ONLINE WAGERING COMPLIANCE & REGULATORY SUPPORT
Keep your online wagering business compliant as regulation evolves
HCPA helps wagering operators manage the regulatory frameworks, policies and operational controls needed to meet licensing, responsible gambling and AML/CTF obligations.
Online wagering compliance extends well beyond maintaining a wagering licence. Operators need to manage customer safeguards, financial crime risks, wagering systems, marketing requirements and the conditions attached to racing and sporting products.
When online wagering compliance issues need immediate attention
A compliance issue does not always begin with formal enforcement. It can surface through a failed customer safeguard, unusual transaction activity, an internal review, a regulator request or a problem with a wagering system or campaign.
The priority is to understand the requirement involved, contain any immediate risk and determine whether the problem sits in the policy, technology, staff process or broader governance framework.
Responsible gambling or BetStop issues
Problems can arise where safeguards do not identify risky customer behaviour, self-exclusion controls fail or marketing reaches a person who should not receive it. If a BetStop or responsible gambling control fails, the operator needs to address the affected customer or activity first, then identify how the failure occurred. That may involve customer matching, system configuration, staff processes or the way marketing suppression rules are applied.
AML/CTF and reporting failures
Unusual transactions, identity concerns or suspected use of stolen payment methods can create AML/CTF obligations. A missed escalation, weak transaction monitoring or uncertainty about suspicious matter reporting should be reviewed promptly. The operator needs to establish what occurred, whether reporting is required and whether the underlying monitoring or escalation process needs to change.
Licence or system compliance findings
A licensing authority may identify problems with wagering systems, policies, licence conditions or other operating controls. An internal review can uncover the same types of issues before formal regulatory action occurs. In either case, the response should address the specific requirement and the control that failed rather than treating the issue simply as a documentation update.
Advertising or customer safeguard breaches
Marketing, inducements, prohibited payment methods and other customer protections are subject to specific wagering rules. If a campaign, offer or customer process is found to conflict with current requirements, operators should stop or correct the affected activity, assess who or what was impacted and update the approval process that allowed the issue to occur.
Key online wagering compliance requirements
Effective wagering compliance management needs to connect the licence, customer journey, transaction monitoring, marketing and day-to-day operation of the platform.
These controls also become the evidence an operator relies on if an incident, complaint or regulatory review occurs. The aim is not simply to have policies in place, but to be able to show that the required processes are working.
Responsible gambling and customer safeguards
Responsible gambling compliance needs to be built into customer interaction, staff training and the systems used to identify and respond to potential harm.
The national framework includes responsible service training for relevant staff, activity statements and consistent harm-minimisation messaging. Licensed interactive wagering providers must also integrate BetStop, with ACMA guidance covering how providers should check the register and prevent excluded customers from wagering or receiving prohibited direct marketing.
ACMA’s BetStop guidance explains the controls providers should consider.
Operators should also have an escalation process for situations where a safeguard does not work as intended, including how the incident is investigated, documented and corrected.
Customer identification and verification
Online wagering providers must verify a new customer’s identity before the customer can place a bet.
The onboarding process therefore needs to prevent an unverified customer from progressing into wagering activity and provide a clear exception pathway where verification cannot be completed normally.
If an unverified customer is able to wager, the operator should investigate both the individual incident and the system or process that allowed the control to be bypassed.
AML/CTF programs and transaction monitoring
Wagering operators that provide designated services have ongoing obligations under Australia’s AML/CTF regime.
AUSTRAC’s ongoing customer due diligence requirements require reporting entities to monitor customers for unusual transactions and behaviour, reassess risk where appropriate and keep customer information current.
The AML/CTF regime was also updated in 2026, so existing frameworks should be reviewed against the current requirements rather than relying on older policies.
Where monitoring identifies a potential gap, operators should establish whether the issue is isolated or reflects a broader weakness in customer risk assessment, transaction monitoring or escalation.
Suspicious matter reporting
Transaction monitoring needs a clear escalation pathway when behaviour raises reasonable grounds for suspicion.
AUSTRAC’s suspicious matter reporting guidance covers situations including suspected criminal activity, identity concerns and unusual customer behaviour. The internal process should make it clear who investigates an alert, who decides whether an SMR is required and how the decision is documented.
If reporting has been delayed or an alert was not escalated correctly, review why the process failed and whether similar matters may also need attention.
Advertising, inducements and payment controls
Wagering advertising operates within a combination of Commonwealth, state and territory requirements.
The Interactive Gambling Act already regulates online wagering services, advertising, credit and BetStop, while credit cards, credit-linked digital wallets and cryptocurrency have been prohibited for online and telephone wagering deposits since June 2024.
Operators should review campaigns, promotional mechanics, customer segmentation and approval processes ahead of regulatory changes. Where non-compliant activity has already occurred, the response should address both the immediate campaign and the approval control that allowed it through.
Licence, racing and sporting requirements
Online wagering operators can have obligations beyond their primary wagering licence.
This may include approved wagering systems, race field arrangements and agreements with relevant sporting bodies. In the Northern Territory, for example, a sports bookmaker or betting exchange operator must meet licence conditions including approval of its wagering control system, terms and conditions, responsible gambling training and BetStop registration before operating.
Changes to wagering products, systems or commercial arrangements should therefore trigger a review of the approvals and conditions that apply. If a regulator or rights holder identifies a problem, operators need to establish whether the issue affects only one approval or has consequences elsewhere in the operating model.
Keeping your wagering compliance systems current
Online wagering operators can face oversight from several bodies rather than one regulator conducting one standard audit.
Licensing authorities can review wagering systems and licence conditions, while AUSTRAC oversees AML/CTF obligations and ACMA regulates areas including the Interactive Gambling Act, BetStop and federal online wagering protections.
Operators should therefore be able to produce current evidence covering areas such as:
responsible gambling policies and procedures
BetStop and self-exclusion controls
customer identification and verification
AML/CTF risk assessments and programs
transaction monitoring and SMR processes
staff training
wagering system controls
advertising and promotional activity
licence conditions and approvals
racing and sporting agreements
Responsible gambling and AML/CTF are areas where outdated policies, weak monitoring or a gap between documented procedures and actual practice can create significant compliance issues.
Internal reviews can help identify those gaps before regulatory intervention. Where a problem has already been identified, the same review process can help determine its extent and what needs to be remediated.
Internal reviews can help identify those gaps before regulatory intervention. Where a problem has already been identified, the same review process can help determine its extent and what needs to be remediated.
Speak with an HCPA online wagering consultantWhat to do after an online wagering compliance breach
Understand the breach
Confirm the licence condition, legislative requirement or customer safeguard involved and what the regulator expects you to address.
Contain the immediate risk
Correct any active issue affecting customers, transactions, marketing or wagering activity while preserving the relevant evidence.
Fix the underlying control
Update the policy, system, training or operational process that allowed the problem to occur and confirm who is responsible for implementing the change.
Evidence the remediation
Document what changed, how affected matters were handled and what monitoring or controls will reduce the risk of recurrence.
Why choose HCPA for online wagering compliance?
Online wagering operators may need support maintaining compliance before an issue arises or responding quickly once a gap has been identified.
HCPA can help operators review AML/CTF and responsible gambling frameworks, update policies and operating controls, investigate compliance gaps and prepare practical remediation where a regulator, audit or internal review identifies a problem.
businesses supported
industry consultants
billion in client revenue
HCPA combines industry-specific compliance support with broader experience across regulated businesses, helping operators keep systems current and respond constructively when compliance issues arise.
Frequently asked questions about online wagering compliance
How can an online wagering operator manage responsible gambling, customer verification and advertising obligations across Australia?
Treat these requirements as connected operational controls rather than separate policies.
Customer onboarding should verify identity before wagering begins, BetStop checks and responsible gambling safeguards should continue throughout the relationship, and marketing systems should prevent communications that breach self-exclusion or advertising rules.
Operators should also test these controls and have a clear escalation process for failures rather than relying only on written policies.
What should an online wagering business do when a regulator identifies a breach of its licence conditions or customer safeguards?
Start by identifying the exact requirement involved and whether the problem is still affecting customers or wagering activity.
Contain the immediate issue, preserve relevant records and then determine whether the cause sits in the policy, system configuration, staff process or governance controls.
The response should demonstrate both how the breach was remediated and what has changed to reduce the risk of recurrence.
Which regulators oversee online wagering compliance in Australia?
There is no single regulator responsible for every obligation.
Operators can be subject to their state or territory licensing authority, ACMA under the federal interactive gambling framework and AUSTRAC for AML/CTF obligations. Racing authorities and sporting bodies may also impose requirements through race field or product agreements.
For many bookmakers licensed in the Northern Territory, the primary licensing authority is now the NT Wagering Commission.
Does an online wagering operator need to verify a customer before they can bet?
Yes.
Mandatory customer pre-verification requires wagering providers to verify the identity of a new account holder before allowing them to place a bet.
If an unverified customer is able to wager, the operator should investigate both the customer-level issue and the onboarding control that failed.
What responsible gambling controls should an online wagering operator maintain?
The controls depend on the applicable licence and regulatory requirements, but important areas include BetStop integration, customer monitoring, staff training, activity statements, deposit-limit functionality and procedures for responding to indicators of gambling-related harm.
Operators should also have documented escalation and remediation processes for situations where a safeguard fails or customer harm is identified.
What AML/CTF issues commonly create wagering compliance risk?
Common risks include weak customer due diligence, inadequate transaction monitoring, failure to escalate unusual behaviour and missed suspicious matter reporting.
These issues often become more serious when the business cannot show how alerts were investigated, decisions were made or corrective action was implemented.
What should an operator do if it identifies suspicious wagering or payment activity?
Follow the operator’s AML/CTF escalation process and assess whether there are reasonable grounds for suspicion.
Where the legal threshold is met, a suspicious matter report needs to be submitted to AUSTRAC within the applicable timeframe.
The business should retain the investigation and decision-making records and review whether the activity exposed any weakness in its monitoring controls.
Can online wagering businesses accept credit cards or cryptocurrency?
No, not for deposits into online or telephone wagering accounts.
Since 11 June 2024, operators have been prohibited from accepting credit cards, credit-linked digital wallets and digital currency such as cryptocurrency for these wagering services.
If a prohibited payment method is accepted, the operator should investigate how it bypassed the payment controls as well as addressing the individual transaction.
Are wagering advertising rules changing?
Yes.
Australia passed major amendments to the Interactive Gambling Act in August 2026 covering wagering advertising, inducements and related safeguards. Although the Act has received Royal Assent, the substantive schedules commence on 1 January 2027.
Operators should review advertising, promotional and approval processes before the commencement date so required changes are operational rather than left until a breach occurs.
What happens if a customer registered with BetStop is allowed to wager?
This can expose the operator to regulatory action.
Licensed providers must have effective controls to prevent registered individuals from opening or accessing wagering accounts and from receiving prohibited marketing.
The operator should contain the immediate issue, identify how the customer bypassed the safeguard and correct the underlying matching, technology or operational control.
How often should online wagering compliance policies be reviewed?
There is no single review interval that replaces the need for ongoing monitoring.
Policies should be reviewed when legislation, licence conditions, regulatory guidance, business systems or wagering products change, and whenever an incident or audit identifies that an existing control is no longer working as intended.
An incident should also trigger a review of the relevant control even where the written policy itself has not changed.
Related online wagering resources
Starting an online wagering business
Ready to turn your wagering concept into a licensed operation?
Growing your online wagering business
Looking to build your customer base and strengthen your market position?
