bet365 must overhaul Australian AML controls under a legally binding undertaking

AUSTRAC did not begin with the July 2026 undertaking. It first ordered Hillside (Australia New Media) Pty Limited, the Australian bet365 business, to appoint an external auditor. After considering that report, the regulator opened a formal enforcement investigation in March 2024 into compliance with Australia's anti-money-laundering and counter-terrorism-financing law.

That sequence matters. An external audit can test whether systems work as described. An investigation asks whether legal obligations were met. The undertaking is the public regulatory outcome that followed, placing a programme of correction under legally enforceable terms.

The regulator's July announcement says it identified serious gaps in the way bet365 managed risk and reported suspicious activity. The release does not allege that the company laundered funds or knowingly handled criminal proceeds. The adverse finding concerns the systems designed to identify and report risk.

That distinction keeps the headline accurate without making it weak. A control failure in a high-volume digital betting business is itself material. It does not need to be inflated into an accusation of money laundering that AUSTRAC did not make.

bet365 must establish an ongoing risk-assessment approach supported by clear methods and processes. It must also strengthen the way it detects and reports suspicious transactions as risk changes. The emphasis on ongoing assessment is important because a static policy can become obsolete while payment routes, products and customer behaviour move.

AUSTRAC says the undertaking sets minimum standards for the bookmaker and reflects what it expects from all reporting businesses. That makes the document more than a single-company correction. It provides a public marker for how the agency thinks gambling AML controls should operate.

The undertaking is enforceable, and AUSTRAC says breaches can attract civil-penalty consequences under both the undertaking and the AML/CTF Act. The regulator did not announce a fine against bet365 in this outcome. It also did not describe the action as a Federal Court judgment.

Readers can therefore separate three stages: suspected non-compliance investigated, control weaknesses addressed through binding commitments, and any future allegation that those commitments were breached. Only the first two appear in the public record reviewed for this article.

AUSTRAC has already shown what a completion record can look like. Three days before announcing the bet365 undertaking, it closed Sportsbet's earlier undertaking after an external auditor confirmed the required remediation had been implemented and put into operation. No equivalent completion statement has been published for bet365.

The next decisive document could be a completion notice, a variation or an enforcement action alleging breach. Until one appears, the correct state is developing: the investigation produced a binding plan, but the public record does not yet show that every requirement has been met.

Completion is not merely a paperwork milestone. A risk assessment should change the scenarios used to flag customers and transactions; improved detection should alter which activity is escalated; stronger reporting should affect the quality and timing of intelligence sent to AUSTRAC. The public undertaking sets the direction, but evidence that those controls work in operation will determine whether remediation has moved beyond policy documents.