An independent audit or review is an assessment of a gambling operator's compliance systems by an external party who has not been involved in the design, implementation or operation of those systems . In Australia, the ACMA, AUSTRAC and state and territory gambling regulators may require or commission different forms of independent scrutiny. These range from audits imposed through enforcement action to recurring independent evaluations required under the AML/CTF regime.
Independent reviews are becoming a standard part of how regulators respond to compliance concerns. For wagering operators, casinos, clubs and hotels, the practical question is the same: who will review your systems, and will the regulator accept their independence and findings?
Not all independent oversight is the same
The terminology and purpose differ between regulatory regimes:
Independent audit: generally examines specified systems, controls or suspected compliance failures against defined terms of reference.
Independent evaluation: the recurring assessment required as part of an AML/CTF program.
Independent inquiry or review: generally examines broader matters such as suitability, governance, culture or regulatory compliance.
Manager, special manager or monitor: provides continuing oversight and, depending on the statutory framework and appointment, may exercise operational or supervisory functions.
Which regulators can require an independent audit?
Three groups of regulators regularly use independent audits and reviews, each under its own law and for different participants in the gambling industry.
| Regulator | Who it applies to | How an independent review arises |
|---|---|---|
| ACMA | Licensed online wagering operators | An enforceable undertaking or remedial direction under the Interactive Gambling Act 2001, often after a BetStop breach |
| AUSTRAC | Gambling businesses that are reporting entities and required to maintain an AML/CTF program, including wagering operators, casinos, clubs and hotels with gaming machines | An external audit ordered by AUSTRAC under section 162 of the AML/CTF Act 2006, and the routine independent evaluation every program needs with frequency relevant to the size and complexity of the business, but at least every 3 years |
| State and territory gambling regulators | Depending on the relevant legislation, casinos, gaming venues and state-licensed wagering operators | Through statutory inquiries, licence conditions, compliance reviews, expert reports, or the appointment of managers, special managers, monitors or other external oversight arrangements |
How do ACMA independent audits work for wagering operators?
The ACMA uses independent audits as part of a remedial direction or other enforcement outcome. The audit commonly examines the causes of the identified breach, the design and operation of the operator’s compliance systems, the involvement of third-party systems and the adequacy of remediation, most often in relation to BetStop obligations. The ACMA generally publishes its investigation outcomes, including the remedial directions it issues. To date in 2026 alone, it has published the outcomes of a dozen BetStop investigation findings.
The precise requirements depend on the direction or undertaking, but under a typical ACMA remedial direction, the operator must:
1. Nominate an auditor within 30 days, with draft terms of reference (covering matters prescribed by the ACMA), for the ACMA's approval.
2. Have the audit completed within 3 months of the auditor being approved.
3. Provide the report to the ACMA within 10 days of receiving it.
4. Implement the recommendations within 6 months.
5. Provide a status report back to the ACMA within 30 days after that.
The audit looks beyond the original breach. It assesses whether the operator's systems, processes and third-party platforms are designed to ensure compliance, how well they work in practice, and how effective any remedial action has been.
How do AUSTRAC external audits and AML/CTF evaluations work?
AUSTRAC uses independent evaluations/reviews in two ways: as an enforcement tool when it suspects a breach, and as a routine requirement for every AML/CTF program.
• External audits. Under section 162 of the AML/CTF Act 2006, AUSTRAC can require a reporting entity to appoint an external auditor where it has reasonable grounds to suspect non-compliance. The auditor must be authorised by AUSTRAC, and the operator pays for the audit. Recent notices have given operators 14 days to appoint an auditor and around 180 to 200 days for preparation of the report. AUSTRAC has used this power across the sector, including for online wagering operators, casinos and a NSW club.
• Independent evaluations. Since the AML/CTF reforms took effect on 31 March 2026, every reporting entity must have its AML/CTF program independently evaluated with frequency relevant to the size and complexity of the business, but at least once every three years. This replaces the old independent review of Part A of the program and is broader in scope. The AML/CTF Transitional Rules 2026 set staggered deadlines for first evaluations.
For gambling businesses subject to the AML/CTF program requirements, independent evaluation is now a planned, recurring element of compliance, rather than only a response to regulatory enforcement.
How do state and territory regulators use independent reviews?
State and territory regulators rely on independent inquiries, expert reviews and external oversight arrangements, particularly in the casino sector. Although these mechanisms differ from a conventional compliance audit, they reflect the same broader regulatory expectation: important claims about remediation, governance and control effectiveness should be supported by independent evidence. Recent examples include:
• Victoria. Following the Royal Commission into the Casino Operator and Licence, a Special Manager oversaw Crown Melbourne's remediation for two and a half years, and the VGCCC relied on independent expert reports in deciding Crown's suitability in 2024.
• New South Wales. Independent inquiries into The Star’s suitability were conducted in 2022 and 2024. Following the 2022 inquiry, The Star’s casino licence was suspended and a Manager was appointed to operate the casino under regulatory oversight while remediation continued.
• Queensland and Western Australia. Both states have used external reviews and inquiries into their casino operators, and the NSW manager was also appointed Special Manager in Queensland.
For gaming venues and state-licensed wagering operators, independent reviews more often arise through licence conditions, compliance reviews and AML/CTF obligations. The common thread is that regulators increasingly expect operators to show, through independent evidence, that their controls work.
What do regulators look for in an independent auditor?
Regulators look for three things in an independent auditor: the right qualifications, genuine independence from the operator, and experience relevant to the review. Where approval is needed, the operator nominates but the regulator decides.
• Qualifications. The ACMA asks for the proposed auditor's name and qualifications. AUSTRAC must authorise an external auditor before they can act.
• Independence. The ACMA asks for a statement on any prior or existing relationship and any conflicts of interest. For AML/CTF evaluations, AUSTRAC expects the evaluator to exercise independent judgement and not be responsible for implementing or maintaining the program.
• Relevant experience. Both the ACMA and AUSTRAC ask for a description of the auditor's experience against the scope of the audit.
If the ACMA does not approve a nomination, the operator must propose another auditor within 30 days, and the clock starts again. Independence deserves particular care: a person who designed, implemented or currently maintains the framework under review may not be sufficiently independent to evaluate it objectively. Prior advisory work does not necessarily prevent an appointment, but its nature and significance should be disclosed and carefully assessed against the relevant regulatory requirements and terms of reference.What do independent reviews focus on?
Independent reviews test whether controls work in practice, not just whether they exist on paper. Common focus areas include (for example):
• BetStop controls (wagering). Whether identity is verified before register checks, whether repeat sign-up attempts with changed details are caught, and how often existing customers are re-checked. The December 2025 Statutory Review of BetStop identified circumvention and data-matching as key concerns.
• AML/CTF programs (wagering, casinos and gaming venues). Risk assessments, customer due diligence, record keeping, independent evaluation follow-up, transaction monitoring and suspicious matter reporting, and whether the program suits the size, complexity and risks of the business.
• Responsible gambling and harm minimisation. Policies, staff interventions and how customers at risk are identified and supported.
• Third-party systems. How the operator selects, contracts with and oversees platform, identity-verification and gaming-system providers, including whether outsourced controls are tested and exceptions are appropriately escalated.
. Outsourcing does not transfer regulatory responsibility.
• Governance and culture. Board oversight, policy review cycles, accountability for compliance, and the adequacy of staff training.
How can operators prepare for an independent review?
Operators can prepare by testing their controls against published regulatory guidance before a review is required. Practical steps include:
• Preserve evidence of control operation. Policies alone will rarely be sufficient. Retain testing records, exception reports, training records, system-change approvals, incident records and evidence that identified issues were remediated.
• Schedule your AML/CTF independent evaluation. Check your first deadline under the transitional rules and build the evaluation into your obligations register and/or compliance calendar.
• Test controls against published findings. ACMA investigation reports, AUSTRAC enforcement outcomes and state inquiry reports show what regulators consider reasonable.
• Know your providers' role. Understand which controls sit with you and which sit with your platform or system providers, and how you oversee them.
• Keep documents current. Clear policy review cycles and accurate training records make any review faster.
• Know who you would nominate. With as little as 14 to 30 days to appoint an auditor, it helps to know in advance who has the qualifications, independence and experience the regulator expects.
Frequently asked questions
How long does an independent audit take?
It depends on the regulator. Under an ACMA remedial direction, the audit generally must be completed within 3 months of the auditor being approved. AUSTRAC external audit notices have typically allowed around 180 to 200 days for the report.
Who chooses the independent auditor?
For enforcement audits, the operator nominates the auditor, but the ACMA must approve them and AUSTRAC must authorise them. For a routine AML/CTF independent evaluation, the operator chooses the evaluator, who must be independent of the program.
Does passing an independent review guarantee compliance?
No. An independent review provides assurance within its agreed scope and based on the evidence examined. It does not transfer responsibility for compliance from the operator or prevent a regulator from undertaking further inquiries.
What is the difference between an enforceable undertaking and a remedial direction?
An enforceable undertaking is a commitment the operator gives and the regulator accepts, which can be enforced in court. A remedial direction is issued by the ACMA and requires the operator to take specified actions. Both can require an independent audit.
Do independent reviews apply to casinos and gaming venues?
Yes. Casinos, clubs and hotels with gaming machines must have their AML/CTF programs independently evaluated, can be ordered to appoint an external auditor by AUSTRAC, and casinos face continuing suitability reviews by state regulators.
How can Senet help with an independent audit or review?
Senet conducts independent audits and reviews across the gambling industry, including:
• Wagering operators: BetStop and broader regulatory compliance reviews, including audits required as part of ACMA enforcement action;
• Gaming venues: independent AML/CTF reviews for clubs and hospitality groups, including a national group of more than 100 venues;
• Casinos: independent expert reviews, including a nine-month review of a casino’s risk environment and measures designed to mitigate
criminal influence.
Our Legal and Compliance services are delivered through conflict-managed engagement teams. . The people who audit a framework have not designed, implemented or advised on it, and we check for conflicts before every engagement. Our Principals have held executive legal and compliance roles at Tabcorp, Crown Resorts, Racing Victoria and KPMG, therefore our recommendations reflect how gambling operations work in practice.
Download our Independent Audits & Reviews one-pager, or contact Alexandra Hoskins (alexandra@senetgroup.com, 0423 726 904) or Michelle Fielding (michelle@senetgroup.com +61 421 083 218).
About Senet
Senet is a multidisciplinary Australian firm specialising in gambling and gaming law, regulatory compliance, and business advisory services. We are the largest specialist team in Australia and based in Victoria. Recognised globally as experts in our field, we understand Australia’s complex gaming legal and regulatory landscape, enabling us to guide clients through their compliance requirements across each state and territory. Our clients range from start-ups to publicly listed global operators, both nationally and internationally. Our team is deeply immersed in the industry, often sharing insights at public speaking events, and our principals have held executive roles in a global ASX-listed entity and a 'Big Four' advisory firm, giving us a unique perspective on the challenges our clients face.
If you have any questions or would like to discuss the topics covered in this article, please contact the team at Senet.
