Casino Control Regulations 2023 (Victoria)

These Regulations, made under section 167 of the Casino Control Act 1991 (the Act) (regulation 2), prescribe operational, governance, identity, data and harm‑minimisation rules for casino operators. Mechanically the instrument does the following.

Establishes prescribed corporate governance roles and functions the independent board or directors must oversee, and identifies prescribed senior executive categories and a prescribed period for independent senior management (regs 5-6).
Requires mandatory pre‑commitment behaviour linked to the pre‑commitment system for gaming machines, and requires casino operators to prevent play and to permit withdrawal of non‑cash tokens when limits are reached (regs 7-9).
Sets detailed cashless gaming controls for account functionality, timing of funds availability, deposit limits and terminal location, includes prohibitions on inducement to increase deposit limits or enabling automatic increases, and prescribes identity verification before paying winnings over $1,000 (regs 10, 10A, 11).
Prescribes identity verification standards for issuance and re‑issue of player cards, including the documents that must be sighted, photographic requirements and verification steps (regs 12-13, 18).
Prescribes technical and data requirements for player cards including staged additional data capture obligations commencing 1 July 2026 and 1 December 2027, mandatory seven year retention, and prohibitions on charging for cards (regs 14-16, 18).
Limits use of player card and identity verification data to regulatory purposes unless express consent is obtained for loyalty schemes, and requires an approved identity verification policy and employee training (regs 19, 23-25).
Sets procedures for voluntary exclusion orders, including safe treatment of funds, application methods, minimum exclusion periods, revocation conditions and signage requirements (regs 26-30).

Version No. 003

Casino Control Regulations 2023

S.R. No. 119/2023

Version incorporating amendments as at
9 December 2025

TABLE OF PROVISIONS

Regulation Page

Part 1—Preliminary 1

1 Objectives 1

2 Authorising provision 1

3 Commencement 2

4 Definitions 2

Part 2—Corporate ownership and governance 4

5 Independent board—prescribed functions of casino operator or directors 4

6 Independent senior management—prescribed periods and prescribed categories 5

Part 3—Pre-commitment, cashless gaming and carded play 7

Division 1—Mandatory pre-commitment 7

7 Requirements for setting limits for mandatory pre‑commitment 7

8 Consequences of person reaching limits for mandatory pre-commitment 7

9 Determining whether a person is ordinarily resident in Australia 7

Division 2—Cashless gaming 8

10 Cashless gaming requirements 8

10A Offences relating to cashless gaming 11

11 Identity verification for payment of winnings 11

Division 3—Carded play and identification 12

12 Identity verification for issue of player cards 12

13 Identify verification for re-issue of player cards 14

14 Requirements and specifications for player cards 15

15 Further requirements and specifications for player cards—commencing 1 July 2026 17

16 Further requirements and specifications for player cards—commencing 1 December 2027 18

18 Storage and access of photographs on player cards 19

19 Access, use and disclosure of player card information 19

20 Player cards—further requirements 20

21 Information and requirements for player activity statements 20

Division 4—Identity verification policy and related offences 24

23 Identity verification policy 24

24 Changes to identity verification policy 26

25 Information collected for the purpose of identity verification 27

Part 4—Exclusion orders 29

26 Treatment of accounts and loyalty scheme when person is subject to voluntary exclusion order 29

27 Offences by casino operator 29

28 Application for voluntary exclusion order 30

29 Revocation of voluntary exclusion order 30

30 Casino operator to provide information and display signs regarding exclusion orders 31

Part 5—Transitional arrangements 32

31 Approval of first identity verification policy 32

═════════════

Endnotes 34

1 General information 34

2 Table of Amendments 36

3 Explanatory details 37

Version No. 003

Casino Control Regulations 2023

S.R. No. 119/2023

Version incorporating amendments as at
9 December 2025

Part 1—Preliminary

1 Objectives

The objectives of these Regulations are to prescribe for the purposes of the Casino Control Act 1991—

(a) matters relating to the corporate governance of a casino operator; and

(b) requirements and specifications for player cards used for carded play; and

(d) requirements for the setting of pre‑commitment limits; and

(e) requirements relating to the conduct of gaming using non-cash gaming tokens in a casino; and

(f) requirements for the identification of players at a casino; and

(g) requirements for the exclusion of players from a casino.

2 Authorising provision

These Regulations are made under section 167 of the Casino Control Act 1991.

3 Commencement

(1) These Regulations (except Parts 2, 3, and 4) come into operation on 28 November 2023.

(2) Parts 2, 3 and 4 come into operation on 14 December 2023.

4 Definitions

In these Regulations—

Australian Government Entity has the same meaning as in Part 1.2 of the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) made under section 229 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 of the Commonwealth;

cashless gaming system means the system that administers cashless gaming accounts;

cashless gaming terminal means a device (other than a gaming machine) that a person can use to—

(a) increase the value of a non-cash gaming token; or

(b) redeem any of the value of a non-cash gaming token; or

Reg. 4 def. of deposit limit inserted by S.R. No. 137/2025 reg. 5.

deposit limit means the maximum amount of money that may be deposited into a cashless gaming account in a day;

Easy Read format means a brochure or sign that—

(a) combines text with layout and imagery to simplify and explain information; and

(b) is accessible for people with low literacy, including the use of simple language where possible;

gambling has the same meaning as in section 1.3AA of the Gambling Regulation Act 2003;

non-regulatory purpose—

(a) means any purpose which is not required for a casino operator to meet its legal and regulatory responsibilities under the Act or any other Act; and

(b) includes any of the following—

(i) advertising;

(ii) direct marketing;

(iii) the provision of a loyalty program;

personal information has the same meaning as in the Privacy Act 1988 of the Commonwealth;

pre-commitment system has the same meaning as in section 3.8A.1 of the Gambling Regulation Act 2003;

the Act means the Casino Control Act 1991;

voluntary exclusion order means an exclusion order on the voluntary application of a person under section 72(2A) of the Act.

Part 2—Corporate ownership and governance

5 Independent board—prescribed functions of casino operator or directors

(1) For the purposes of section 36ZB(2) of the Act, the prescribed functions are the functions of a casino operator relating to the independent and effective oversight of the governance, policies, systems, management and strategic direction of a casino operator with respect to the following—

(a) accounting and financial management;

(b) internal and external audit and risk management;

(d) security and surveillance;

(e) responsible service of gambling;

(f) harm minimisation and prevention;

(g) anti-money laundering;

(h) international, VIP and premium player business;

(i) gambling product, strategy, innovation and loyalty programs;

(j) staff training and development;

(k) information technology;

(l) people, culture, integrity and senior executive appointment and remuneration.

(2) For the purposes of subregulation (1)(l), senior executive appointment and remuneration means the appointment and remuneration of a senior executive belonging to a category of senior executive prescribed by regulation 6(b).

6 Independent senior management—prescribed periods and prescribed categories

(1) For the purposes of section 36ZC(a) of the Act—

(a) the prescribed period is 14 December 2023 until the day these Regulations are revoked;

(b) the prescribed categories of senior executives are the following—

(i) Chief executive officer (however described);

(ii) Chief financial officer (however described);

(iii) Chief operating officer (however described);

(iv) Head of gambling (however described);

(v) Head of harm minimisation and prevention (however described);

(vi) Head of international and domestic VIP business (however described);

(vii) Head of risk management (however described);

(viii) Head of compliance (however described);

(ix) Head of security (however described);

(x) Head of surveillance (however described).

(2) One or more persons may be employed or appointed in accordance with section 36ZC of the Act as a senior executive in the prescribed categories.

Part 3—Pre-commitment, cashless gaming and carded play

Division 1—Mandatory pre-commitment

7 Requirements for setting limits for mandatory pre‑commitment

For the purposes of section 62C(2)(b) of the Act, a person must set a time limit and net loss limit in accordance with the instructions given by the pre‑commitment system before playing a gaming machine at a casino.

Reg. 8 (Heading) amended by S.R. No. 137/2025 reg. 6(1).

8 Consequences of person reaching limits for mandatory pre-commitment

Reg. 8(1) amended by S.R. No. 137/2025 reg. 6(2).

(1) A casino operator must ensure that when a person reaches a time limit or net loss limit under the
pre-commitment system the person is no longer able to play a gaming machine at a casino until a new limit period commences.

Penalty: 20 penalty units.

Reg. 8(2) amended by S.R. No. 137/2025 reg. 6(3).

(2) A casino operator must ensure that a person who reaches a time limit or net loss limit under the
pre-commitment system can use a non-cash gaming token to withdraw their funds.

Penalty: 20 penalty units.

9 Determining whether a person is ordinarily resident in Australia

(1) For the purposes of section 62C(2) of the Act, a casino operator must treat a person as ordinarily resident in Australia unless the operator can confirm that the person is not ordinarily resident in Australia.

(2) A casino operator must record the primary country of residence of all persons to whom a player card is issued.

(3) If at any time a casino operator suspects that a person who is not recorded as ordinarily resident in Australia is in fact ordinarily resident in Australia, the operator must take further steps to confirm the residency status of that person.

(4) For the purpose of subregulation (3), if a passport is written in a language that is not understood by the person carrying out the verification, the casino operator may request an English language translation prepared by an accredited translator.

Division 2—Cashless gaming

10 Cashless gaming requirements

(1) For the purposes of section 64A(2) of the Act, the following requirements are prescribed—

(a) there is a minimum period of 15 minutes from the time that a person deposits money into their cashless gaming account until the money is credited to the account and available to be accessed by the person for gambling; and

(b) a person must be able to cancel a deposit during the period referred to in paragraph (a) and the procedure for doing so must be no less easy than the procedure for making the deposit; and

Reg. 10(1)(c) amended by S.R. No. 137/2025 reg. 7(1)(a).

(c) each cashless gaming terminal at a casino must not be located within 2 metres walking distance of a gaming machine that is available for gaming; and

Reg. 10(1)(d) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(d) a cashless gaming account must not permit the transfer of funds from an account established with an ADI or a financial institution outside Australia or a transfer from a debit card unless the person who holds the cashless gaming account—

(i) sets a deposit limit; or

(ii) notifies the casino in writing that the person does not wish to set a deposit limit; and

Reg. 10(1)(e) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(e) a person who holds a cashless gaming account which permits a transfer from an ADI or a financial institution outside Australia or from a debit card has, on or before 9 December 2025—

(i) set a deposit limit; or

(ii) notified the casino in writing that the person does not wish to set a deposit limit; and

Reg. 10(1)(f) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(f) a password, personal identification number or additional security check is required to access a cashless gaming account; and

Reg. 10(1)(g) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(g) a person must be able to set or change a deposit limit for their cashless gaming account at any time; and

Reg. 10(1)(h) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(h) the process for setting or changing a deposit limit must be simple and easy to follow; and

Reg. 10(1)(i) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(i) if a person makes a change to the deposit limit for their cashless gaming account, that change must take effect—

(i) immediately, if the new deposit limit is less than the existing deposit limit; or

(ii) after 24 hours, if the new deposit limit exceeds the existing deposit limit; and

Reg. 10(1)(j) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(j) a person must not be able to deposit an amount of money (excluding a deposit from a non-cash gaming token) into a cashless gaming account if that amount would exceed the deposit limit for the account; and

Reg. 10(1)(k) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(k) if a cashless gaming account permits a transfer from an ADI or a financial institution outside Australia or from a debit card, at least once every 12 months, the person who has used the account to play games at the casino must be asked whether the person would like to set a deposit limit for the account or change the deposit limit for the account (as the case requires); and

Reg. 10(1)(l) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(l) the process for closing a cashless gaming account must—

(i) be clearly explained and prominently displayed on the casino operator's website; and

(ii) be simple and easy to follow; and

(iii) allow a person to request the closure of their account by telephone or email or at a cashless gaming terminal or a player service point; and

Reg. 10(1)(m) inserted by S.R. No. 137/2025 reg. 7(1)(b).

(m) if a person requests the closure of their cashless gaming account, all funds held in the account must be remitted to the person and the account must be closed as soon as possible.

Reg. 10(2) substituted by S.R. No. 137/2025 reg. 7(2).

(2) Subregulation (1)(a) does not apply—

(a) to deposits made into a cashless gaming account by way of cash or non-cash gaming tokens; and

(b) to the first deposit made into a cashless gaming account each day.

(3) Section 43 of the Interpretation of Legislation Act 1984 does not apply to the measurement of any distance for the purposes of subregulation (1)(c).

Reg. 10A inserted by S.R. No. 137/2025 reg. 8.

10A Offences relating to cashless gaming

(1) A casino operator must not encourage or induce a person who has set a deposit limit to increase that deposit limit.

Penalty: 20 penalty units.

(2) A casino operator must not enable a person to set up automatic increases to the amount of money available for gaming in a cashless gaming account.

Penalty: 20 penalty units.

11 Identity verification for payment of winnings

(1) Before paying out any winnings or accumulated credits exceeding $1000 to a person from playing games in a casino, a casino operator must verify the person's identity in accordance with the requirements set out in subregulations (2) and (3).

(2) A casino operator must sight photographic identification which displays the person's—

(a) full name; and

(b) either—

(i) date of birth; or

(ii) residential address.

(3) A casino operator must be reasonably satisfied that the information and photograph on the identification—

(a) belongs to the person; and

(b) matches the information on the person's player card.

(4) For the purposes of this regulation, the only acceptable forms of identification that may be used are—

(a) a document issued by an Australian Government Entity; or

(b) a passport issued for the purpose of international travel.

Division 3—Carded play and identification

12 Identity verification for issue of player cards

(1) For the purposes of section 71B(1) of the Act, a casino operator must verify a person's identity in accordance with subregulations (2) to (10).

(2) A casino operator has verified a person's identity if the operator has taken reasonable steps to confirm a person's identity in accordance with subregulations (3) to (10) and is reasonably satisfied that the person is who they claim to be.

(3) A casino operator must collect a person's—

(a) full name; and

(b) date of birth; and

(4) A casino operator must verify a person's—

(a) full name; and

(b) either—

(i) date of birth; or

(ii) residential address.

(5) For the purposes of subregulation (4), the only acceptable forms of identification that may be used are—

(a) a document issued by an Australian Government Entity; or

(b) a passport issued for the purpose of international travel.

(6) A casino operator must sight, in person—

(a) at least one form of identification of a kind referred to in subregulation (5); and

(b) at least one form of photographic identification.

(7) The documents referred to in subregulation (6)(a) and (b) may be the same document.

(8) A casino operator must take all reasonable steps to confirm the validity of the identification documents presented by a person.

(9) If at any time a casino operator is not able to verify a person's identity, or forms any reasonable doubt about the veracity of a person's identity, the casino operator must request further information or conduct additional checks to be satisfied that the person is who they say they are.

(10) Without limiting subregulation (9), the casino operator may—

(a) seek information from the person or from third party sources in order to clarify or update information already collected from the person; and

(b) verify or re-verify identification information; and

(c) if a passport is written in a language that is not understood by the person carrying out the verification, request an English language translation prepared by an accredited translator.

13 Identify verification for re-issue of player cards

(1) Despite regulation 12, a casino operator may replace or re-issue a player card within 5 years of issuing the player card by verifying a person's identity in accordance with subregulation (2).

(2) A casino operator may verify a person's identity to replace or re-issue a player card in one of the following ways—

(a) by the person interacting with a casino staff member if—

(i) the person produces photographic identification of a kind referred to in regulation 11(2); and

(ii) the casino operator has a carded play account linked to the person which includes—

(A) a photograph of the person in accordance with regulation 18; and

(B) the information referred to in regulation 12(3); and

(iii) the photograph and information on the photographic identification produced under subparagraph (i)—

(A) belong to the person; and

(B) match the information included in the account referred to in subparagraph (ii);

(b) without interaction between the person and a casino staff member if—

(i) the casino operator has a carded play account linked to the person which includes—

(A) a photograph of the person in accordance with regulation 18; and

(B) the information referred to in regulation 12(3); and

(ii) the person accesses the account referred to in subparagraph (i) using multi‑factor authentication.

(3) In this regulation—

carded play account means an account established by a casino operator to facilitate carded play in the casino, which may also facilitate a player's participation in a loyalty scheme;

multi-factor authentication means a security measure that requires 2 or more proofs of identity to grant access.

Reg. 14 substituted by S.R. No. 137/2025 reg. 9.

14 Requirements and specifications for player cards

(1) For the purposes of section 71C(1) of the Act, the prescribed requirements and specifications are those set out in this regulation and regulations 15 and 16.

(2) A player card in use in a casino must be a registered player card within the meaning of the Gambling Regulation (Pre-commitment and Loyalty Scheme) Regulations 2025[1].

(3) A player card in use in a casino must include a photograph, which complies with subregulation (4), of the person to whom the card is issued.

(4) The photograph of a person on a player card—

(a) must include the person's full head; and

(b) must be in focus with the person facing square and looking at the camera; and

(d) must be at least 20 mm wide and 20 mm high; and

(e) may be in colour or black and white; and

(f) may include a hat, head covering, eye patch, prosthetic or similar, if the person is wearing these items for religious or medical reasons.

(5) A player card in use in a casino must be capable of recording—

(a) the following sessional data from a person's playing of games at the casino—

(i) the periods during which the player played games at the casino including the date, start time and end time;

(ii) the player's turnover during each period that the player played games at the casino;

(iii) the player's losses and wins during each period that the player played games at the casino;

(iv) the amount of loyalty credits redeemed during each period that the player played games at the casino;

(v) the amount of any inducement or other credit redeemed during each period that the player played games at the casino; and

(b) any other information that the Commission reasonably requires, by written notice given to the casino operator, for the purposes of—

(i) preventing and minimising gambling harm; or

(ii) preventing or reporting on money laundering; or

(iii) carrying out investigations of the casino operations; or

(iv) ensuring the casino operator is complying with the operator's obligations in relation to the responsible service of gambling or monitoring or preventing criminal activity.

(6) A casino operator must retain any information or data collected by a player card in accordance with this regulation for 7 years.

(7) A casino operator must not charge a fee for issuing or re-issuing a player card in order to comply with this regulation.

Reg. 15 substituted by S.R. No. 137/2025 reg. 9.

15 Further requirements and specifications for player cards—commencing 1 July 2026

(1) On and after 1 July 2026, a player card in use in a casino must be capable of recording the player's credit in and credit out time and amounts for each period that the player played games at the casino.

(2) The requirement in subregulation (1) applies in addition to the requirements in regulation 14(5).

(3) A casino operator must retain any information or data collected by a player card in accordance with this regulation for 7 years.

(4) A casino operator must not charge a fee for issuing or re-issuing a player card in order to comply with this regulation.

Reg. 16 substituted by S.R. No. 137/2025 reg. 9.

16 Further requirements and specifications for player cards—commencing 1 December 2027

(1) On and after 1 December 2027, a player card in use in a casino must be capable of recording the following transactional data from a person's playing of games at the casino—

(a) the amount of cash used to play a game, whether the cash was provided to a casino staff member or inserted by the player into a cashless gaming terminal or provided by another method for the purposes of playing a game;

(b) the amount of cash paid out as winnings to the player.

(2) The requirements in subregulation (1) apply in addition to the requirements in regulations 14(5) and 15(1).

(3) A casino operator must retain any information or data collected by a player card in accordance with this regulation for 7 years.

(4) A casino operator must not charge a fee for issuing or re-issuing a player card in order to comply with this regulation.

Reg. 17 revoked by S.R. No. 137/2025 reg. 10.

18 Storage and access of photographs on player cards

(1) A casino operator must ensure that a copy of a photograph of a person included on a player card is stored in electronic form.

(2) A casino operator must ensure that the electronic copy of the photograph—

(a) is clear and in colour; and

(b) displays on a screen visible by a casino employee when the employee scans the player card or otherwise facilitates a transaction for the person to whom the card is issued, including—

(i) payment of winnings; and

(ii) reprinting a player card; and

(iii) identification to ensure that the person using the player card is the person to whom the card is issued; and

19 Access, use and disclosure of player card information

(1) Subject to subregulation (2), a casino operator must not access, use or disclose, or allow another person to access, use or disclose, any information or data collected by a player card for a non‑regulatory purpose.

Penalty: 20 penalty units.

(2) A casino operator may access, use or disclose, or allow another person to access, use or disclose, information or data collected by a player card for the purpose of carrying out a loyalty scheme if the casino operator first obtains the express consent of the person to whom the card is issued.

20 Player cards—further requirements

(1) This regulation applies on and after section 71C(1) of the Act applies.

(2) A casino operator must take reasonable steps to prevent a person having more than one active player card.

Penalty: 20 penalty units.

(3) A casino operator must take reasonable steps to prevent a person from gambling with a player card that is not issued to that person.

Penalty: 20 penalty units.

(4) A casino operator must ensure that a player card specifies the legal name of the person to whom the player card is issued.

Penalty: 20 penalty units.

(5) A casino operator must not link a player card to an account within the pre-commitment system unless the account is in the legal name of the person to whom the player card is issued.

Penalty: 20 penalty units.

(6) In this regulation—

legal name, in relation to a person, means the name that appears on a form of identification issued to that person by an Australian Government Entity or on a passport issued for the purpose of international travel.

21 Information and requirements for player activity statements

(1) For the purposes of section 71E(2) of the Act, a casino operator must provide each active player with player activity statements in accordance with the following requirements—

(a) a player activity statement must be in a form approved by the Commission;

(b) a player activity statement must be provided to each active player within 7 days after the end of each calendar month;

(c) if an active player requests a player activity statement in respect of the previous calendar month, a casino operator must provide the statement to the player within 7 days after the request;

(d) a player activity statement must contain any additional information specified by the Commission;

(e) a casino operator—

Reg. 21(1)(e)(i) amended by S.R. No. 137/2025 reg. 11(1).

(i) must offer an active player the choice to receive a player activity statement by post, email or in the casino complex; and

(ii) may offer an active player the choice to receive a player activity statement by any other method.

(2) For the purposes of subregulation (1)(a), the Commission must not unreasonably refuse to approve a form of player activity statement.

(3) A player activity statement must include the following information on gaming activity and cashless gaming account transactions collected by the player card and cashless gaming system—

(a) the amount spent in dollars and cents by the player during the statement period;

(b) the amount won and lost in dollars and cents by the player during the statement period;

(c) the amount of loyalty credits or any other inducement redeemed through the playing of games at a casino during the statement period;

Reg. 21(3)(d) amended by S.R. No. 137/2025 reg. 11(2)(a).

(d) the total time spent by the player playing games at a casino during the statement period;

(e) the total number of spins or bets in the statement period;

(f) the overall net win or loss for the statement period;

Reg. 21(3)(g) amended by S.R. No. 137/2025 reg. 11(2)(b).

(g) the overall net win or loss for 6 calendar months prior to the statement period;

Reg. 21(3)(h) inserted by S.R. No. 137/2025 reg. 11(2)(c).

(h) the opening and closing balance of the person's cashless gaming account for the statement period (if applicable);

Reg. 21(3)(i) inserted by S.R. No. 137/2025 reg. 11(2)(c).

(i) the amount of any deposit to or withdrawal from the person's cashless gaming account during the statement period.

Reg. 21(4) substituted by S.R. No. 137/2025 reg. 11(3).

(4) A player activity statement must include—

(a) a column graph comparing amount spent against net result on a monthly basis for the previous 6 months, including months of no play; and

(b) a column graph comparing amount spent against net result for the calendar month to which the statement relates and the corresponding month in the previous calendar year.

(5) A player activity statement must include—

(a) a daily summary that specifies, for each day of the statement period, for all activities for which a player card was used—

(i) the amount spent by the player in dollars and cents; and

(ii) the amount won and lost by the player in dollars and cents; and

Reg. 21(5) (a)(iii) substituted by S.R. No. 137/2025 reg. 11(4)(a).

(iii) the total time spent by the player playing games at the casino in hours and minutes; or

Reg. 21(5) (a)(iv) revoked by S.R. No. 137/2025 reg. 11(4)(a).

Reg. 21(5)(b) amended by S.R. No. 137/2025 reg. 11(4)(b).

(b) a link or contact details that enable an active player to access or request a daily summary that specifies the information referred to in paragraph (a)(i) to (iii) for each day of the statement period.

(6) If a player activity statement is sent by email, a casino operator must ensure that—

(a) the statement is included as an attachment to the email or that the email includes a direct link to open the statement; and

(b) the person is not required to complete additional security checks to open the statement.

Example

Requiring the person to enter a password.

(7) All information in a player activity statement about a person's gambling activity must be collected by the player card or cashless gaming system.

(8) If an active player chooses to receive a player activity statement in the casino operated by the Melbourne Casino Operator, it is sufficient compliance with subregulation (1)(e)(i) for the statement to be provided to the player anywhere within the casino complex.

(9) A casino operator must ensure that it collects the information required to comply with this regulation.

Reg. 22 revoked by S.R. No. 137/2025 reg. 12.

Division 4—Identity verification policy and related offences

23 Identity verification policy

(1) A casino operator must have an identity verification policy that is approved by the Commission.

Penalty: 20 penalty units.

(2) A casino operator must ensure that the casino operator and all casino employees comply with the identity verification policy.

Penalty: 20 penalty units.

(3) The identity verification policy must outline how a casino operator will meet its obligations under regulations 9, 11, 12, 13, 20 and 24, including—

(a) what forms of identification the operator will accept; and

(b) what reasonable steps the operator will take to verify a person's identity; and

(c) what reasonable steps the operator will take to confirm the validity of identification documents presented by a person; and

(d) what reasonable steps the operator will take to determine whether a person is ordinarily resident in Australia; and

(e) risk-based guidance to inform when and how further checks are to be conducted for the purposes of regulations 9(3) and 12(9); and

(f) what reasonable steps the operator will take to prevent access, use and disclosure of information collected for the purpose of identity verification for non-regulatory purposes.

(4) The identity verification policy must outline the training that will be given to casino employees to assist with identity verification.

(5) The identity verification training must include a component on recognising security features in passports.

(6) The identity verification policy must outline how the casino operator will deal with winnings and accumulated credits if the casino operator cannot verify a person's identity in accordance with regulation 11.

(7) Any changes to the identity verification policy must be approved by the Commission in accordance with regulation 24.

24 Changes to identity verification policy

(1) A casino operator may request changes to an identity verification policy.

(2) The request must be made to the Commission in writing.

(3) The Commission, within 14 days after receiving the request, must—

(a) approve the changes to the identity verification policy; or

(b) refuse to approve the changes to the identity verification policy.

(4) In determining whether to approve the identity verification policy, the Commission must have regard to—

(a) the effectiveness of the policy in preventing gambling-related harm, money laundering and other criminal activity; and

(b) the effect of the policy on a person's experience at the casino, including the time it will take to verify a person's identity; and

(d) whether the policy will impose a significant economic burden on the casino operator, having regard to the likely administration and compliance costs of implementing the policy; and

(e) whether the policy will impose a significant social burden on the public; and

(f) whether the policy is compliant with these Regulations and any other requirements under the Act, the Gambling Regulation Act 2003 or any other Act.

(5) On making a decision under subregulation (3), the Commission must notify the casino operator of the decision and, if the Commission has refused to approve a change to the identity verification policy, provide reasons for the decision.

25 Information collected for the purpose of identity verification

(1) A casino operator must not access, use or disclose, or allow another person to access, use or disclose, any information collected by the casino operator for the purposes of verifying a person's identity in accordance with these Regulations for any non‑regulatory purpose.

Penalty: 20 penalty units.

(2) A casino employee must not access, use or disclose information collected for the purposes of verifying a person's identity in accordance with these Regulations, unless—

(a) the employee is authorised to do so by the casino operator; and

(b) access to, or use or disclosure of, the information is necessary for the casino operator to comply with the operator's legal and regulatory obligations under the Act or any other Act.

Penalty: 20 penalty units.

(3) Before collecting any personal information for the purposes of verifying a person's identity in accordance with these Regulations, a casino operator must notify a person of—

(a) any matter required to be disclosed to the person under the Privacy Act 1988 of the Commonwealth; and

(b) how long the information collected will be retained and, if it is not possible to state a specific timeframe, the basis upon which the information would be deleted or destroyed; and

(4) The matters and information referred to in subregulation (3)(a) to (c) must be—

(a) provided to a person before signing up for a player card in accordance with the Privacy Act 1988 of the Commonwealth; and

(b) displayed on signs or documents (digital or printed) at—

(i) any location where a person can sign up for a player card or collect winnings; or

(ii) the cashier; and

(d) presented in a way that is easy to understand; and

(e) available electronically; and

(f) available in a range of languages; and

(g) available in English in an Easy Read format.

Part 4—Exclusion orders

Reg. 26 amended by S.R. No. 137/2025 reg. 13 (ILA s. 39B(2)).

26 Treatment of accounts and loyalty scheme when person is subject to voluntary exclusion order

(1) If a person is subject to a voluntary exclusion order, a casino operator must ensure that, as soon as practicable after the voluntary exclusion order takes effect—

(a) all funds in that person's deposit account or cashless gaming account are remitted to the person; and

(b) if a non-cash gaming token held by that person is surrendered to the casino operator, the equivalent value of that non-cash gaming token is remitted to the person.

Penalty: 20 penalty units.

Reg. 26(2) inserted by S.R. No. 137/2025 reg. 13.

(2) A casino operator must not establish a cashless gaming account for a person who is subject to a voluntary exclusion order.

Penalty: 20 penalty units.

27 Offences by casino operator

(1) A casino operator must not discourage, hinder or obstruct a person from applying for a voluntary exclusion order.

Penalty: 20 penalty units.

(2) A casino operator must not encourage or induce a person who applies for a voluntary exclusion order to request a shorter period of time for the exclusion order to operate.

Penalty: 20 penalty units.

(3) A casino operator must not encourage or induce a person to apply for or accept a temporary exclusion order instead of applying for a voluntary exclusion order.

Penalty: 20 penalty units.

28 Application for voluntary exclusion order

(1) A casino operator must ensure that a person who wishes to apply for a voluntary exclusion order can apply—

(a) in person in the casino; or

(b) by email; or

(2) A casino operator must require a person who applies for a voluntary exclusion order to nominate the duration of the exclusion order being no less than 6 months.

29 Revocation of voluntary exclusion order

(1) A casino operator must not revoke a voluntary exclusion order unless the casino operator has received an application, in writing, from the person subject to the order requesting that the order be revoked.

(2) A casino operator must not contact or approach a person subject to a voluntary exclusion order to advise the person that the order has expired.

(3) If a person subject to a voluntary exclusion order applies for revocation of the order prior to the expiry of the order—

(a) a casino operator must require the person to engage with gambling counselling services; and

(b) the following conditions must be met before the casino operator revokes the order—

(i) the person presents evidence to the casino operator that the person has engaged with gambling counselling services as required under paragraph (a);

(ii) the casino operator is satisfied that the person is not at significant risk of gambling harm.

(4) The revocation of a voluntary exclusion order referred to in subregulation (3) takes effect 28 days after the conditions in subregulation (3)(b) have been met.

30 Casino operator to provide information and display signs regarding exclusion orders

(1) A casino operator must take reasonable steps to provide information, including contact details, about gambling counselling services to each person who enquires about, or applies for, a voluntary exclusion order.

(2) A casino operator must display a notice stating that an exclusion order under section 72 of the Act may be made on the voluntary application of a person at—

(a) each exit of the casino area; and

(b) each location where a person may seek payment of winnings.

Part 5—Transitional arrangements

31 Approval of first identity verification policy

(1) A casino operator must give the Commission a draft identity verification policy within 4 days after the commencement of this regulation.

(2) The Commission, within 4 days after receiving the draft identity verification policy, must—

(a) request changes to the identity verification policy; or

(b) approve the identity verification policy.

(3) In determining whether to approve the identity verification policy, the Commission must have regard to—

(a) the effectiveness of the policy in preventing gambling-related harm, money laundering and other criminal activity; and

(b) the effect of the policy on a person's experience at the casino, including the time it will take to verify a person's identity; and

(d) whether the policy will impose a significant economic burden on the casino operator, having regard to the likely administration and compliance costs of implementing the policy; and

(e) whether the policy will impose a significant social burden on the public; and

(f) whether the policy is compliant with these Regulations and any other requirements under the Act, the Gambling Regulation Act 2003 or any other Act.

(4) If the Commission requests changes to the identity verification policy under subregulation (2)(a), the casino operator, within 4 days after receiving the request, must—

(a) amend the identity verification policy in accordance with the Commission's request and submit a revised draft to the Commission; or

(b) with the written approval of the Commission, amend the identity verification policy in another way and submit a revised draft to the Commission.

(5) No later than 4 days after receiving a revised draft under subregulation (4), the Commission must approve the policy and notify the casino operator.

═════════════

Endnotes

1 General information

See www.legislation.vic.gov.au for Victorian Bills, Acts and current Versions of legislation and up-to-date legislative information.

The Casino Control Regulations 2023, S.R. No. 119/2023 were made on 21 November 2023 by the Governor in Council under section 167 of the Casino Control Act 1991, No. 47/1991 and came into operation as follows:

Regulations 1–4, 31 on 28 November 2023: regulation 3(1); regulations 5–30 on 14 December 2023: regulation 3(2).

The Casino Control Regulations 2023 will sunset 10 years after the day of making on 21 November 2033 (see section 5 of the Subordinate Legislation Act 1994).

INTERPRETATION OF LEGISLATION ACT 1984 (ILA)

Style changes

Section 54A of the ILA authorises the making of the style changes set out in Schedule 1 to that Act.

References to ILA s. 39B

Sidenotes which cite ILA s. 39B refer to section 39B of the ILA which provides that where an undivided regulation, rule or clause of a Schedule is amended by the insertion of one or more subregulations, subrules or subclauses the original regulation, rule or clause becomes subregulation, subrule or subclause (1) and is amended by the insertion of the expression "(1)" at the beginning of the original regulation, rule or clause.

Interpretation

As from 1 January 2001, amendments to section 36 of the ILA have the following effects:

• Headings

All headings included in a Statutory Rule which is made on or after
1 January 2001 form part of that Statutory Rule. Any heading inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, forms part of that Statutory Rule.
This includes headings to Parts, Divisions or Subdivisions in a Schedule; Orders; Parts into which an Order is divided; clauses; regulations; rules; items; tables; columns; examples; diagrams; notes or forms.
See section 36(1A)(2A)(2B).

• Examples, diagrams or notes

All examples, diagrams or notes included in a Statutory Rule which is made on or after 1 January 2001 form part of that Statutory Rule. Any examples, diagrams or notes inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, form part of that Statutory Rule. See section 36(3A).

• Punctuation

All punctuation included in a Statutory Rule which is made on or after
1 January 2001 forms part of that Statutory Rule. Any punctuation inserted in a Statutory Rule which was made before 1 January 2001, by a Statutory Rule made on or after 1 January 2001, forms part of that Statutory Rule.
See section 36(3B).

• Provision numbers

All provision numbers included in a Statutory Rule form part of that Statutory Rule, whether inserted in the Statutory Rule before, on or after
1 January 2001. Provision numbers include regulation numbers, rule numbers, subregulation numbers, subrule numbers, paragraphs and subparagraphs. See section 36(3C).

• Location of "legislative items"

A "legislative item" is a penalty, an example or a note. As from 13 October 2004, a legislative item relating to a provision of a Statutory Rule is taken to be at the foot of that provision even if it is preceded or followed by another legislative item that relates to that provision. For example, if a penalty at the foot of a provision is followed by a note, both of these legislative items will be regarded as being at the foot of that provision. See section 36B.

• Other material

Any explanatory memorandum, table of provisions, endnotes, index and other material printed after the Endnotes does not form part of a Statutory Rule. See section 36(3)(3D)(3E).

2 Table of Amendments

This publication incorporates amendments made to the Casino Control Regulations 2023 by statutory rules, subordinate instruments and Acts.

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

Casino Control Amendment Regulations 2025, S.R. No. 137/2025

Date of Making:	9.12.25
Date of Commencement:	9.12.25: reg. 3

–––––––––––––––––––––––––––––––––––––––––––––––––––––––––––––

3 Explanatory details

Reg. 14(2): S.R. No. 106/2025.

——

Penalty Units

These Regulations provide for penalties by reference to penalty units within the meaning of section 110 of the Sentencing Act 1991. The amount of the penalty is to be calculated, in accordance with section 7 of the Monetary Units Act 2004, by multiplying the number of penalty units applicable by the value of a penalty unit.

The value of a penalty unit for the financial year commencing 1 July 2025 is $203.51. The amount of the calculated penalty may be rounded to the nearest dollar.

The value of a penalty unit for future financial years is to be fixed by the Treasurer under section 5 of the Monetary Units Act 2004. The value of a penalty unit for a financial year must be published in the Government Gazette and a Victorian newspaper before 1 June in the preceding financial year. ↑

1 Casino Control Regulations 2023

Version No. 003

Casino Control Regulations 2023

S.R. No. 119/2023

Version incorporating amendments as at
9 December 2025

TABLE OF PROVISIONS

Regulation Page

Part 1—Preliminary 1

1 Objectives 1

2 Authorising provision 1

3 Commencement 2

4 Definitions 2

Part 2—Corporate ownership and governance 4

5 Independent board—prescribed functions of casino operator or directors 4

6 Independent senior management—prescribed periods and prescribed categories 5

Part 3—Pre-commitment, cashless gaming and carded play 7

Division 1—Mandatory pre-commitment 7

7 Requirements for setting limits for mandatory pre‑commitment 7

8 Consequences of person reaching limits for mandatory pre-commitment 7

9 Determining whether a person is ordinarily resident in Australia 7

Division 2—Cashless gaming 8

10 Cashless gaming requirements 8

10A Offences relating to cashless gaming 11

11 Identity verification for payment of winnings 11

Division 3—Carded play and identification 12

12 Identity verification for issue of player cards 12

13 Identify verification for re-issue of player cards 14

14 Requirements and specifications for player cards 15

15 Further requirements and specifications for player cards—commencing 1 July 2026 17

16 Further requirements and specifications for player cards—commencing 1 December 2027 18

18 Storage and access of photographs on player cards 19

19 Access, use and disclosure of player card information 19

20 Player cards—further requirements 20

21 Information and requirements for player activity statements 20

Division 4—Identity verification policy and related offences 24

23 Identity verification policy 24

24 Changes to identity verification policy 26

25 Information collected for the purpose of identity verification 27

Part 4—Exclusion orders 29

26 Treatment of accounts and loyalty scheme when person is subject to voluntary exclusion order 29

The instrument organises obligations across three core themes: governance, player identity and data, and play controls. Each concept is defined and deployed through prescriptive operational mechanics.

Governance: Regulation 5 prescribes the functions that an independent board must oversee, listed as accounting and financial management, internal and external audit and risk management, legal and regulatory compliance and reporting, security and surveillance, responsible service of gambling, harm minimisation and prevention, anti‑money laundering, international, VIP and premium player business, gambling product strategy and loyalty programs, staff training and development, information technology, and people, culture, integrity and senior executive appointment and remuneration. Regulation 6 prescribes the period for the independent senior management requirement (14 December 2023 until revocation) and lists specific senior executive categories (CEO, CFO, COO, head of gambling, head of harm minimisation and prevention, head of international and domestic VIP business, head of risk management, head of compliance, head of security, head of surveillance). The regulation ties the term "senior executive appointment and remuneration" back to those prescribed categories (reg 5(2)).

Player identity and carding: The Regulations create a comprehensive identity verification and carded play regime. Regulations 12 and 13 set the steps to verify identity for issuing and re‑issuing player cards, including in‑person sighting of government‑issued documents and photographic ID, and allowance for passport translation where necessary. Regulation 14 and the subsequent staged regs 15 and 16 impose technical specifications for player cards, including photograph quality and the capacity to record sessional, credit in/credit out and, from December 2027, cash used and cash paid out transactional data. Regulation 18 requires storage of a photographic copy in electronic form, accessible to employees and inspectors. Regulation 21 mandates monthly player activity statements in a Commission‑approved form with specified content and graphical comparisons, and regulation 19 restricts the use of player card data to regulatory purposes unless express consent for loyalty scheme use is obtained.

Pre‑commitment and cashless gaming: Regulation 7 requires that a person set a time limit and net loss limit according to the pre‑commitment system instructions before playing a gaming machine. Regulation 8 mandates that players who reach pre‑commitment limits are blocked from gaming machines until a new limit period commences and can withdraw funds using non‑cash gaming tokens. Regulation 10 sets cashless gaming system requirements: a minimum 15 minute delay from deposit to availability (with exemptions for cash/non‑cash token deposits and the first deposit each day), the right to cancel a deposit during that delay, password or PIN protection, the ability to set and change deposit limits with a 24 hour delay on increases, a prohibition on deposits that would exceed set limits, periodic prompts to set or change limits, and requirements about cashless terminal placement (not within 2 metres walking distance of a gaming machine). Regulation 10A forbids casino operators from encouraging increases to deposit limits or enabling automatic increases.

Data and privacy architecture: The Regulations cross‑reference the Privacy Act 1988 for the meaning of personal information and require prior notices about privacy matters when collecting identity verification data (reg 25(3)-(4)). They restrict access, use and disclosure of identification and player card data to regulatory purposes except where express consent is given for loyalty schemes, and place employee authorisation and necessity limitations on internal access (reg 25(2)).

Exclusion process: The instrument prescribes processes for voluntary exclusion orders, including remittance of funds and tokens, prohibition on establishing cashless accounts for excluded persons, minimum six month nomination for voluntary exclusion, obstacles against discouraging exclusion or incentivising shorter orders, and a conditioned revocation process requiring engagement with gambling counselling and assessment that the person is not at significant risk of harm (regs 26-30).

Temporal and administrative mechanics: The Regulations set commencement dates (reg 3), retention periods for data (7 years for player card data under regs 14(6), 15(3), 16(3)), a rapid initial identity policy submission and approval schedule (reg 31), and a sunset 10 years from making (endnotes). The 2025 amendment instrument S.R. No. 137/2025 is integrated by cross‑references and specific substitutions and insertions.

These main concepts embed compliance, recordkeeping and operational limitations with specified penalties and Commission oversight mechanisms.

Primary obligations fall on casino operators, their boards, senior management and employees. The Regulations repeatedly direct duties to "a casino operator" and to "casino employees" (for example regs 5, 6, 8, 10, 12, 23, 25). More specifically:

Casino operators must implement and maintain independent board oversight of prescribed governance functions (reg 5), appoint or designate independent senior management in prescribed categories (reg 6), operate pre‑commitment and cashless systems that meet technical and procedural requirements (regs 7-10, 10A), and implement identity verification, player cards and data handling systems meeting prescribed specifications (regs 11-21, 23-25).
Casino employees are subject to information access and use controls. Regulation 25(2) makes it an offence for a casino employee to access, use or disclose identity verification information unless authorised and necessary for compliance with legal obligations.
The Commission is given decisive administrative roles: approving identity verification policies (regs 23(1), 24), specifying content for player activity statements (reg 21(1)(a) and (d)), and receiving and deciding upon changes to identity verification policies within specified timeframes (reg 24). The Commission also may issue written notices to require additional data collection from player cards (reg 14(5)(b)).
Inspectors have access rights to electronic photographs stored under regulation 18(2)(c) for regulatory purposes.
Players are affected in multiple ways. All persons to whom player cards are issued must have primary country of residence recorded (reg 9(2)). Players are required to set pre‑commitment time and net loss limits in accordance with the pre‑commitment system (reg 7). Players who use cashless gaming accounts will be required to interact with deposit limits and may have to provide identity documentation to receive winnings over $1,000 (reg 11). Active players will receive monthly player activity statements unless they opt out of the method offered (reg 21). Players subject to voluntary exclusion orders are affected by immediate closure or remittance of funds and restricted ability to hold cashless accounts (reg 26).
Third parties involved in loyalty schemes can receive player card data only with express consent from the player (reg 19(2)).

Financial and operational consequences flow to casino operators through compliance costs, data storage and IT configuration requirements, employee training obligations, Commission approval processes and monetary penalties for contraventions. Players face behavioural constraints,blocked access at limits, the need to provide approved identification to obtain winnings above $1,000, monthly statements that may affect choices, and structured exclusion processes. The Commission and inspectors are empowered to approve, require changes and inspect compliance, creating decision points that determine operational permissibility.

This section lists the principal positive and negative duties, the rights created by the Regulations, and the decision points they allocate.

Duties of casino operators

Governance oversight duties: Ensure the independent board oversees the functions listed in regulation 5. The list is exhaustive for prescribed functions and includes anti‑money laundering and harm minimisation (reg 5(1)(a)-(l)). The board must cover senior executive appointment and remuneration for categories in regulation 6(b) (reg 5(2)).
Senior management prescriptions: Ensure senior executives in the listed categories are employed or appointed in accordance with section 36ZC of the Act during the prescribed period (reg 6(1)).
Pre‑commitment duties: Require players to set a time limit and net loss limit as instructed by the pre‑commitment system before using a gaming machine (reg 7). Block play when limits are reached and permit withdrawal of non‑cash gaming tokens (reg 8(1)-(2)).
Cashless gaming duties: Implement the minimum 15 minute deposit hold, permit cancellation during that period, ensure terminal placement not within 2 metres walking distance of a gaming machine, require security credentials for access, enable setting and changing deposit limits with immediate effect for decreases and 24 hour delay for increases, prevent deposits exceeding deposit limit, prompt players at least annually to set or change deposit limits where certain transfer types are permitted, publish and make simple the account closure process and remit any funds promptly upon closure (reg 10(1)(a)-(m), 10(2)).
Prohibitions: Do not encourage or induce a player to increase a deposit limit and do not enable automatic increases to amount available for gaming (reg 10A(1)-(2)).
Identity verification duties: Verify identity prior to issuing and re‑issuing player cards (regs 12-13), verify identity before paying winnings over $1,000 (reg 11), and implement and obtain Commission approval for an identity verification policy and ensure compliance and staff training (reg 23).
Data duties: Ensure player cards capture sessional and, from specified dates, credit and transactional data (regs 14-16), retain player card data for 7 years (reg 14(6), 15(3), 16(3)), store and make photographs electronically accessible (reg 18), and restrict access, use and disclosure of card and identity verification data to regulatory purposes unless express consent is obtained for loyalty use (regs 19, 25).
Exclusion duties: Facilitate voluntary exclusion applications through multiple methods, remit funds promptly for excluded persons and not establish cashless accounts for excluded persons, and follow structured revocation procedures including requiring counselling and a 28 day waiting period after conditions are met before revoking (regs 26-30).
Administrative duties: Provide player activity statements in Commission‑approved form within 7 days after each calendar month, include specified content and graphical comparisons, and offer delivery method choices (reg 21).

Rights and decision points

Commission authority: The Commission has approval and refusal powers for identity verification policies and must consider specified factors when making decisions (reg 24(3)-(4); reg 31 for initial policy). The Commission must notify reasons if refusing approval (reg 24(5)).
Player choices: Players may choose to receive player activity statements by post, email or inside the casino (reg 21(1)(e)). Players may set deposit limits or elect in writing not to set one, and may change deposit limits (reg 10(1)(d)-(i)).
Consent requirement: Players can permit use of player card data for loyalty schemes by giving express consent, which then allows the casino operator to disclose data for that non‑regulatory purpose (reg 19(2)).

Enforcement and penalties

Monetary penalties: Numerous contraventions attract a penalty of 20 penalty units, for example failing to block play on reaching pre‑commitment limits (reg 8(1)), misuse of player card data (reg 19(1)), and failures in identity verification policy compliance (reg 23). The endnotes specify the value of a penalty unit for the financial year commencing 1 July 2025 as $203.51 and the mechanism for calculating penalty amounts (Endnotes: Penalty Units).
Administrative enforcement: The Regulations use Commission approvals, notices and inspectors’ access as enforcement levers, with specific statutory offences for employee misuse of identity information (reg 25(2)) and prohibitions about discouraging exclusion or prompting shorter exclusions (reg 27).

These duties allocate operational, IT, personnel and procedural burdens to casino operators and their staff, create decision‑making authority for the Commission on identity policy matters, and create rights for players to choose statement delivery and to consent to loyalty uses.

The Regulations attach monetary penalties for multiple contraventions, assign administrative approval and oversight powers to the Commission, and confer limited inspector and employee access rights.

Monetary penalties

Many offences are specified with a standard penalty: 20 penalty units. Examples include:
- Failure to prevent play when a person reaches a pre‑commitment time or net loss limit (reg 8(1)).
- Failure to allow withdrawal of funds by non‑cash gaming token when limits are reached (reg 8(2)).
- Breaches of cashless gaming prohibitions such as encouraging a person to increase a set deposit limit and enabling automatic increases (reg 10A(1)-(2)).
- Making non‑regulatory use of player card data (reg 19(1)).
- Failing to have or to comply with an identity verification policy (reg 23(1)-(2)).
- Employee unauthorised access or disclosure of identity verification information (reg 25(2)).
- Contraventions in player card handling such as more than one active card, gambling with another person’s card, incorrect specification of legal name, and linking a player card to a pre‑commitment account not in the legal name (reg 20(2)-(5)).
- Failure to remit funds on voluntary exclusion, or establishing a cashless account for an excluded person (reg 26(1)-(2)).
The endnotes specify the monetary value of a penalty unit for the financial year commencing 1 July 2025 as $203.51, and require calculation of monetary penalties by multiplying the number of units by the penalty unit value under the Monetary Units Act 2004 (Endnotes: Penalty Units). The Regulations do not itself provide the dollar amount per unit beyond that endnote; future values will be set by the Treasurer and published (Endnotes).

Administrative enforcement and oversight

Commission approvals and notices: The Commission must approve identity verification policies (reg 23(1)), and the Regulations require a casino operator to submit an initial draft identity verification policy promptly (within 4 days; reg 31(1)). The Commission must approve or request changes within tight timelines: for initial policies a 4 day decision period (reg 31(2)); for subsequent change requests, the Commission must decide within 14 days (reg 24(3)). When refusing to approve a change to the identity verification policy, the Commission must provide reasons (reg 24(5)). The Commission can require a casino operator to collect additional data on player cards by written notice (reg 14(5)(b)). The Commission therefore acts as an active regulator controlling identity policy content and thereby operational practice.
Inspector access: Regulation 18(2)(c) requires that the electronic copy of the photograph on a player card is readily accessible to a casino employee or an inspector for regulatory purposes. The text thereby enables inspectors to view photographs as part of oversight.
Internal controls and employee authorisation: Regulation 25(2) criminalises employee access to identity verification data unless authorised and necessary to comply with legal or regulatory obligations. This places a compliance obligation on casino operators to design and implement role‑based access controls and approval processes.

Other enforcement mechanics

The Regulations include both prohibition‑style offences and affirmative duties tied to procedures (for example, to remit funds to excluded persons as soon as practicable; reg 26(1)(a)). Some duties require specific operational modalities such as providing player activity statements within 7 days after the end of each calendar month (reg 21(1)(b)). Failure to meet these timeframes could expose the operator to penalty units where an explicit offence is attached.
The Regulations do not set out the mechanics of prosecutions, administrative fines or intervention powers beyond the penalties and the Commission's approval and notice role. Enforcement action and remedies beyond pecuniary penalties are therefore to be found in the Act and other instruments; the Regulations situate operational offences and specify the Commission's approvals.

The mix of monetary penalties, Commission approvals with strict timelines, inspector access and employee access offences creates a layered enforcement architecture. Casinos bear exposure to fixed penalty unit fines and to Commission regulatory oversight that can withhold approval or demand changes, while inspectors and internal compliance systems form the immediate monitoring nodes.

The Regulations operate as subordinate legislation under the Casino Control Act 1991 and cross‑reference and integrate obligations from several other statutes and instruments. The text itself identifies the principal legal interfaces.

Primary enabling and supervisory law

Casino Control Act 1991: These Regulations are made under section 167 of the Act (regulation 2). Several duties are expressly framed "for the purposes of" particular sections of the Act. For example, regulation 5 is “for the purposes of section 36ZB(2) of the Act” and regulation 6 is “for the purposes of section 36ZC(a) of the Act.” Provisions on pre‑commitment and player cards reference sections 62C, 64A, 71B, 71C and 71E of the Act (regs 7, 10, 12, 14, 21 respectively). Readers must consult the Act for the broader statutory context and for enforcement and licensing powers that sit above these Regulations.

Cross‑reference to gambling legislation

Gambling Regulation Act 2003: Several definitions and the concept of the pre‑commitment system derive from the Gambling Regulation Act 2003. The Regulations import the meaning of "gambling" from section 1.3AA of that Act (reg 4). Regulation 14(2) requires player cards to be registered as per the Gambling Regulation (Pre‑commitment and Loyalty Scheme) Regulations 2025. The pre‑commitment system has the same meaning as in section 3.8A.1 of the Gambling Regulation Act 2003 (reg 4). These links mean that changes in the Gambling Regulation Act or its subordinate instruments can alter how these Regulations operate in practice.

Privacy and AML/CTF instruments

Privacy Act 1988: The Regulations adopt the Privacy Act definition of "personal information" and require disclosure notices consistent with the Privacy Act prior to collecting identity verification information (reg 25(3)-(4)). The Regulations also require provision of privacy‑related notices in multiple formats and languages (reg 25(4)(a)-(g)).
Anti‑Money Laundering and Counter‑Terrorism Financing rules: The definition of Australian Government Entity mirrors the definition in the AML/CTF Rules Instrument 2007 (reg 4). Anti‑money laundering is also an express area of independent board oversight (reg 5(1)(g)). Where AML obligations in Commonwealth law exist, the casino operator must satisfy those obligations concurrently with the identification and recordkeeping duties in these Regulations.

Interpretation and measurement rules

Interpretation of Legislation Act 1984: Regulation 10(3) explicitly states that section 43 of the Interpretation of Legislation Act 1984 does not apply to the measurement of any distance for the purposes of subregulation 10(1)(c). The endnotes also record style and interpretation effects arising from the ILA, indicating that headings, examples, punctuation and provision numbers form part of the statutory rule as per ILA provisions.

Monetary units and penalty calculation

Monetary Units Act 2004 and Sentencing Act 1991: The Regulations express penalties in penalty units. The endnotes explain that penalty units are defined under section 110 of the Sentencing Act 1991 and the value of a penalty unit is fixed under the Monetary Units Act 2004 and updated by the Treasurer. For the financial year commencing 1 July 2025 the endnote gives the penalty unit value as $203.51 and explains the calculation method.

Regulatory instrument interplay and staged requirements

The Regulations explicitly incorporate and rely upon other subordinate instruments, such as the Gambling Regulation (Pre‑commitment and Loyalty Scheme) Regulations 2025 for the definition of a registered player card (reg 14(2) and endnote reference). The 2025 Casino Control Amendment Regulations S.R. No. 137/2025 modifies many provisions, demonstrating that subordinate instrument interplay affects operative duties.

Administrative law and Commission decisions

Commission approval processes and decision timelines are set in the Regulations for identity verification policy matters (regs 23-24, 31). Those Commission decisions will be subject to the administrative law framework that governs decisions of public statutory bodies, though the Regulations do not recite judicial review or appeal procedures.

In sum, the Regulations sit inside a network of Commonwealth and State instruments: the Casino Control Act provides the enabling authority, the Gambling Regulation Act and its subordinate instruments set the pre‑commitment and player card registration context, the Privacy Act and AML/CTF instruments shape identity and information duties, and the ILA and penalty unit statutes determine interpretation and penalty calculation. Operators must map compliance across these instruments rather than treating the Regulations in isolation.

The Regulations as published include incorporated amendments to 9 December 2025. The instrument itself and its endnotes identify the amendment record and specific changes.

Key amendment instrument and dates

Casino Control Amendment Regulations 2025, S.R. No. 137/2025: Made 9 December 2025, commenced 9 December 2025 (Table of Amendments). The text denotes multiple insertions, substitutions and revocations as effected by S.R. No. 137/2025. The endnotes and in‑text marginal notes indicate where particular regulations were substituted, amended, inserted or revoked by the 2025 instrument. Examples include substantial insertions to regulation 10 (cashless gaming requirements), the insertion of regulation 10A (offences relating to cashless gaming), and substitutions in regulations 14-16 (player card requirements), among others (see in‑text annotations such as "Reg. 10(1)(c) amended by S.R. No. 137/2025 reg. 7(1)(a)").

Other amendments referenced

Reg. 14(2): S.R. No. 106/2025 is noted in the Explanatory details as the source for that substitution. The text in the endnotes shows that amendments and prior versions have been integrated into the present consolidated text.

Nature of the 2025 amendments

The 2025 amendments add granularity and new prohibitions to cashless gaming (for example deposit limits, transfer source restrictions and customer prompts to set limits, and the 2 metre terminal placement rule), create new offences regulating operator encouragement to increase deposit limits and automatic increases (reg 10A), and elaborate substantially on player card data capture, including phased additions of credit in/credit out data (1 July 2026) and cash transactional capture (1 December 2027) in regs 15 and 16 respectively. Amendments also tightened identity policy change procedures and data handling, and inserted or modified several penalty items.

Transitional and commencement mechanics

The Regulations provide for staged commencement. Regulations 1-4 and regulation 31 commenced 28 November 2023, while regulations 5-30 commenced 14 December 2023 (Endnotes). Several requirements themselves have staged implementation dates: the player card capture of credit in/credit out from 1 July 2026 (reg 15) and cash transaction capture from 1 December 2027 (reg 16). The 2025 amendments took effect 9 December 2025 and modified certain operative paragraphs and inserted transitional obligations such as deadlines for cashless account holders to set deposit limits by 9 December 2025 where accounts permitted transfers from ADIs or institutions outside Australia (reg 10(1)(e)(i-ii)).

Sunset provision

The endnotes state that the Casino Control Regulations 2023 will sunset 10 years after the day of making on 21 November 2033 per section 5 of the Subordinate Legislation Act 1994. This creates a statutory expiry for the instrument unless re‑made or preserved under the relevant statute.

Implication for compliance

The amendment history in the instrument shows active rule evolution across 2025 with both technical additions and new offences. Compliance timelines are therefore multi‑year and operators must manage both retrofitting systems for new data capture dates and meet immediate new prohibitions and reporting processes introduced by amendments. The instrument integrates amendment notes inline so that operators can trace which paragraphs were altered by which statutory rule.

The Regulations and the accompanying endnotes do not record any litigation or judicial decisions interpreting these Regulations. The instrument includes no case citations, and the endnotes do not list judicial proceedings. The primary legal references are to the enabling Act, the Gambling Regulation Act 2003, the Privacy Act 1988, the Monetary Units Act 2004, the Sentencing Act 1991 and the Interpretation of Legislation Act 1984.

Implications of an absence of recorded litigation

No judicially developed interpretive guidance is included in the instrument. Practitioners will therefore need to rely on the text of the Regulations, the Act and related instruments for statutory construction and to predict how ambiguous provisions might be applied in enforcement proceedings.
Where the Regulations create offences or prescriptive duties (for example around data use, identity verification and cashless gaming constraints), questions of evidence, the standard of "reasonable steps", or what constitutes "readily accessible" data will initially be matters for the Commission, inspectors and, if contested, courts to decide. The Regulations do not define enforcement discretions or appeal routes beyond the Commission’s obligations to notify reasons when refusing identity policy changes (reg 24(5)). Administrative law principles and Act provisions will govern reviewability.
The absence of litigation in the instrument does not mean disputes will not arise. Areas likely to generate contested interpretation include:
- The scope of "non‑regulatory purpose" and application of the consent exception for loyalty schemes (regs 4, 19).
- The meaning of "reasonable steps" for identity verification and document validity checks (regs 12(2), 12(8)-(10), 23(3)).
- The mechanics of the 15 minute deposit hold and the exceptions in reg 10(2) where cash or non‑cash token deposits or daily first deposits are excluded from the hold.
- The Commission's timely approval process for identity verification policies and the remedies where the Commission refuses or requests changes (regs 24, 31).

Until administrative decisions are litigated, practitioners must interpret the Regulations against ordinary statutory construction principles, the Act and interrelated instruments. Any compliance risk assessment should treat untested areas as zones of regulatory and litigation uncertainty.

This section flags provisions that commonly produce operational friction, timing pressure, or unintended administrative consequences when implemented.

Tight timeframes for identity policy approval

The initial identity verification policy must be submitted to the Commission within 4 days after the commencement of regulation 31, and the Commission has 4 days to request changes or approve (reg 31(1)-(2)). The subsequent process for changes gives the Commission 14 days to decide (reg 24(3)). These compressed windows create a short runway for drafting, legal review and stakeholder consultation. Failure to submit or to obtain approval amounts to an offence carrying 20 penalty units (reg 23(1)).

Staged data capture obligations with long retention

Player cards must capture sessional data immediately (reg 14(5)). From 1 July 2026 they must also record credit in and credit out times and amounts (reg 15(1)), and from 1 December 2027 cash transactional data must be recorded (reg 16(1)). All player card data must be retained for seven years (regs 14(6), 15(3), 16(3)). Operators will need IT systems capable of progressively expanding capture fields and of secure long‑term retention while ensuring access controls and privacy compliance. Legacy systems designed only for earlier requirements may require substantial upgrades.

Definitions of “non‑regulatory purpose” and loyalty schemes

The Regulations prohibit use or disclosure of player card information for non‑regulatory purposes (reg 19(1)), but allow access, use or disclosure for loyalty schemes only with express consent (reg 19(2)). Operators who already operate loyalty programs must ensure consent is explicit and documented, and that operational flows separate regulatory data use from loyalty program processing. Consent logistics for existing accounts may require re‑consent campaigns and audit trails.

Deposits, deposit limits and deposit source restrictions

Regulation 10 introduces multiple constraints: a 15 minute delay for deposits to be available (subject to exceptions at reg 10(2)), requirement to set deposit limits or provide a written waiver where transfers from ADIs or external institutions are permitted (reg 10(1)(d)-(e)), and a 24 hour delay before increases to deposit limits take effect (reg 10(1)(i)). The 9 December 2025 deadline for those with accounts permitting transfers from ADIs or offshore institutions to set limits or submit written waivers (reg 10(1)(e)) is a hard date inserted by amendment. Operators must implement account logic to prevent deposits exceeding limits and to prevent first‑deposit exceptions from being abused.

Terminal placement measurement exception

The 2 metre walking distance rule for cashless gaming terminals from gaming machines is specified (reg 10(1)(c)). Regulation 10(3) provides that s 43 of the Interpretation of Legislation Act 1984 does not apply to measuring distance for this purpose. This creates potential ambiguity about measuring a "walking distance" in complex casino floorplans and may require operators to adopt conservative placement policies or seek guidance from the Commission.

Prohibitions on encouraging increases and enabling automatic increases

Regulation 10A(1) and (2) create operator offences for encouraging deposit limit increases and for permitting automatic increases. Marketing and loyalty officers must avoid communications or UI flows that could be interpreted as inducements. The absence of detail about what constitutes "encourage or induce" increases might create compliance uncertainty.

Identity verification thresholds and forms of ID

Paying winnings over $1,000 requires verification by sighting photographic identification issued by an Australian Government Entity or a passport (reg 11(4)). For player card issuance and re‑issue the operator must sight at least one government document and at least one photographic identification (regs 12(6)-(7)). Where documents are in other languages, an accredited translator’s English translation may be requested (regs 9(4), 12(10)(c)). The "reasonable steps" standard for verification (reg 12(2)) is context dependent and will rely on operational protocols.

Voluntary exclusion revocation conditions and contact prohibitions

Operators must not contact a person subject to a voluntary exclusion order to notify expiry (reg 29(2)). Revocation before expiry requires evidence of counselling engagement and the operator must be satisfied the person is not at significant risk of gambling harm before revocation takes effect, which then occurs 28 days after the conditions are met (reg 29(3)-(4)). The operator therefore must manage revocation workflows, counselling verifications and the 28 day administrative delay. The prohibition on contacting excluded persons about expiry raises customer‑service and operational visibility issues.

Documentation, multilingual notices and Easy Read obligations

Regulation 25(4) requires that privacy and retention notices be provided at the point of sign up, displayed at sign up and cashier locations, be available electronically on request, in multiple languages and available in Easy Read English. This creates content production, translation and accessibility obligations that operators must budget and resource.

Commission discretion over policy acceptance

The Commission's approval criteria for identity verification policy include effectiveness in preventing harm and money laundering, effect on customer experience, current technological capability, economic burden on the operator, and social burden (reg 24(4); reg 31(3)). These multi‑factor criteria give the Commission scope to require changes on qualitative grounds, making the approval process potentially iterative and resource intensive.

Penalty unit volatility

Monetary exposure is expressed in penalty units. The endnotes note a specific penalty unit value for FY2025 ($203.51) but the Treasurer sets future values annually (Endnotes). Operators must therefore model fine exposure against evolving penalty unit values.

Each "gotcha" is a concrete operational risk that flows from the Regulations’ form. Operators should map these items into project plans with assigned owners and timelines.

This section provides structured, source‑grounded steps operators should follow to align operations with the Regulations. Every step references the Regulation(s) that impose the duty.

Governance and senior management

Board oversight: Update the independent board’s mandate and committee charters so the board explicitly oversees the functions listed in regulation 5(1)(a)-(l). Amend delegation schedules to ensure oversight of anti‑money laundering, harm minimisation, VIP business, product strategy and IT are allocated and reported on regularly (reg 5).
Senior executive appointments: Ensure that the specified senior executive categories listed in regulation 6(b) are employed or appointed in accordance with section 36ZC of the Act for the prescribed period starting 14 December 2023 and until revocation. Document appointment authority and reporting lines to demonstrate compliance with the prescribed categories (reg 6).

Identity verification and policy

Draft and submit identity verification policy: Prepare an identity verification policy that addresses the elements mandated in regulation 23(3)(a)-(f), including which forms of identification will be accepted, reasonable steps to verify identity and confirm document validity, residency checks, risk‑based escalation triggers for further checks, and steps to prevent non‑regulatory use of identity data. Include training modules and passport security feature recognition per regulation 23(4)-(5).
Initial submission timetable: Submit the draft identity verification policy to the Commission within the 4 day initial window under regulation 31(1). Prepare to respond to Commission change requests within 4 days if requested (reg 31).
Approval process: Track the Commission’s 14 day decision timeframe for subsequent changes, and be ready to provide technical evidence of technological capability, cost estimates and social burden assessments as the Commission must consider these factors (reg 24(3)-(4)).

Player cards: issuance, data capture and retention

Issue compliant player cards: Ensure player cards meet the registration requirements referenced in regulation 14(2) and include acceptable photographs that meet regulation 14(4)(a)-(f). Do not charge fees for issuing or re‑issuing cards required by these Regulations (reg 14(6) and reg 15(4), reg 16(4)).
Data capture architecture: Configure player cards and backend systems to capture sessional data per regulation 14(5)(a)(i)-(v) and any additional Commission notices (reg 14(5)(b)). Implement phased capture for credit in/credit out from 1 July 2026 (reg 15(1)) and cash transactional data from 1 December 2027 (reg 16(1)). Ensure data schemas and logs are capable of storing the specific fields and timestamps required.
Retention and access controls: Maintain captured data for seven years and implement role‑based access controls. Ensure photographs are stored electronically and are visible to an employee or inspector when a card is scanned (reg 18). Document retention and deletion policies and operationalise the Privacy Act notices required under regulation 25(3)-(4).

Cashless gaming and deposit limit processes

Cashless system controls: Build the 15 minute deposit hold where applicable, with clear UI allowing cancellation during the hold that is no more difficult than making the deposit (reg 10(1)(a)-(b)). Exclude the first deposit each day and cash/non‑cash token deposits from the 15 minute requirement as per regulation 10(2).
Deposit limits and waivers: Implement functionality to require customers to set a deposit limit or to provide a written notification that they decline to set one when the account permits transfers from ADIs or foreign financial institutions, including ensuring customers with such transfer permissions have set limits or submitted waivers by the 9 December 2025 deadline indicated in the text (reg 10(1)(d)-(e)). Allow deposit limit changes with immediate effect for decreases and a 24 hour delay for increases, and prevent deposits that would exceed limits (reg 10(1)(i)-(k)).
Annual prompts and account closure: Implement an annual prompt for users who use ADI or offshore transfers to set or change deposit limits (reg 10(1)(k)). Publish clear and simple account closure instructions on the operator’s website, allow closure requests by telephone, email, terminal or player service point, and remit funds as soon as possible on closure (reg 10(1)(l)-(m)).
Prohibition compliance: Prohibit marketing or staff incentives that could be seen as encouraging players to increase deposit limits and disable any UI that allows automatic increases to amounts available for gaming (reg 10A).

Pre‑commitment and machine blocking

Pre‑commitment configuration: Ensure integration with the jurisdictional pre‑commitment system so that the system provides instructions for setting time and net loss limits and that such limits are enforced before a player accesses a gaming machine (reg 7). Implement blocking logic so that once a person reaches limits they cannot play gaming machines until a new limit period commences (reg 8(1)). Ensure non‑cash gaming token withdrawals remain available when limits are reached (reg 8(2)).

Winnings and identity checks

Winnings verification: For payout of winnings or accumulated credits exceeding $1,000, implement a process to sight photographic identification that displays full name and either date of birth or residential address, and to be reasonably satisfied the ID matches the player card and belongs to the person (reg 11(1)-(3)). Acceptable documents are specified in regulation 11(4).
Re‑issue workflows: For re‑issuance of player cards within five years, implement the two permitted verification processes in regulation 13(2). Ensure multi‑factor authentication is implemented securely for the re‑issue channel that does not involve staff.

Player activity statements and reporting

Monthly statements: Automate generation and delivery of player activity statements in a Commission‑approved form within seven days after the end of each calendar month, or within seven days after a player requests a statement for the previous calendar month (reg 21(1)(b)-(c)). Include the required data fields and graphical comparisons specified in regulation 21(3)-(5).
Delivery options: Offer delivery by post, email or within the casino complex, and ensure email statements are attached or directly linked without additional security hurdles to open (reg 21(1)(e), 21(6)). Provide daily summaries on request as described in regulation 21(5)(b).

Exclusion procedures

Voluntary exclusion process: Provide channels for voluntary exclusion applications in person, by email or online and require the applicant to nominate at least six months for the exclusion period (reg 28(1)-(2)). On the taking effect of the voluntary exclusion, promptly remit funds from deposit or cashless accounts and surrender or redeem non‑cash gaming tokens as required (reg 26(1)). Do not create cashless accounts for excluded persons (reg 26(2)).
Revocation handling: If a person applies for early revocation, require engagement with gambling counselling services and evidence that the person has engaged, and assess that revocation will not create significant risk of harm. Revocation takes effect 28 days after conditions are met (reg 29(3)-(4)). Do not contact excluded persons to advise expiry of the order (reg 29(2)).

Training, documentation and audits

Employee training: Implement and document identity verification training that includes passport security feature recognition (reg 23(4)-(5)). Train staff on data access authorisation protocols to avoid contraventions under regulation 25(2).
Policies and notices: Publish and display the required privacy and retention notices where player cards are obtained or winnings collected, in multiple languages and in Easy Read format, and make them available electronically and on request (reg 25(3)-(4)).
Internal audit and logs: Maintain audit logs for access to identity verification data and player card data to demonstrate that access is authorised and necessary (reg 25(2)). Prepare to produce photographs and other records to inspectors upon request (reg 18(2)(c)).

Board reporting and Commission engagement

Regular reporting: Establish board and executive reporting on compliance with the Regulations, including incidents, policy change submissions to the Commission, data breach notifications, and results of internal audits of identity verification and cashless gaming functions (reg 5, reg 24).
Commission interactions: Prepare to respond within Commission timelines and maintain records supporting claims about technological capability, costs, social burden, and effectiveness when seeking policy approvals or amendments (reg 24(3)-(4)).

Monitoring and review

Compliance register: Maintain a register of obligations, commencement dates and staged requirements (1 July 2026 and 1 December 2027), deadlines for deposit limit waivers or settings (e.g. 9 December 2025 where applicable), and retention schedules (7 years).
Legal review: Conduct periodic legal review to ensure alignment with changes in the Gambling Regulation Act, the registered player card regime in the Gambling Regulation (Pre‑commitment and Loyalty Scheme) Regulations 2025, and any Commonwealth AML or privacy rules that may affect identity verification and data handling.

Following these procedural steps, grounded in the cited Regulations, will help align policy, operations and IT to the instrument’s detailed requirements and reduce exposure to the monetary penalties and Commission actions specified in the Regulations.

Casino Control Regulations 2023

Plain English Summary

Deep Dive

What it does

Current sections

Casino Control Regulations 2023

Source text: opening excerpt

1 Casino Control Regulations 2023

Main concepts

Who it affects

Key duties and rights

Penalties and enforcement

How it interacts with other laws

Amendment history

Litigation history

Gotchas

How to comply