For pubs and clubs with electronic gaming machines, one of the biggest changes under Australia’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) reforms is not simply the reduction of the customer due diligence threshold from $10,000 to $5,000. It is what happens when a player reaches that point.
Venues need to take these obligations seriously, with strict record-keeping requirements, significant penalties for non-compliance and potential criminal consequences where proceeds of crime are involved.
Since 31 March 2026, venues operating sixteen or more electronic gaming machines have been working under materially different AML/CTF obligations, with greater emphasis on actively managing financial crime risk.
As Cruz Payouts puts it, “the game has changed – and it changes at the payout.”
When Initial Customer Due Diligence (CDD) is required, venues need to collect and verify relevant customer information, assign a risk rating and consider factors including PEP and sanctions status, previous dealings and incidents, and other information reasonably known or collected by the venue.
Depending on the customer’s risk rating, additional checks may also be required, including background checks, adverse media searches and enquiries into source of wealth. High-risk patrons require senior manager approval before using gaming machines.
For gaming venues, the payout is particularly important because players can remain largely unknown to a venue while they are on the floor. A customer may play for several hours without providing detailed personal information.
When a payout reaches $5,000, however, the compliance process becomes much more immediate.
Cruz Payouts describes the payout as “the triggering event”, when an otherwise unknown player becomes a known customer and the venue’s risk assessment obligations come into play. The cashier interaction therefore becomes more than a payment process. It becomes a key compliance control.
Record-keeping is another critical consideration. A venue may complete an identification check, obtain management approval and assess a customer’s risk, but still face problems if those records are scattered across paper forms, payment systems and incident logs.
As Cruz Payouts notes, the issue for a regulator is not simply whether the venue did the work. It is whether the venue can “show me”.
Venues should review how Initial CDDs are completed and recorded, how customer risk ratings are applied, when additional checks are triggered and how information can be retrieved later. Staff training should ensure employees understand their responsibilities and know when matters need to be escalated.
Venues should also consider whether lowering CRT payout limits to below $5,000 would help ensure players interact with cashiers and complete Initial CDD processes where appropriate. Cheque payout and customer identification forms should be reviewed to ensure they capture the required information.
Cruz Payout’s technology can help by bringing these controls into the payout process itself, rather than treating compliance as a separate task. Identification, risk assessment, enquiries and payment information can be captured as part of the transaction, creating a clear and retrievable audit trail.
The reforms ultimately require venues to move beyond having an AML/CTF policy on paper. Their systems, processes and people need to demonstrate that financial crime risk is being actively managed.
“The payout is the triggering event,” says Cruz. “It is where that test becomes real.”
