Travel & Hospitality Compliance in Australia

Australia's travel and hospitality market is open to online operators, and there is no Commonwealth licence for selling travel or accommodation. Identity obligations come from four directions instead: border law for carriers and their passengers, the anti-money laundering regime for currency exchange, the Privacy Act for everything a business collects, and voluntary government identity services that businesses may connect to.

The principal Commonwealth bodies are the Department of Home Affairs and the Australian Border Force (ABF) for visas and passenger data, AUSTRAC for currency exchange and cross-border cash, and the Office of the Australian Information Commissioner (OAIC) for privacy and biometrics. For a new entrant the biggest obstacle is usually not a licence but data handling: collecting the passport details that the law requires carriers to report, while not over-collecting where the law does not require it.

1. Who regulates this sector

State and territory governments regulate liquor licensing, short-term rental accommodation and fair trading. Section 4 summarises the state and territory rules that touch guest and patron identity.

2. Licensing and authorisation

No Commonwealth licence is required to sell flights, accommodation or tours, online or in a shop, and none of these activities is a designated service under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). Authorisation attaches to particular activities instead.

3. AML, KYC and customer due diligence

Hotels, travel agents, tour operators and online travel agencies are not reporting entities merely because they sell travel. The AML/CTF Act even excludes safe deposit facilities offered by a business providing short-term accommodation for travellers (s 6, table 1, item 47). The regime applies to a travel business when it provides a designated service, most commonly currency exchange.

Initial customer due diligence

Under the reformed AML/CTF Act (Compilation No. 63, 1 October 2026), a currency exchange provider must not start a service until it has established on reasonable grounds the customer's identity, anyone acting for the customer and their authority, beneficial owners of non-individual customers, politically exposed person (PEP) and targeted financial sanctions status, and the nature and purpose of the transaction (s 28(2)). For individuals it must take reasonable steps to establish that the customer is who they claim to be, and verify KYC information "using reliable and independent data" as appropriate to the customer's risk (s 28(3)). The delivery channel is a mandatory factor in rating that risk (s 28(4)(d)).

The A$1,000 exemption

Initial due diligence does not apply to a currency exchange under A$1,000 where the currency moves into or out of a bank account, or where the exchange is funded or paid out in physical currency outside a bank account, unless the provider has an enhanced due diligence obligation for that customer (s 39E, items 9 and 10).

Reporting and records

Cross-border cash

Whether or not it is a reporting entity, anyone who moves physical currency or bearer negotiable instruments worth A$10,000 or more into or out of Australia must report it (s 53). Commercial passenger carriers are not liable for cash held by their passengers (s 53(4)), but the person in charge of an inbound aircraft or ship must give passengers the prescribed notice of the reporting obligation (s 62).

Transitional position

Under the AML/CTF Transitional Rules 2026 (ss 7 and 8), a reporting entity may keep using customer identification procedures that met the Rules in force on 30 March 2026, for classes of customer named in its policies with a stop date for each class (required from 1 July 2026). The relief ceases to have effect on 31 March 2029 and does not cover ongoing due diligence, which applied from 31 March 2026.

4. Identity verification and onboarding

Passengers: the passport is the identity document

The Migration (Approval of Primary and Fall-back Reporting Systems: International Passenger Aircraft) Instrument 2025 approves the Advance Passenger Processing (APP) system and lists what is reported for each passenger: document type and number, nationality code, the first four characters of the family name, flight and ports, with full name, date of birth and sex for some categories. The ABF's APP manual (April 2025) requires details to match the travel document exactly and prohibits dummy data. Each check-in returns a board or do-not-board directive, and a "contact" response means the passenger may not board without the Border Operations Centre's permission.

Visitors: app-based chip reading and a live photo

ETA (subclass 601) applicants with an eligible passport must use the Australian ETA app, which needs a camera for the applicant's photo and the passport data page and Near Field Communication (NFC) to read the passport chip. The service charge is A$20. Each person, including family members on the same passport, applies separately; anyone helping must be physically with the applicant, and an industry representative must take the live facial image, without which Home Affairs will not grant the visa. ETA details that do not exactly match the passport can cause boarding delays or refused entry. For other visas, applicants in listed countries can supply passport chip data and a live facial image through the Australian Immi App instead of attending a biometrics collection centre.

Currency exchange customers

AUSTRAC's guidance on initial due diligence for individuals (31 March 2026) gives baseline examples: collect full name, date of birth, residential address and any unique identifier; verify name and date of birth with a government photo ID, or a non-photo document plus a secondary document; and confirm the customer is who they claim to be by comparing them with their photo identity document in person, in a video call, or by "biometric technology" such as a solution from an identity verification provider, or, for non-photo documents, by a reference from an independent and reliable source. Delayed verification is possible only in circumstances set by the AML/CTF Rules 2025 (for most services provided in Australia, r 6-12), and under r 6-12 the customer's identity must still be established first and no funds released.

Guests

No Commonwealth law requires a hotel to verify guest identity. Australian Privacy Principle (APP) 2 lets individuals deal anonymously or under a pseudonym unless the law requires identification or it is impracticable, and APP 3 limits collection to what is reasonably necessary. State and territory laws add duties for some venues and hosts (table below). Businesses can use the government Document Verification Service through an approved gateway provider (2,109 private sector users in 2024-25), but should not use it as the sole basis for a decision.

Short-term rental laws in Victoria, Tasmania, Western Australia and the ACT govern levies, listings and premises registration, not guest identity.

5. Digital channels: what's different

Bottom line: the obligations are largely channel-neutral, but the government's own processes are now app-first, and where identity has to be confirmed online, AUSTRAC's examples replace in-person face comparison with a video call or a biometric check.

Remote confirmation of identity

The AML/CTF Act does not require face-to-face service but makes the delivery channel a risk factor (s 28). For customers with photo ID, AUSTRAC's guidance gives a video call or biometric technology as the online ways to compare the person with the document; for non-photo ID, it gives a reference from an independent and reliable source.

Consent is easier online

The OAIC's facial recognition guide (29 July 2026) says consent is most practical where a business can contact each person before they arrive, for example through a booking. Contactless check-in should therefore seek consent at booking.

Digital arrival declaration

The Australia Travel Declaration [Funded, rollout by end 2027] is a digital alternative to the paper incoming passenger card, which most arriving passengers must still complete. It is available in the Qantas app and, for flights into Western Sydney International Airport, as a web form submitted up to 72 hours before arrival. The ABF announced on 13 July 2026 that it will reach all international airports and seaports before the end of 2027.

6. Data protection and biometrics

The Privacy Act 1988 (Compilation No. 104, 4 June 2026) applies to businesses with annual turnover above A$3 million and to some smaller ones, for example those that trade in personal information (s 6D). Smaller accommodation providers may fall below the threshold, but every party to an Identity Verification Services participation agreement that is not covered by the Privacy Act must agree to comply with the APPs (Identity Verification Services Act 2023 s 9(1)).

• Biometrics are sensitive information. The OAIC treats facial images and templates used for automated verification or identification as sensitive information, which needs consent and a reasonable necessity, or a narrow exception. It expects a privacy impact assessment first; convenience alone does not make collection necessary.
• Express consent for government checks. Participation agreements for the Identity Verification Services must provide for express consent to the use of identification information (IVS Act s 9(2)). Private requesters of a face verification receive only a match or no-match result, never the government facial image (s 19).
• Destroy what is not needed. APP 11.2 requires personal information no longer needed for a permitted purpose to be destroyed or de-identified unless a law requires retention.
• Passenger data is compelled. APP and passenger reports must be given even where the information is personal information (Migration Act s 245L; Customs Act s 64ACA notes). PNR data processed in the EU moves under the Australia-EU PNR Agreement (in force since 1 June 2012).

7. Sector-specific obligations

Border identity processing

SmartGates use facial recognition with the passport to check identity on arrival and departure. On arrival, travellers on any valid passport may try them if they are at least 1.1 metres tall and seven years old; unaccompanied children under 16 are not eligible (ABF, 1 October 2026). Separately, a police or protective service officer at a major airport may direct a person to give evidence of identity, preferably a government photo ID, on reasonable suspicion of an offence punishable by 12 months' imprisonment or more, or to safeguard airport operations (Crimes Act 1914 s 3UP).

Sanctions

Dealing with a person on DFAT's Consolidated List is a serious criminal offence, with up to 10 years' imprisonment for individuals. Assets of listed persons must be frozen and reported to the Australian Sanctions Office and the Australian Federal Police. Currency exchange providers must check sanctions status before serving a customer (AML/CTF Act s 28(2)(e)).

8. Risk indicators and red flags

Travel and hospitality indicators

• Split exchanges: repeated cash purchases just under A$10,000, which may be structuring (AML/CTF Act s 142), or repeated purchases just under the A$1,000 due diligence exemption.
• Name mismatch: booking or check-in details that differ from the passport; APP reports must match the travel document.
• Identity doubt: a customer or agent who may not be who they claim to be, a suspicious matter trigger (s 41).
• Undeclared cash: travellers carrying or concealing A$10,000 or more without a report. AUSTRAC's 2024 national risk assessment rates undeclared cash smuggling a high vulnerability and notes that air-passenger amounts are often structured to avoid reporting.
• Declared but unexplained cash: AUSTRAC rates declared cash movement a medium vulnerability because a declaration can lend illicit cash a veneer of legitimacy.
• Cancelled passport: an Australian passport reported lost or stolen is cancelled, border authorities are notified, and it cannot be used again even if recovered.
• Third-party ETA lodgement: an application lodged by a helper or agent without the applicant physically present.
• Impersonation of support staff: calls posing as IT help to contact-centre agents, the route of the 2025 Qantas breach.
• Sanctions hit: a customer or beneficial owner on the DFAT Consolidated List.

9. Enforcement and penalties

Commonwealth penalties are set in penalty units. A unit is A$364 for offences committed on or after 1 July 2026 (Crimes (Amount of a Penalty Unit) Instrument 2026). For criminal offences, a court may fine a body corporate up to five times the individual maximum unless the law says otherwise (Crimes Act 1914 s 4B(3)).

Lower-level breaches can be settled without prosecution. Customs and police officers may issue infringement notices for unreported cross-border cash (AML/CTF Act s 184), and the Migration Regulations may let a carrier pay a prescribed penalty instead of prosecution: up to 10 units for a strict liability passenger reporting offence and up to 100 units for a body corporate carrying a passenger without a visa (Migration Act s 504(1)(j) and (jaa)). On the privacy side, the OAIC reported on 16 July 2026 that the 2025 Qantas breach, which exposed about 5.67 million customer records (affecting about 5.12 million Australians) after an attacker impersonated IT support to an overseas contact centre, did not warrant an investigation. The OAIC's first compliance sweep, from January 2026, covered privacy policies of car rental companies and licensed venues, with infringement notices of up to A$66,000.

10. Recent changes and what to watch

• 10 December 2026:[Adopted, effective 10 Dec 2026] privacy policies must describe decisions made or substantially informed by computer programs that significantly affect individuals (APP 1.7 to 1.9).
• 1 December 2026:[Adopted, effective 1 Dec 2026] businesses can apply to the ACCC to join the Australian Government Digital ID System, because the Digital ID Act 2024 opens applications two years after its 30 November 2024 start (s 61(d)). Members must keep an accessible route that needs no Digital ID unless the ACCC grants an exemption (s 74).
• November 2026 to June 2027:[Scheduled] the FATF mutual evaluation of Australia, the first since April 2015, has its onsite visit in November 2026 and Plenary discussion in June 2027.
• 29 July 2026:[In force] the OAIC updated its facial recognition guide after the Administrative Review Tribunal's Bunnings decision of 4 February 2026, which the Commissioner did not appeal. The separate Kmart determination remains under review, with hearings scheduled for early 2027.
• 13 July 2026:[Funded, rollout by end 2027] the Australia Travel Declaration will replace the paper incoming passenger card nationally.
• 1 July 2026:[In force] the Commonwealth penalty unit rose to A$364, lifting every maximum in section 9 that is set in penalty units.
• 31 March 2026:[In force, transitional relief to 2029] the reformed AML/CTF due diligence obligations commenced; legacy identification procedures may be used for customer classes named in AML/CTF policies until the relief ceases on 31 March 2029.
• 24 September 2025:[In force] new instruments approving the passenger and crew reporting systems for international aircraft and cruise ships replaced the 2015 approvals.

11. What this means for identity verification

• Documents: the passport (with its chip) is the working document for travel. Capture it once, accurately, because carrier reports must match it character for character.
• Remote methods: for currency exchange, pair document verification with one of AUSTRAC's examples for showing the customer is the document holder: a video call or a biometric face comparison for photo ID, or an independent reference for non-photo ID.
• Consent and purpose: collect face images only for a defined purpose, obtain consent at booking, run a privacy impact assessment, and set deletion rules under APP 11.2.
• Thresholds: build the A$1,000 exemption and A$10,000 reporting line into currency flows, and flag repeated near-threshold activity.