Third-party account verification in Australian wagering: what operators must do

Account verification is not a formality in Australian wagering. It is a hard compliance obligation woven through the Interactive Gambling Act, state licensing conditions, and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). Operators who treat it as a box-ticking exercise eventually find out it isn't.

Third-party verification specifically refers to the practice of using an external data provider, rather than documents submitted by the customer alone, to confirm that a person is who they say they are. In practice, this means cross-referencing a customer's name, date of birth, and address against records held by credit bureaus, government datasets, or identity document verification services. The customer doesn't control those records. That's the point.

Why third-party verification is required

AUSTRAC, Australia's financial intelligence agency, classifies licensed wagering operators as reporting entities under the AML/CTF Act. That classification requires operators to apply a customer identification program before providing a designated service. For most wagering accounts, the designated service begins at account opening. Operators cannot defer verification until a player deposits or withdraws.

The verification obligation has two layers. The first is collecting the customer's details: full name, date of birth, and residential address at minimum. The second is verifying those details through a reliable and independent source. A customer typing their own name correctly proves nothing. The verification step requires an external source to confirm the information matches a real, living individual.

Third-party electronic verification, often called eKYC, satisfies that second layer for most low-to-medium risk customers. The operator sends the customer's stated details to a verification provider, which checks them against records from credit reporting bodies, the Document Verification Service (DVS) operated by the federal government, or both. A match result confirms the identity. A mismatch triggers further due diligence.

What the Document Verification Service covers

The DVS links directly to official government records, including Australian passports, driver licences, Medicare cards, and visa documents. An operator integrated with an accredited DVS gateway can check whether a submitted document number matches the details held by the issuing authority. The check is near-instant and requires the customer's consent, which must be obtained and recorded.

DVS access isn't open to every business. Operators must apply through the Attorney-General's Department or access it through an accredited intermediary. The intermediary model is common in wagering: providers such as GBG, Equifax, and Illion package DVS access alongside credit bureau checks into a single API call. That combination is the practical standard in the industry.

One important limitation: DVS checks confirm the document is real and the details match. They don't confirm the person presenting the details is the document's legitimate holder. That distinction matters for higher-risk accounts, where liveness detection or biometric verification may be required.

Where operators most often get it wrong

The most common failure point isn't the technology. It's the timing. Some operators run verification only when a withdrawal is requested, or only when an account reaches a certain deposit threshold. AUSTRAC's rules don't support that approach. Verification must occur before the designated service is provided, which means before the account is active and usable.

A second frequent problem involves partial match handling. Most eKYC providers return a match, no-match, or partial-match result. Partial matches occur when some fields verify but others don't, often because a customer has moved address recently or their name appears differently across records. Operators need a documented escalation process for partial matches. Many don't have one, or the process exists on paper but isn't followed.

Record-keeping is a third area of weakness. The AML/CTF Act requires operators to retain verification records for seven years. That includes the data submitted for verification, the result received, the timestamp, the provider used, and any manual review steps taken. Operators that outsource verification to a third party sometimes assume the provider is keeping the records. It isn't their obligation. It's the operator's.

State licensing conditions add another layer

The AML/CTF Act sets a floor, not a ceiling. State regulators impose their own identity verification conditions as part of licensing, and these sometimes go further. The Northern Territory Racing Commission, which licenses most online bookmakers operating nationally, requires operators to verify a customer's identity before allowing a bet to be placed, not just before a withdrawal. Victoria's gambling regulator has its own customer identification standards for state-licensed products.

This layered structure means operators need to understand which jurisdiction's licence covers each product they offer, and map verification obligations accordingly. It's not enough to satisfy AUSTRAC if a state licence condition requires something stricter. The online gambling state licensing framework creates exactly this kind of complexity, and verification requirements are one area where it shows up directly in operational practice.

Enhanced due diligence and politically exposed persons

Standard third-party verification applies to ordinary customers. The AML/CTF Act requires enhanced due diligence (EDD) for customers who present higher risk. This includes politically exposed persons (PEPs), customers from high-risk jurisdictions, and accounts showing transaction patterns inconsistent with stated purpose.

EDD for a wagering customer typically means collecting more information: source of funds, source of wealth, and additional documentation. It also means senior management approval before the account is activated or the relationship continues. Operators need a clear policy on what triggers EDD and who in the organisation is authorised to approve it.

PEP screening is usually built into the same eKYC workflow through a sanctions and PEP database check. Providers such as Refinitiv World-Check and Dow Jones Risk and Compliance are commonly used. The check needs to run at onboarding and be repeated periodically, because a customer's PEP status can change after account opening.

What ACMA enforcement means for verification failures

ACMA's role in this space is narrower than AUSTRAC's, but it intersects with verification in one specific way: the prohibition on providing interactive wagering services to Australians without proper licensing. Unlicensed operators can't satisfy verification requirements because they're not subject to them in a regulated sense. But licensed operators that fail to verify can face action from both ACMA and AUSTRAC simultaneously, a position that quickly becomes expensive.

ACMA's enforcement powers have expanded in recent years, and the agency has shown a clear appetite for using them against operators who fall short of compliance expectations. Verification gaps tend to surface during audits triggered by other concerns, which means an operator flagged for an advertising breach might also face scrutiny of its identity program. The two investigations don't stay separate for long.

Operators who keep their verification infrastructure current, document their decisions properly, and test their processes through independent audit don't eliminate regulatory risk entirely. They do reduce it significantly, and they produce evidence of good faith that regulators notice.