We have created suspicious activity indicators to help you identify potential money laundering, terrorism financing and other serious criminal activities. These indicators can inform your transaction monitoring alerts that trigger further review.
To complement these indicators, you must also ensure your transaction monitoring systems alert you to unusual, large or complex transactions or patterns of transactions.
If you suspect a customer or a transaction involving your customer is linked to a crime, submit a suspicious matter report (SMR) to AUSTRAC within the required timeframes. This includes where you reasonably suspect a person:
- is committing a crime
- is not who they claim to be
- could be the victim of a crime.
On their own, one of these indicators may not suggest suspicious activity. If you are unsure whether there are reasonable grounds for a suspicion, you should conduct further monitoring and examination, including applying enhanced customer due diligence (ECDD) measures. If you have clear and reasonable grounds for a suspicion, you must submit a suspicious matter report (SMR) to AUSTRAC.
For more information on complying with your reporting obligations, see our suspicious matter reporting reference guide and suspicious matter reporting checklist.
This indicators list is not exhaustive. You should consider other indicators specific to your business’s individual risk profile and circumstances.
On this page
Customer identification and behaviour
Customer identification indicators
A customer:
- provides identification information that is false, misleading, vague, or cannot be verified
- is unwilling or refuses to provide identification documents or proof of source of funds or wealth when requested
- provides or attempts to provide a post office box or business address instead of a residential address
- frequently changes account details e.g. address, phone numbers, etc.
- provides mismatched information. For example, email domain, telephone or postcode details that do not correspond to the country
- has online betting account details that do not match the account details of the payment method for deposits and withdrawals
- is linked to criminal activity, including match fixing, through information from government or law enforcement agencies or open source information
- has links to previously investigated and/or monitored accounts
- has sources of funds or sources of wealth that are unexplained or inconsistent with their profile or level of play
- seeks to open multiple accounts under the same name
- seeks to open account/sunder a fake name
- seeks to open an account after closing a previous account, or asks to have their account closed
- attempts to open multiple accounts using variations of their personal details, including name, date of birth, address and emails
Other indicators:
- Several accounts under different names are opened using the same IP address and/or device
- Multiple accounts sharing the same physical address or contact details
Customer behaviour indicators
A customer:
- enquires or attempts to withdraw funds using an e-wallet or prepaid card
- enquires about withdrawing funds internationally or in foreign currency or cryptocurrency
- asks for funds to be transferred to an account different from the account the funds came from
- appears to be placing bets automatically, or robotically
- shows unusual interest in your internal controls and processes
- and/or their gaming activity is the subject of law enforcement enquiries
- appears nervous, overly defensive, or evasive when questioned
- appears coached or rehearsed when answering questions
Money laundering
A customer:
- seeks to open multiple accounts under the same name
- seeks to open account(s) under a fake name
- seeks to open an account after closing a previous account (or asks to have their account closed)
- attempts to open multiple accounts using variations of their personal details, including name, date of birth, address and emails
- makes large deposits into a newly-opened account
- makes multiple deposits into an account within a short period of time
- uses multiple debit or credit cards to deposit funds into a gambling account
- frequently changes deposit methods
- has an increase in the number and/or value of deposits to their account
- attempts to deposit foreign currency into an account
- uses their employer’s or own business’s point of sale devices to deposit funds into their gambling account
- frequently deposits money via methods where it is difficult to determine the source of funds. For example:
- prepaid vouchers or cards
- e-wallets
- approved third party bill payment systems
- cheques
- money orders
- cash in/cash top-up
- cash deposits into an online gambling company’s bank account
- makes cash top-ups or buys vouchers across multiple retailers (for example, newsagents, petrol stations, etc.) in a short period of time, particularly if there is large distance between retailers
- makes cash deposits that appear to be structured to avoid meeting the cash threshold transaction reporting limit
- makes deposits from a business account
- attempts to deposit funds from international bank accounts
- logs in from IP addresses outside Australia and/or in multiple countries
- has changes in their IP address, to different locations in Australia on each log-in
- has an IP address used by a virtual private network
- has their account accessed simultaneously or in quick succession from different IP addresses
- has a change in betting activity, including the frequency, amount, type of bet or betting market
- has betting activity that is not consistent with their usual activity
- places large or unusual bets
- places a bet related to a sport in which they are either related to or identified as a:
- player/competitor/participant;
- coach;
- game or match officials, including referee/umpire;
- support personnel, staff member, official, executive, board member or owner of either an organisation/club involved in the sport or body that oversees the sport,
- a manager/agent of a player or coach
- has account activity involved in ‘betting plunges’ (a massive and sudden support for a particular competitor, for example team or horse) in a particular market
- places a bet on the outcome of an event where the integrity of the event is called into question by a gambling company, a sporting body’s integrity unit, law enforcement agency, or integrity software provider
- places a bet on an outcome that is later determined to have occurred due to match fixing
- makes the same or very similar bets as other accounts flagged for suspicious activity
- places multiple, large or maximum bets on obscure markets
- uses the total funds deposited to place a large or maximum bet
- attempts to layer transactions by creating an accumulator bet with short odd selections to disguise the total amount of bet
- attempts to make large withdrawals from a new account
- makes frequent withdrawals within a short period of depositing funds
- attempts to withdraw funds without conducting any gambling activity
- is storing funds in an account with no activity
- withdraws funds into third party account
- uses own point of sale devices to withdraw funds
- continually places bets on short-odd favourites and then requests an immediate withdrawal when the payout is received
- attempts to withdraw funds to an international bank account
Other indicators:
- Several accounts under different names are opened using the same IP address and/or device
- Multiple accounts sharing the same physical address or contact details
- Funds are stored in a betting account with no or little play (known as dormant accounts)
- A cardholder challenges a credit or debit card payment to a gambling account
- Two or more accounts under different names are using the same IP address and/or device
- Different players are linked to a common or particular bank account
- A third party attempts to make deposits into a customer’s account, or deposits are funded from a different account to those where winnings are paid
Terrorism financing
- A customer is matched through screening against an Australian or international sanctions list
- Open-source information indicates customer is linked to a known terrorist organisation, or terrorist activities
- Open-source information indicates a customer displays extremist ideologies (social, political, environmental etc.).
Related pages
The content on this website is general and is not legal advice. Before you make a decision or take a particular action based on the content on this website, you should check its accuracy, completeness, currency and relevance for your purposes. You may wish to seek independent professional advice.
Last updated:
30 Sep 2024
Page ID: 1114