A withdrawal I requested in mid-2025 sat in “processing” for nine days. When I contacted support, the agent said my account was under a routine AML review. No further details, no timeline, just “routine review.” Nine days later, the withdrawal cleared without explanation. That experience — opaque, frustrating, and ultimately benign — is what AML/CTF compliance looks like from the player’s side. Behind the scenes, anti-money laundering rules impose real obligations on casino operators, and the 2025 amendment to Australia’s AML/CTF Act raised the stakes significantly for non-compliance.
Updated AML/CTF amendments passed in late 2025 pushed corporate penalties for non-compliance to AUD 2.2 million per violation, with potential licence revocation for systemic failures. These are not theoretical numbers — AUSTRAC has demonstrated willingness to pursue enforcement action against gambling operators, and the 2025 amendment expanded both the scope of reporting obligations and the severity of penalties.
The 2025 AML/CTF Amendment: Key Changes
I read the amendment documentation and its explanatory memorandum to understand what actually changed. The 2025 AML/CTF amendment did three things that matter for casino operations. First, it expanded the definition of “designated services” to capture a wider range of gambling transactions, including some that previously fell into grey areas around digital payment methods. Second, it increased the maximum penalty for each contravention to AUD 2.2 million for corporations, creating a financial deterrent proportional to the revenue scale of large gambling operators. Third, it strengthened the suspicious matter reporting requirements, lowering the threshold for what constitutes a reportable transaction.
For licensed Australian operators — bookmakers and any future licensed online casinos — the amendment’s requirements are directly enforceable through AUSTRAC. For offshore operators accepting PayID deposits from Australians, the situation is more nuanced. These operators are not registered with AUSTRAC and are not directly subject to Australian AML/CTF law. However, their payment processors — the entities that hold Australian bank accounts and receive NPP payments — are subject to Australian banking regulations, creating an indirect compliance pathway that affects how deposits and withdrawals are handled.
The practical result for players: AML-related delays and document requests are becoming more common, not less. The amendment’s expanded reporting requirements mean that casino operators and their payment processors flag more transactions for review, apply enhanced due diligence to a wider range of player profiles, and take longer to process withdrawals when the automated compliance systems trigger an alert.
How PayID’s Traceability Supports AML Compliance
PayID deposits create an unusually clean audit trail for AML purposes. Every transfer carries the sender’s bank-verified name, the amount, the timestamp, and the recipient’s PayID identifier. Confirmation of Payee — used more than 100 million times since its July 2025 launch — adds a pre-transfer name-matching check that further validates the identity chain. For a compliance officer reviewing transaction records, a PayID deposit is far easier to verify than a card payment or cryptocurrency transfer because the banking system has already authenticated the sender’s identity.
Anna Bligh, CEO of the Australian Banking Association, noted that banks are investing in new technologies so customers have another important layer of protection against scammers, and that they are one step closer to having a new weapon in the fight against financial crime. While her comments were directed at the broader Confirmation of Payee rollout rather than gambling specifically, the same infrastructure benefits AML compliance at casinos. A deposit that arrives via PayID with a name-verified sender is a lower AML risk than an anonymous crypto deposit or a card payment where the cardholder’s identity is less directly tied to the funding source.
This traceability can work in the player’s favour. When a casino’s AML team reviews your account, PayID deposits demonstrate a clear, bank-verified funding source that matches your KYC documents. The identity consistency between your PayID registration and your casino account simplifies the compliance review and can shorten the processing time for flagged withdrawals compared to accounts funded through less transparent methods.
What AML Rules Mean for Your Deposits and Withdrawals
The most visible impact of AML compliance on players is withdrawal delays. When a casino’s automated compliance system flags a withdrawal — based on amount, frequency, player profile, or behavioural patterns — the withdrawal enters a manual review queue. This review can take anywhere from 24 hours to several weeks, depending on the casino’s compliance team capacity and the complexity of the flag. During this time, the player typically cannot access the flagged funds.
Deposits are less commonly affected by AML delays because the compliance risk profile of an incoming payment is lower than an outgoing one. The casino wants your deposit; it is the withdrawal — where money leaves the platform — that triggers AML scrutiny. However, a pattern of rapid, high-value deposits followed by minimal play and an immediate withdrawal request will trigger a money-laundering flag at any competently run compliance system. This pattern mirrors the structure of laundering transactions, and even legitimate players who happen to deposit and withdraw in this pattern may face additional verification requirements.
Source-of-funds requests are the other common AML touchpoint. If your cumulative deposits exceed a threshold — which varies by casino but typically sits between A$5,000 and A$20,000 — the compliance team may request documentation proving the legitimate origin of your funds. Payslips, tax returns, and bank statements showing the source of the deposited amounts are standard requests. Having these documents ready prevents delays when the request arrives.
Penalties for Non-Compliant Operators
The AUD 2.2 million per-violation penalty is the headline, but the enforcement framework is broader. AUSTRAC can impose civil penalties, seek court orders for ongoing non-compliance, and refer matters for criminal prosecution in severe cases. Licence revocation — the ultimate sanction — ends an operator’s ability to legally offer gambling services. For offshore operators outside AUSTRAC’s direct jurisdiction, the enforcement pressure comes through their Australian banking relationships: a payment processor found facilitating non-compliant transactions risks losing its own banking access, which effectively cuts the casino off from Australian deposits.
Players cannot directly influence whether a casino complies with AML rules, but they can observe the indicators. Casinos that conduct KYC verification promptly, process withdrawals within stated timeframes, and request source-of-funds documentation at appropriate thresholds are demonstrating functional compliance. Casinos that never ask for documents, process large withdrawals instantly without review, or fail to verify identity at all are either non-compliant or operating outside any meaningful regulatory framework — a red flag for the security of your deposited funds.
