On 21 May 2026, AUSTRAC ordered Bankstown District Sports Club Ltd to appoint an external auditor, amid concerns the club's anti-money laundering controls may not be strong enough to stop organised crime exploiting its poker machines. (AUSTRAC news release)
There is no Federal Court case here. No penalty. No 35 percent share price drop like the one Tabcorp suffered two weeks earlier. On the surface, an order to "appoint an auditor" looks like the mildest item in AUSTRAC's enforcement catalogue.
That is exactly why Tranche 2 firms should read it closely. The Bankstown order is the cheapest tool AUSTRAC has, and it still lands hard. The regulator picks the scope, an independent auditor goes through your program line by line, and you pay for all of it. For the roughly 80,000 lawyers, accountants, real estate agents, conveyancers and dealers entering the regime on 1 July 2026, this is the form of AUSTRAC attention you are most likely to actually experience.
The Power Most People Have Never Heard Of: Section 162
The Mounties case was civil penalty proceedings in the Federal Court. The Tabcorp matter is an enforcement investigation. Sportsbet signed an enforceable undertaking. The Bankstown order is none of those. It was made under section 162 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, which gives AUSTRAC the power to require a reporting entity to appoint an external auditor to assess its compliance.
Three features of a section 162 order matter for every entity in the regime:
- AUSTRAC sets the scope. The entity does not get to define what "good enough" looks like or steer the auditor toward the comfortable areas. The regulator writes the terms of reference.
- The audit is conducted at the entity's expense. In AUSTRAC's words, "the scope of the audit has been set by AUSTRAC and will be conducted at the club's expense." You fund the investigation into your own controls.
- The findings feed back to AUSTRAC. This is not a private health check. The auditor's findings inform AUSTRAC "whether any further regulatory action is required." A section 162 order can be a destination, or it can be a runway to something larger.
For a small accounting or law firm, none of that requires AUSTRAC to prove a contravention in court first. The regulator only needs a reasonable concern that your controls might be weak. That is a much lower bar than a civil penalty case, which means it is a much more likely outcome for a small entity that files a thin program in July and hopes for the best.
What the Auditor Will Actually Examine
AUSTRAC named three things the Bankstown audit will assess. Read them slowly, because they are the same three things you will be measured against from 1 July:
- Whether the club has an effective, risk-based AML/CTF program to identify, mitigate and manage money laundering and terrorism financing risks.
- Whether it has conducted an appropriate assessment of the risks posed by its customers, services and delivery methods.
- Whether it has adequate systems to monitor customers and identify suspicious behaviour linked to money laundering or terrorism financing.
Program. Risk assessment. Monitoring. If those three sound familiar, it is because they are almost word for word the three focus areas AUSTRAC named in its letter to Tabcorp on 8 May. (The three things AUSTRAC told Tabcorp it was investigating) The regulator is not improvising. It applies the same structural test to a suburban club that it applies to an ASX-listed wagering company, and it will apply it to your firm too.
Why Pokies and Professional Services Are Closer Than You Think
AUSTRAC Acting CEO Katie Miller described the laundering pattern in plain terms:
"In gambling venues, criminals may repeatedly insert cash into poker machines, engage in little or no genuine play, and then cash out, turning illicit cash into funds that appear legitimate."
A lawyer reading this might reasonably think: we do not have poker machines, so this is not about us. That instinct is wrong, and it is worth understanding why.
The poker machine is just a laundering instrument. It takes dirty cash in and produces an apparently clean, documented payout. The criminal's real problem is the same one they have everywhere: turning illicit cash into something that survives scrutiny. Professional services solve that problem in different ways. A trust account that receives funds and disburses them with a law firm's name attached produces exactly the same effect as a pokies payout: a clean paper trail over a dirty source. A property settlement does it. A company structure built by an accountant does it.
That is the entire logic of Tranche 2. AUSTRAC is not bringing lawyers and accountants into the regime because of pokies. It is bringing them in because the output a launderer wants, legitimacy, is something professional services produce by design. Miller's warning about "weak controls or missed warning signs" reads identically whether the service is a poker machine or a conveyancing file. (Why real estate and conveyancing are flagged as high risk)
The Escalation Ladder Is Now Fully Visible
What makes the Bankstown order genuinely useful is that AUSTRAC, in the same release, listed it alongside its other recent gambling-sector actions. Put together, they map AUSTRAC's enforcement ladder in 2026:
| Tool | Example | What it costs the entity |
|---|---|---|
| External audit order (s.162) | Bankstown District Sports Club | The audit fee, plus remediation, plus AUSTRAC now watching |
| Enforceable undertaking | Sportsbet | A binding, public commitment to a remediation program |
| Enforcement investigation | Tabcorp | Reputational damage before any finding (35% share price fall) |
| Civil penalty proceedings | Mounties | Up to tens of millions in penalties, set by a court |
The lesson is not that one rung is comfortable. It is that AUSTRAC now has a graded set of responses and is using all of them in a single sector inside a single year. A small firm is unlikely to be the next Mounties. It is entirely plausible as the next Bankstown. The regulator does not need to believe you are laundering money to order an audit at your expense. It only needs to suspect your controls are weak. (Why "we outsourced our AML" did not save Mounties)
What an AUSTRAC-Set Audit Would Find in a Typical Tranche 2 Firm
Imagine the section 162 power turned on a six-partner accounting practice in July 2026. An auditor working to an AUSTRAC scope, not a friendly one, walks through the three test areas. Here is where most firms would fail today:
On the program. The firm has a document. It was a template, the firm name was dropped in, and no partner has read it cover to cover. The auditor asks the compliance officer to explain, from the document alone, when enhanced due diligence is triggered. The compliance officer reaches for the consultant's phone number. That is a finding. (What a compliant Part A to F program actually contains)
On the risk assessment. The risk assessment describes "risks faced by the accounting profession". It does not reference this firm's client base, these services, these geographies. It is generic, and a generic risk assessment is, by definition, not an assessment of the entity's risk. That is a finding. (How to build a risk assessment that is actually yours)
On monitoring. Ask most professional services firms how they monitor customers after onboarding and the honest answer is: they do not. There is no schedule of periodic reviews tied to risk rating, no trigger list for unscheduled reviews, no documented review trail. For a Tranche 2 firm, monitoring does not mean software. It means a written schedule and a written trigger list that actually get followed. The absence of one is a finding. (Source of funds versus source of wealth, and when to re-check)
Three test areas, three near-certain findings in a firm that treated 1 July as a paperwork deadline rather than an operating change.
What To Do in the Next Five Weeks
There are 33 days between this article and 1 July. That is enough time to stand up a program that survives a section 162 audit. It is not enough if you start in late June. In priority order:
- Name and enrol your compliance officer. The role sits inside the firm, and the named person must have formally accepted it. You cannot nominate your external consultant. (Compliance officer responsibilities)
- Complete enrolment if you have not. The portal has been open since 31 March, with the deadline on 29 July. The firms still waiting are the firms with no margin. (Enrolment walk-through)
- Make your risk assessment specific to your firm. Reference your actual clients, services and jurisdictions. Strip out any sentence that could appear in a competitor's program unchanged. (Risk assessment template)
- Write your customer monitoring framework down. A review schedule keyed to risk rating, plus a named trigger list: new beneficial owner, unusual transaction pattern, change in jurisdiction, connection to a sanctions exposure. It does not need software. It needs to exist on paper and be followed.
- Run a self-audit against AUSTRAC's three questions. Pick a real client file. Trace it through your program. How were they screened, how is their risk recorded, and what would trigger a review if their circumstances changed? If you cannot answer from the documents, neither could an auditor, and that is the gap to close now. (Tranche 2, explained end to end)
The One Sentence to Take Away
Most Tranche 2 firms are bracing for the wrong threat. They picture a Federal Court penalty and conclude it will never happen to a small practice. They are right about that, and it is the wrong thing to plan around.
The realistic AUSTRAC outcome for a small reporting entity is not a court case. It is an order, at your expense, to prove your program works, against a scope you do not control. Bankstown is what that looks like.
The firms that build a genuine, specific, followed program before 1 July are not just avoiding a penalty they were never going to face. They are making sure that if the auditor ever does walk in, the answer to all three of AUSTRAC's questions is already on the file.
Run a free compliance check in two minutes, no signup, and see where your firm sits against the same three questions AUSTRAC set for the Bankstown audit. Or start a 14-day free trial and have a defensible Part A to F program, risk assessment and monitoring framework drafted the same afternoon.
Source: AUSTRAC, "AUSTRAC steps in on suspected AML weaknesses at NSW club", 21 May 2026. The section 162 order requires an independent audit of Bankstown District Sports Club's compliance; no contravention has been determined.