iGaming & Gambling Compliance in Australia

Australia is open to licensed online wagering and lotteries but closed to online casino and poker products. Licensing is a state and territory matter, while the Commonwealth sets the national rules on what may be offered online (the Interactive Gambling Act 2001), anti-money laundering duties (the AML/CTF Act 2006) and self-exclusion (BetStop).

The principal regulators are AUSTRAC for financial crime, the Australian Communications and Media Authority (ACMA) for online gambling and BetStop, and the state and territory gambling regulators, with the Northern Territory licensing many national online bookmakers.

The biggest obstacle for a new online entrant is the combined front-door burden: a state or territory licence, AUSTRAC enrolment and a reformed AML/CTF programme, identity verification strong enough to match customers accurately against BetStop, and a fast-tightening federal regime under active enforcement.

1. Who regulates this sector

Western Australia, South Australia, Tasmania and the Australian Capital Territory also license casinos, wagering and gaming within their borders through their own regulators.

2. Licensing and authorisation

What may be offered online

The Interactive Gambling Act 2001 (IGA, Compilation No. 24) permits online wagering on racing, and on sport other than in-play betting, and online lotteries as "regulated interactive gambling services" (ss 8A, 8E). Other online gambling services offered to customers in Australia are prohibited (s 5), including casino games, poker and in-play sports betting.

Providing a prohibited service to customers in Australia is an offence (5,000 penalty units) and a civil penalty provision (7,500 penalty units), each per day (s 15). Offering a regulated service without a state or territory licence attracts the same penalties (s 15AA). A defence applies only if the operator could not with reasonable diligence have known a customer was in Australia (s 15(3)). ACMA has had 1,822 illegal gambling and affiliate websites blocked since November 2019 (ACMA, 24 September 2026).

State and territory licences

Online bookmakers are licensed by a state or territory. NT licensees include Sportsbet, Ladbrokes, Neds, bet365 and PointsBet. An NT sports bookmaker licence covers racing, declared sporting events and approved novelty events (Racing and Wagering Act 2024 s 122, as in force 22 June 2026), and licensees must comply with the NT Code of Practice for Responsible Service of Online Gambling 2019.

Federal registration

Gambling businesses must apply to AUSTRAC for enrolment within 28 days of starting (AML/CTF Act s 51B, Compilation No. 63, 1 October 2026). Venues entitled to no more than 15 gaming machines, providing only gaming machine services, are relieved of most obligations but must still enrol and report suspicious matters (s 233K).

3. AML, KYC and customer due diligence

Gambling businesses are reporting entities: table 3 of s 6 of the AML/CTF Act covers accepting or placing bets, paying winnings, exchanging money or virtual assets for chips, entry into games of chance and, separately, opening a betting account and allowing transactions on it (items 11 and 13). An "online gambling service" is any table 3 service provided by internet, another carriage service or broadcasting means listed in the Interactive Gambling Act, excluding telephone betting (s 5).

Reformed CDD obligations

The reformed Act and the AML/CTF Rules 2025 (Compilation No. 1, 31 March 2026) apply to existing reporting entities from 31 March 2026 [In force]. A business must not commence a designated service until it has established on reasonable grounds the customer's identity, anyone acting for the customer, beneficial owners of non-individual customers, politically exposed person (PEP) and targeted financial sanctions status, and the nature and purpose of the relationship (s 28(1) and (2)). For individuals it must take reasonable steps to establish that the customer is the person they claim to be, and verify KYC information "using reliable and independent data" appropriate to the customer's risk (s 28(3)). Delivery channel is a mandatory risk factor.

Thresholds: land-based only

Section 39E exempts some land-based gambling services from initial CDD. Casino services under $5,000 (and chip-only exchanges) are exempt only where the service "does not involve online gambling services"; gaming machine play outside casinos and payouts under $5,000 are also exempt. On-course bookmakers and totalisator agency boards (TABs) are exempt for accepting and placing bets, and for payouts and exchanges under $5,000 (items 14 and 15). None of these exemptions covers opening a betting account or transactions on it (items 11 and 13), so account-based online wagering, including through a TAB, requires CDD before the account is opened, and identity verification cannot be deferred (Rules 6-12).

Enhanced due diligence

Mandatory where risk is high, after a suspicious matter report if the relationship continues, for foreign PEPs and for customers in FATF high-risk jurisdictions (s 32). Source of wealth and funds must be established where relevant (Rules 6-21).

Ongoing CDD

Monitoring and updating KYC information (s 30) applies to all customers from 31 March 2026.

Reporting

Suspicious matter reports within 3 business days, or 24 hours for terrorism financing (s 41). Threshold transaction reports within 10 business days for physical currency of $10,000 or more (s 43).

Records

Records of designated services and customer documents kept for 7 years (Part 10). No tipping off (s 123).

Transitional relief

Entities enrolled on 30 March 2026 may keep applying their pre-reform customer identification procedures (ACIP) to defined customer classes, provided their policies name each class and the date it will move to the new framework (required from 1 July 2026) [Optional relief]. The relief ceases to have effect on 31 March 2029 (AML/CTF Transitional Rules 2026 s 7). It does not cover ongoing CDD.

4. Identity verification and onboarding

AUSTRAC's initial CDD guidance for individuals (updated 31 March 2026) sets baseline expectations:

• Collect: full name, other names, date of birth, residential address and any unique identifier such as a passport or licence number.
• Verify name and date of birth: with government-issued photo ID (driver licence, passport, proof of age card, foreign national ID), or non-photo ID plus a secondary document showing name and address.
• Confirm the person is genuine: compare the customer's appearance with the photo ID in person or by video call, or use biometric technology from an identity verification provider.
• Screen: PEP status and the DFAT Consolidated List, using matching that tolerates spelling variations.

Customers who cannot obtain standard evidence may be verified by alternative means if the business has policies to manage the extra risk (Rules 6-10). Collection and verification can be carried out by an agent, but the reporting entity, not the agent, is liable for contraventions (s 37). A business may rely on another reporting entity's CDD under a written, regularly assessed arrangement (ss 37A, 37B).

Age

State and territory laws prohibit gambling by minors. In the Northern Territory, where a child is a person under 18, a wagering licensee that bets with a child commits a strict liability offence carrying up to 2,500 penalty units, with a defence of reasonable belief that the person was 18 or over (Racing and Wagering Act 2024 s 277).

Government verification services

Businesses can check Australian identity documents against issuing records through the Document Verification Service (DVS), reached through an approved gateway provider; it may not be the sole basis for a decision to enrol or refuse a customer (IDMatch, Business user).

5. Digital channels: what's different

Bottom line: opening an online betting account is itself a regulated service that no exemption covers, so identity must be verified, and the customer matched against BetStop, before the account opens.

Verification timing

Since 29 September 2024 online gambling providers have had to complete identification before creating an account (AUSTRAC). Under the reformed Rules, delayed verification (Rules 6-12) still requires identity to be verified first, allows 20 business days for other checks, and bars making funds available until CDD is complete.

BetStop as an identity control

Opening an account for, or providing wagering services to, a person registered on BetStop are civil penalty provisions (IGA s 61MA, s 61KA), subject to a defence of reasonable precautions and due diligence. ACMA's guidelines expect providers to verify that a customer is who they say they are before using the details to query the register, and state that checking the register before opening an account "alone is unlikely to satisfy" the defence. Providers can check before each bet; otherwise customers should have to log back in at reasonably short intervals.

Payments

Licensed online wagering providers must not offer credit or accept payment by credit card or digital currency (IGA Part 2B, s 15C). Under the National Consumer Protection Framework, implemented through state and territory rules, providers must offer deposit limits that cannot be raised on the spot and send monthly activity statements (DSS, Measures 6 and 7). The NT code requires customers to be prompted to set a deposit limit when opening an account, with increases taking effect only after 7 days.

Pending changes

From 1 January 2027 [Adopted, effective 1 Jan 2027], the Interactive Gambling Amendment (Gambling Reform) Act 2026 requires banks and payment system participants to block, so far as reasonably practicable, payments to illegal online gambling services, imposes new duties on internet service and domain name system providers, and treats online keno-type and foreign matched lotteries as outside the lottery exception.

6. Data protection and biometrics

The Privacy Act 1988 and the Australian Privacy Principles govern identity data collected at onboarding. The OAIC's facial recognition guidance (updated 29 July 2026) states that biometric templates and facial images used for automated verification are sensitive information, that implied consent should generally not be relied on to collect them, and that a documented privacy risk assessment should precede deployment.

AML/CTF records must be kept for 7 years. Once identity data is no longer needed for a permitted purpose or required by law, it must be destroyed or de-identified (APP 11.2).

7. Sector-specific obligations

BetStop account handling

Registered customers' accounts must be closed and balances returned. ACMA's May 2026 Entain findings show what "reasonable precautions" means: legal names must match the government identity document exactly, every account a customer holds across a group's brands must be linked, and a new account must not be opened after the register has returned a positive match (ACMA investigation report).

Casino player cards

All casino gaming in New South Wales must be played using a player card from 19 August 2024. Before issue the operator verifies an ID document, records name, date of birth and address, compares the face to the photo and keeps a colour photo; each use is confirmed by face comparison, multi-factor authentication, biometrics or a PIN (Casino Control Amendment Regulation 2024, cl 31F and 31G). In Victoria, casino operators verify name and date of birth or address, either by sighting documents in person or by using the DVS plus a face match to photo ID (Casino Control Regulations 2023, reg 12, with the digital option in reg 12(7A) from 18 April 2026). Queensland's Casino Control Act allows regulations requiring player cards with proof of identity (s 72E, inserted in 2024), but no such regulation was in force as at October 2026.

Inducements and harm monitoring

From 1 January 2027 [Adopted, effective 1 Jan 2027], a new Part 7D of the IGA bars licensed online wagering providers from offering inducements by direct marketing or social media to "designated customers" (accounts open 14 days or less, people who have left BetStop, and customers identified as at risk), and from paying staff, agents or affiliates commissions tied to sign-ups, deposits or bets. Providers must also monitor customer activity to identify people at risk of gambling harm (s 62ZSA, 1,000 penalty units per day).

8. Risk indicators and red flags

AUSTRAC's 2024 money laundering national risk assessment rates betting agencies and corporate bookmakers (now mainly app and web-based) as a medium and stable money laundering vulnerability. It rates casinos high, and online offshore gambling medium, noting that offshore platforms fall outside the AML/CTF regime and increasingly settle in digital currency.

Online betting typologies (AUSTRAC)

• Minimal-play withdrawal: funds withdrawn with little or no betting, or left idle.
• Bowler accounts: third-party betting accounts, including bets structured by syndicates.
• Redirected payouts: winnings paid to a third-party, joint or international account.
• Name mismatch: betting account details differ from the payment method's details.
• Linked accounts: accounts in different names sharing an IP address, device or bank account.
• Hard-to-trace deposits: cash, vouchers or prepaid products from multiple retailers, or third-party deposits.
• Location anomalies: overseas or multi-country log-ins, VPN use or simultaneous sessions.
• Hidden identities: high-risk customers recorded under pseudonyms on the operator's own systems.

Drawn from AUSTRAC's indicators for online betting agencies, its online wagering worked examples (25 March 2026), the national risk assessment and its Entain allegations. Suspecting a customer is not who they claim to be is itself a reporting trigger (s 41(1)(d)).

9. Enforcement and penalties

The Commonwealth penalty unit is $364 for offences and contraventions on or after 1 July 2026 (AUSTRAC applies the unit in force at the time), indexed every three years (Crimes Act 1914 s 4AA; Crimes (Amount of a Penalty Unit) Instrument 2026); state units differ.

AUSTRAC began its first civil penalty proceedings against an online betting operator, Entain Group (Ladbrokes, Neds), on 16 December 2024; the case remained before the Federal Court as at October 2026 (AUSTRAC enforcement actions). On 28 October 2026 the Federal Court ordered The Star to pay $260 million (AUSTRAC). On the BetStop side, ACMA accepted an 18-month enforceable undertaking from Entain after finding more than 500 breaches (ACMA, 6 May 2026), and Dabble paid $1,069,200 for failing to close 157 self-excluded customers' accounts and marketing to them (ACMA, 16 September 2026).

10. Recent changes and what to watch

• 1 January 2027[Adopted, effective 1 Jan 2027]: Gambling Reform Act 2026 schedules commence (payment blocking, advertising and inducement limits, harm monitoring, BetStop penalty increases, online lottery changes).
• 28 October 2026[In force]: The Star ordered to pay $260 million, including for failing to verify high-risk customers' source of funds.
• 22 October 2026[In force]: Picklebet paid a $19,800 penalty for accepting bets from a person who had registered with BetStop hours earlier.
• 6 July 2026[In force]: bet365 enforceable undertaking with AUSTRAC.
• 1 July 2026[In force]: transitional ACIP users must document customer classes and stop dates; the penalty unit rises to $364.
• 18 April 2026[In force]: Victorian casino player cards can be issued using the DVS plus a face match instead of in-person document sighting.
• 31 March 2026[In force]: reformed AML/CTF Act and Rules 2025 apply, with risk-based initial CDD and ongoing CDD for all customers. ACIP relief ceases on 31 March 2029.

11. What this means for identity verification

• Verify at sign-up: before the account opens and the first bet; no payouts to unverified customers.
• Capture exact legal names: BetStop matching depends on names exactly as on the government document.
• Remote methods are recognised: photo ID plus face matching or a video call; DVS checks support but cannot replace the decision.
• Treat biometrics as sensitive information: consent, a privacy assessment and defined retention.
• Re-verify on triggers: payout account changes, activity spikes and enhanced due diligence cases.
• Plan for regional variation: casino player cards in New South Wales and Victoria add their own identity steps.