AUSTRAC Reporting Entity Forum — Gambling Sector

A key concern was the lack of an appropriate and comprehensive ML/TF risk assessment. AUSTRAC said it is not sufficient to list or refer to generic controls — for example, referring to "TMP" or "ECDD" as a control without explaining how those specific components mitigate the risks identified. If you make statements such as "all customers are treated as low risk at onboarding," you should be able to support this through evidence and data. AUSTRAC said: "An ML/TF risk assessment is not tick and flick, nor is it set and forget."

The quality of AML/CTF programs was a critical concern. The program must use your ML/TF risk assessment as its base and include systems and controls your business will actually implement. AUSTRAC found programs that failed to define the processes actually followed, were not sufficiently detailed for consistent execution, and did not reflect how the business actually meets its obligations in practice.

A Transaction Monitoring Program (TMP) is the system a reporting entity uses to monitor customer transactions for unusual or suspicious activity. A recurring theme AUSTRAC found was the failure to have a fit-for-purpose TMP capable of identifying suspicious transactions, large or complex transactions, and unusual patterns. If your TMP uses thresholds, you must be able to justify them and link them to your ML/TF risk assessment. AUSTRAC gave a specific example: your TMP should be able to identify a customer who wagers $100 per month for years and then suddenly gambles five times that amount in a month. AUSTRAC said: "Your TMP is not set and forget."

AUSTRAC found failures including: a lack of clear and detailed policies around ECDD, instances where businesses were required to undertake ECDD but failed to do so, and ECDD that did not effectively mitigate the identified risk. AUSTRAC said: "One-size-fits-all ECDD is not appropriate ECDD." Re-verifying a customer's Know Your Customer (KYC) information will not assist in mitigating the risk of a customer who has a sudden spike in deposit value or betting activity. AUSTRAC also made clear that submitting an SMR is a reporting obligation — it is not a risk mitigation measure.

A key concern was the lack of board and senior management oversight of the AML/CTF function. AUSTRAC said this "involves more than having AML/CTF as a standing item at meetings." The AML/CTF function must have access to the board and senior management to regularly report on ML/TF risks. The compliance function may need a reporting line that is sufficiently independent from revenue-generating areas of the business.