to meet new standards
Given the rapid pace of change and the need to align with other regulatory changes, AUSTRAC also flagged that more guidance will be released in the coming months on CDD obligations affecting casinos.