Writing an AML/CTF program,
for a NSW gaming venue.

Section 26B of the AML/CTF Act defines the AML/CTF program as two components: (a) the reporting entity's ML/TF risk assessment and (b) its AML/CTF policies. They're typically drafted together as one document with two sections, but the obligations they cover — and the statutory provisions they answer to — are distinct.

1. The ML/TF risk assessment (Act ss 26C–26E ↗). The strategic level. A structured analysis of the money laundering, terrorism financing and proliferation financing risks the venue may reasonably face in providing its designated services (s.26C(1)). The steps must be appropriate to the venue's nature, size and complexity (s.26C(2)); the assessment must have regard to customer types, designated services, distribution channels, jurisdictions, related entities, and AUSTRAC guidance (s.26C(3)); and it must be reviewed at least every three years (s.26D(1)(b)). This is what AUSTRAC reviewers spend most of their time on, because it's where the venue demonstrates that it understands its own risk.
2. The AML/CTF policies (Act s.26F). The operational level. The policies translate the risk assessment into rules and procedures the venue applies in practice: customer due diligence (Part 2 of the Act — initial, ongoing, simplified, enhanced), transaction monitoring, reporting (TTRs and SMRs under Part 3), employee due diligence and training, governance and senior-manager oversight (s.26P), independent evaluation (s.26F(4)(f)), record-keeping (Part 10) and AUSTRAC communications. The policies must be reviewed at least every three years (s.26F(3)(d)) and approved by a senior manager. The AML/CTF Rules 2025 Part 5 add detailed content requirements (Divisions 1–5).

Together, the two components make a complete picture: the risk assessment says what the venue is exposed to; the policies say what staff do at the patron-facing surface to mitigate those risks. Each references the other — the risk assessment produces the rules in the policies; the operational evidence the policies generate feeds back into the next risk-assessment review.

The risk-based methodology spans the risk assessment (ss 26C–26E ↗) and the AML/CTF policies (s 26F ↗) — it is where most program weakness shows up under review. Three components, all of which need to be specific to the venue:

1. The risk assessment.A structured analysis of the ML/TF risks the venue actually faces. Inputs include EGM count and category, average and peak cash-handling volumes, patron mix (members vs visitors, geographic catchment, foreign-national exposure), third-party service-provider exposure, and historical incident pattern. Output is a documented risk profile specific to the venue. Generic “clubs face cash- handling risk” doesn't survive review.
2. The risk rating.The framework that weights and scores the assessed risks. This is where high / medium / low (or a numeric scale) gets assigned to specific scenarios — “repeated cash buy-ins by a non-member visitor in a single session” gets a medium rating; “a $5,000-or-more gaming-machine cash-out by a non-member visitor with a refusal-of-CDD pattern” gets a high rating (initial CDD is triggered by the cash-out under s.39E item 17, and refusal is one of AUSTRAC's published ML indicators). The rating framework should be reproducible — two AMLCOs running the same input should produce the same rating.
3. The mitigation procedures. What controls the venue applies to each rated scenario. High- rated situations might trigger enhanced CDD, transaction monitoring on the patron, escalation to the AMLCO, or SMR consideration. Medium-rated situations might trigger ongoing monitoring without escalation. The mitigation procedures are the rules that produce alerts; the rules that produce alerts are what defendable transaction-by- transaction explanations land on.

Under the post-reform Act, the AMLCO must be able to show — for any specific transaction — which rule in the methodology fired, what threshold was met, what data triggered it, and what disposition was applied. This traceability is what the program's record-keeping obligations (Act s.116 — records relating to Part 1A; s.111 — CDD records) and transaction-monitoring duties produce in combination. Methodology documents that can't support that traceability fail evaluation.