Casino Regulations 2013

The Regulations centre on a handful of regulatory levers and technical concepts. Each is defined or deployed in the text and has clear operational consequences.

Prescribed jurisdictions (r 4). The Regulations list New South Wales, New Zealand, Queensland and Victoria as “prescribed jurisdictions” for the purposes of s 40A(2) of the Act. That designation ties the South Australian approval regime into interstate and New Zealand standards for gaming‑machine approvals as a comparability device.

Standards and approval (r 5). The Australian/New Zealand Gaming Machine National Standard 2016 (or any subsequent version) is the baseline technical standard required for approval of gaming machines or games, subject to the local South Australian or other jurisdiction Appendix (r 5(3), (4)). The Regulations create a limited economic‑viability carve‑out: machines already approved or taken to have been approved under s 40A of the Act need not be modified where it is not economically viable to do so (r 5(3a)(a)-(b)). The effect is to require conformity to the ANZ standard for new or modified machines while limiting retrofitting where cost removes commercial feasibility.

Facial recognition (r 7; r 10). The Commissioner’s approval of a facial recognition system is conditioned on functionality (capable of accurately accounting for physical variances in facial features), security (designed to prevent unauthorised access, use and disclosure), and the ability to be operated in accordance with technical, security and other Commissioner‑determined criteria (r 7). Use of data is restricted: data may not be used to encourage gambling, support loyalty programs, be used in lotteries, be used to identify barred persons at other venues, or be used for other Commissioner‑notified purposes (r 10(1)). There are notice and retention rules for facial images and identifying data (r 10(2)(a)-(b)): an approved form of notice must be displayed at each entrance; and facial images or identifying data for persons who are not barred may not be retained beyond 72 hours.

Pre‑commitment (r 8; Sch 2). The Regulations require a pre‑commitment system operated by the licensee in compliance with the Voluntary Pre‑commitment Code (r 8). Schedule 2 prescribes registration methods, the information that must be provided to a registering customer, default and user‑set limits (default spend limit $100 per day, unless customer specifies otherwise), mechanisms to set and vary limits with timing restrictions for increases, messaging and acknowledgement flows at specified thresholds (50%, 75%, 90% and further escalation percentages), staff notification requirements, language and communication preferences, periodic activity statements every 6 months and on‑demand activity statements for certain periods (Sch 2 items 1-19).

TITO (r 9; Sch 4). For any ticket‑operable gaming device, the licensee must ensure it is connected to a TITO system that complies with the requirements in the Regulations. Until 3 December 2020, that meant compliance with Schedule 4 TITO technical requirements; after that date, TITO systems are to comply with gambling administration guidelines issued under s 17 of the Gambling Administration Act 2019 (r 9(2)). Schedule 4 contains detailed technical requirements for tickets, peripheral devices, ticket‑in and ticket‑out processes, cashier and cash redemption terminals, logging, redundancy, host resilience, ticket expiry, handling of duplicates, partial prints and orphaned tickets, and auditability (Sch 4 items 1-8).

Ticket limits and controls (r 9(3)-(6); Sch 4). Tickets must not contain promotional material (r 9(3); Sch 4 cl 2.6 and 2.1.6). A machine must not accept a ticket for redemption at the machine if the cash value exceeds $149.99 (r 9(4)). A ticket with credit value above $5,000 may only be issued if manually enabled by an authorised person (r 9(5)). Tickets expire after 12 months and cannot be redeemed after that (r 9(6)). Schedule 4 further provides for configurable maximum and minimum ticket in and out limits and for expiry times (Sch 4 cl 3.12; 3.14).

Transitional rules and review rights (Sch 3). Schedule 3 contains transitional provisions for approvals that predate changes, and preserves, for a transitional period, the licensee’s right to apply to the Licensing Court for a review of prescribed decisions despite repeal of Part 8 of the Act, until a day declared by Ministerial notice (Sch 3 cl 3).

The regulatory architecture thus combines prescriptive technical standards, operator duties to run systems in particular ways, Commissioner discretion to set some approval criteria and signage formats, default behavioural settings for customers (pre‑commitment defaults and messages), and detailed technical obligations for TITO host and devices.

Primary regulated parties. The Regulations bind licensees under the Casino Act 1997. The text consistently frames duties as obligations on “the licensee” (see r 8, r 9(1), r 10(2)(a), Sch 2 items 1-19, Sch 4 generally). Licensees are required to operate, maintain and make available pre‑commitment and TITO systems, to obtain and implement Commissioner approvals for facial recognition systems, and to ensure that gaming machines conform to the prescribed standards (r 5, r 7, r 8, r 9).

Service providers and vendors. Technical vendors, integrators and system providers who supply gaming machines, TITO hosts, peripherals, facial recognition systems or pre‑commitment software are indirectly affected because the Regulations specify technical and security requirements the systems must meet. For facial recognition, the Commissioner can determine “technical requirements, security requirements and any other criteria” for approval (r 7); for TITO hosts and peripherals, Schedule 4 sets detailed design and logging specifications (Sch 4 cll 3, 4, 8). System providers will need to deliver equipment and software that conforms to the printing, logging, communications protocols, redundancy and security requirements in Sch 4.

Casino patrons. The Regulations directly shape customer experience and options. The Voluntary Pre‑commitment Code requires licensees to permit customers to register, to offer default expenditure limits of $100 per day if the customer does not select a limit (Sch 2 item 7), and to provide reminders at multiple thresholds during play (Sch 2 item 10.3-10.5). The pre‑commitment system must prevent play continuation without acknowledgement of reminders in certain screen contexts (Sch 2 item 10.8-10.9). Ticket limits affect how much cash value can be redeemed at a gaming machine (r 9(4)) and the availability of cash redemption options for larger sums (Sch 4 cl 3.13, 6.7). Facial recognition affects every person entering the casino because of the notice requirement at entrances and retention rules (r 10(2)(a)-(b)).

Casino staff and authorised attendants. Staff perform operational roles that the Regulations require. The licensee must authorise persons to manually enable issuance of tickets above $5,000 (r 9(5)). The pre‑commitment system must notify staff when customers exceed limits or fail to comply with no‑play periods (Sch 2 items 3.4.2, 10.6). Cashier and cash redemption terminal operations must log staff member identifiers for transactions (Sch 4 cll 7.7-7.8). Staff training and tiered access controls for cashier terminals are mandated (Sch 4 cl 7.4-7.6).

Regulatory decision makers. The Commissioner has substantive roles and discretions: to approve facial recognition systems subject to criteria (r 7), to determine the form and manner of entrance notices (r 10(2)(a)), and to notify prohibited uses under r 10(1)(e). The Commissioner can also publish facial recognition requirements on a public website for transitional approval regimes (Sch 3 cl 2(1)). These delegations concentrate technical gatekeeping with the Commissioner.

Researchers and the regulator. The licensee must provide the Commissioner, on request, with de‑identified pre‑commitment system data for gambling research (Sch 2 item 19). This creates a data flow from licensees to regulators for policy analysis, subject to de‑identification.

Other jurisdictions and standard setters. The Regulations reference interstate and trans‑Tasman standards and appendices (r 4; r 5(4)), drawing external standard bodies into the approval framework. For TITO after 3 December 2020, the controlling standards shift to the gambling administration guidelines under another Act (r 9(2)).

Parties not directly affected but constrained. The Regulations prohibit using facial recognition data to identify barred persons at other premises (r 10(1)(d)). That constrains cross‑venue or third‑party uses of the data that might otherwise be considered by multi‑venue operators or third‑party service providers.

In short, the Regulations allocate compliance costs and operational duties primarily to licensees and their suppliers, delegate technical approval to the Commissioner, shape customer interaction through default settings and message flows, and create data obligations both for licensees and for the regulator.

Duties on the licensee. The Regulations place numerous affirmative duties on licensees:

• Gaming machine approvals: to ensure gaming machines and games comply with the Australian/New Zealand Gaming Machine National Standard 2016 (or any subsequent version) as modified by the relevant Appendix, unless the economic‑viability exception applies to already‑approved machines (r 5(3), (3a), (4)).

• Pre‑commitment system operation: to operate a pre‑commitment system in compliance with the Voluntary Pre‑commitment Code at Schedule 2 (r 8). Specific duties in Schedule 2 include permitting registration by multiple means, providing written information and obtaining consent before registration, recording customer preferred language and communication method, setting default and customer limits, applying variations in specified timeframes, displaying reminders at set thresholds, preventing continuation without acknowledgement in particular screen contexts and notifying staff when limits are exceeded (Sch 2 items 1-19).

• TITO operation: not to provide any gaming machine or automated table game equipment operable by ticket unless the machine is connected to a TITO system that complies with the prescribed requirements (r 9(1)). TITO systems must meet technical and operational requirements, including ticket content, no promotional material, machine acceptance limits, expiry, logs, host redundancy and secure communications (r 9; Sch 4).

• Facial recognition: to ensure any approved facial recognition system meets prescribed requirements and to display a Commissioner‑approved notice at each entrance and limit retention of facial images or identifying data for non‑barred persons to 72 hours (r 7; r 10(2)(a)-(b)). Licensees must also ensure data is not used for prohibited purposes (r 10(1)).

• Data supply to regulator: to supply de‑identified pre‑commitment system information to the Commissioner for research on request (Sch 2 item 19).

Rights and procedural protections preserved. The Regulations themselves offer limited rights language, but Schedule 3 preserves a historical right of review: despite repeal of Part 8 of the Act, until the relevant day a licensee continues to have the right to apply to the Licensing Court of South Australia for review of a prescribed decision in accordance with provisions that were in force before repeal (Sch 3 cl 3(1)). The Regulations also include an economic‑viability exception to retrofitting older machines to the updated ANZ standard (r 5(3a)), which operates as a limited right to avoid forced modification where it is not economically viable.

Discretion and delegated powers. The Commissioner retains decision rights over technical and security criteria for facial recognition approval and the form of entrance notices (r 7; r 10(2)(a)). The Commissioner may also notify “any other purpose” that facial recognition data must not be used for (r 10(1)(e)), creating an administrative discretion to expand prohibited uses. For TITO after 3 December 2020, compliance is to be with gambling administration guidelines issued under another Act, effectively delegating some technical detail to those guidelines (r 9(2)).

Operational rights of patrons. Registered customers have rights under the pre‑commitment code: to register by multiple means, to set and vary expenditure limits and break/no‑play periods, to receive reminders and periodic and on‑demand activity statements in their preferred language and communication method, and to have pre‑commitment data portable across machines on the same system (Sch 2 items 1-17).

Staff and authorisation controls. Licensees retain the right to designate authorised persons who can manually enable issuance of high‑value tickets (r 9(5)), and to implement staff access controls and tiered privilege levels for cashier terminals (Sch 4 cll 7.4-7.6).

Note on penalties and enforcement. The Regulations themselves do not articulate penalty sanctions within the text provided; they operate by imposing conditions on licence operation, approval and technical compliance. Enforcement and penalty mechanisms are therefore a matter for the Act or other regulatory instruments referenced in the Act. The text preserves a right to judicial review under transitional arrangements (Sch 3 cl 3).

Absence of explicit penalties in the Regulations. The text of the Casino Regulations 2013 as provided does not itself specify fines, offences, or penalty rates. It prescribes conditions of licence and technical and operational standards, without attaching explicit statutory penalty clauses within the Regulations. That is a notable structural point: compliance is couched in affirmative rules rather than immediate in‑Regulation sanctions.

Enforcement is therefore likely to be exercised through the licensing and enforcement powers conferred by the Act and related instruments. The Regulations repeatedly tie obligations to licence conditions and approvals under the Act (for example, approvals under ss 40A and 40D of the Act are referenced at r 5 and r 7). This implies that failure to comply with the Regulations will be actionable through the licensing and enforcement framework established by the Act (for example, by refusal to grant or renew approvals, suspension or other licence‑based sanctions). The Regulations also ensure that certain approvals and operational authorisations (for instance approval of a facial recognition system by the Commissioner) are conditional on meeting criteria in the Regulations (r 7). Non‑compliance therefore risks withdrawal or denial of those approvals.

Administrative discretion and control points. The Commissioner has administrative discretion in multiple places which creates administrative enforcement levers. The Commissioner determines technical and security criteria for an approved facial recognition system (r 7). The Commissioner also approves the form and manner of entrance notices required for facial recognition (r 10(2)(a)) and may notify additional prohibited purposes for facial recognition data (r 10(1)(e)). These delegated powers enable the Commissioner to shape compliance expectations and to refuse or revoke approvals where specified requirements are not met.

Operational enforcement levers embedded in technical design. Several provisions embed enforcement via system behaviour: for example, the pre‑commitment system must be capable of preventing continuation of play until a reminder message has been acknowledged on certain screens (Sch 2 item 10.8-10.9). TITO requirements mandate that devices automatically abort ticket transactions where connection to the TITO host is lost (Sch 4 cl 3.6) and require logs and unique identifiers to ensure auditability (Sch 4 cll 3.8-3.11, 4.19, 5.14). These technical constraints both prevent particular non‑compliant pathways and provide audit trails that can be used in enforcement.

Review rights. The Regulations preserve judicial review routes for certain decisions in the transitional phase (Sch 3 cl 3). The preservation of a right to apply to the Licensing Court for review of “prescribed decisions” during the transitional period positions the court as a potential enforcement venue for licensees seeking to challenge Commissioner decisions that affect their rights or approvals.

Interaction with other enforcement regimes. The Regulations cross‑reference the Gambling Administration Act 2019 for TITO technical standards on and after 3 December 2020 (r 9(2)). That cross‑reference imports the enforcement architecture of the Gambling Administration Act 2019’s guidelines regime for TITO post‑transition, and shifts enforcement of TITO technicalities to compliance with those guidelines.

Practical enforcement implications. Because the Regulations specify system behaviours, logging, messaging and staff notification, enforcement can be operationalised by audits of system logs, on‑site inspections to verify signage and notice requirements, examination of host redundancy and backup, and review of staff authorisation records used to enable high‑value ticket issuance (r 9(5); Sch 4 cll 7.7-7.8; Sch 2 items 10, 13-17). Where a system fails to meet those requirements, the Commissioner may be able to withhold or revoke approvals tied to those systems; the Regulations establish the criteria that such enforcement will be measured against.

In sum, the Regulations do not declare monetary penalties within their text; enforcement is effected through approvals, licence conditions, technical system constraints and administrative revocation or action under the Act and related guidelines.

Cross‑references to the Act and other instruments. The Regulations are made under the Casino Act 1997 and explicitly define “Act” as that statute (r 3). They reference and operationalise approvals under specific Act provisions, for example approvals under s 40A (gaming machine approvals) and s 40D (facial recognition approvals) (r 5; r 7). The TITO provisions reference the Gambling Administration Act 2019 for post‑3 December 2020 standards (r 9(2)). Consequently, compliance with the Regulations is bound up with the licensing and approval framework in the Act and with any guidance or rules made under the Gambling Administration Act 2019.

National and jurisdictional standards. For gaming machines, the Regulations prescribe the Australian/New Zealand Gaming Machine National Standard 2016 (or subsequent versions) as the required technical standard, as modified by the “relevant Appendix” which may be the South Australian Appendix or the Appendix to a jurisdiction listed in r 4 (r 5(3), (4)). The Regulations therefore embed an interaction with interstate and trans‑Tasman standardsetting and require that machines align with national technical norms unless the economic‑viability exception applies (r 5(3a)). Regulation 4 explicitly lists the jurisdictions deemed “prescribed” for purposes of s 40A(2): New South Wales, New Zealand, Queensland and Victoria (r 4).

Gambling Administration Act 2019. The TITO rule operates on a temporal gateway: until 3 December 2020, TITO systems must comply with Schedule 4; on and after that date, compliance is with the gambling administration guidelines issued under s 17 of the Gambling Administration Act 2019 (r 9(2)). This cross‑link shifts the locus of TITO technical detail away from the Regulations to a separate regulatory instrument after the transitional date, creating an interaction where standards and compliance procedures for TITO may be updated or administered under the Gambling Administration Act 2019 regime.

Data and privacy regimes. The Regulations impose retention limits for facial recognition images and identifying data for non‑barred persons (r 10(2)(b)) and constrain uses for facial recognition data (r 10(1)). Those rules will interact with general privacy law and data protection obligations (for example state or Commonwealth privacy laws). The Regulations themselves require data be stored securely and not used for specific commercial purposes; they also authorise the Commissioner to require de‑identified pre‑commitment data for research (Sch 2 item 19). Operators will therefore need to reconcile the Regulations’ retention and use obligations with privacy and data security obligations in other laws, and with any reporting or disclosure obligations.

Lottery and gaming laws. Regulation 10(1)(c) expressly disallows use of facial recognition data “in connection with a lottery within the meaning of the Lottery and Gaming Act 1936 or the Lotteries Act 2019”. The Regulations thus interact with state lottery legislation by drawing a prohibition line between casino facial recognition use and lottery operations defined outside the casino regulatory framework.

Administrative law and review. Schedule 3 preserves a right to apply to the Licensing Court for review of prescribed decisions until a Ministerially declared day (Sch 3 cl 3). That interacts with the broader administrative law framework for judicial review and with the procedural architecture in the Act for licensing and review.

Standard‑setting and delegated instruments. Multiple provisions vest the Commissioner with power to determine technical, security and other criteria (r 7), and to publish notified requirements on the Commissioner’s website for transitional approval (Sch 3 cl 2(1)). The post‑2020 TITO standard shift to gambling administration guidelines means that a significant portion of technical regulation can be effected via gazetted or published guidelines under another Act. The practical effect is that the Regulations are part of a layered regulatory system combining primary legislation, subordinate regulations, Commissioner determinations, publicly available guidelines and national technical standards.

Overall, the Regulations are tightly interwoven with the Act, national technical standards, the Gambling Administration Act 2019 guidelines, lottery statutes and privacy/data regimes. Compliance therefore requires operators to track and reconcile multiple instruments and timelines.

The Regulations include an embedded legislative history and a schedule of amendments. The history shows iterative changes to content, the insertion and repeal of clauses, and timeline‑based modifications. The Legislative history section appended to the Regulations documents principal regulations and variations, commencement dates, and specific provision amendments.

Key chronological markers and variations documented in the text:

• The principal regulations were originally gazetted in late 2013 and commenced in 2014 (Gazette entries 270 and 275/2013). The legislative history lists commencement dates and references for subsequent variations.
• Several provisions were varied across 2015, 2017, 2018 and 2020 through specific amending instruments. Notable entries include amendments in 2015 (No. 173), 2017 (No. 204), 2018 (Nos. 237 and 246) and a cluster of changes in 2020 (Nos. 245, 246, 247) with specific commencement dates of 30 July 2020, 28 September 2020 and 3 December 2020 respectively.
• Regulation 7 (approval of facial recognition system) was inserted by 246/2018 and substituted by 245/2020 (dates shown in the history table), indicating an evolution in the facial recognition approval framework. Regulation 8 (pre‑commitment requirement) and regulation 9 (TITO operation by ticket) were inserted by 245/2020 and 246/2020 respectively, reflecting the introduction of more prescriptive requirements for pre‑commitment and ticket operation in 2020.
• Schedule 4 (TITO technical requirements) was inserted by 245/2020 and therefore is a relatively recent codification of TITO technical detail (Sch 4 insertion date 30.7.2020).
• Several earlier components were deleted or replaced: for example r 6 was deleted by 247/2020 (3.12.2020); parts of Schedule 1 were varied and parts later deleted by 245/2020. Sch 1 was deleted by 245/2020 (30.7.2020).
• The legislative history lists specific clause‑level variations: for example, Sch 2 item 6.1 was substituted and varied across amending instruments in 2015 and 2016; item 10 subitems were varied multiple times. Item 11's definition of ancillary screen was varied by 245/2020 r 7(1), changing the minimum screen dimensions or presentation context (Sch 2 item 11).

Transitional provisions. Schedule 3 contains specific transitional rules that preserve certain approval requirements up to 3 December 2020, including requirements for machines intended to operate with TITO and for facial recognition system approvals to follow notified requirements until that date (Sch 3 cll 1-2). The transitional clause preserving review rights (Sch 3 cl 3) remains operative until a Ministerially declared “relevant day”.

Notes on interpretive caution. The Regulations include a standard legislative note cautioning that references to other legislation or offices may be obsolete if titles have changed and that earlier versions are listed in the legislative history. The history table provides a readable map of when specific changes took effect and which provisions were varied or deleted, which is essential for assessing which rules apply at a given time.

Practical effect of amendments. The 2020 package of amendments is particularly significant: it introduced the formal pre‑commitment Code (Sch 2 became mandatory for licensees under r 8), tightened the facial recognition approval regime and operational restrictions (r 7 and r 10), and codified TITO technical requirements (Sch 4) with a transition to the Gambling Administration Act 2019 guidelines from 3 December 2020 (r 9(2)). These changes move the Regulations from higher‑level standards to detailed technical and behavioural prescriptions.

Users must therefore consult the legislative history to determine which version of a clause applied at any given time, particularly where a machine or system was approved during a transitional period. The Regulations explicitly list historical versions and amendment instruments with commencement dates, which should be cross‑checked for compliance and review matters.

The provided Regulations text does not include references to specific judicial decisions or an active litigation docket. There are, however, embedded transitional provisions that preserve certain procedural rights that generate litigation potential: Schedule 3 preserves the licensee’s right to apply to the Licensing Court of South Australia for review of prescribed decisions until a Minister determines a relevant day (Sch 3 cl 3). That clause indicates that disputes over Commissioner decisions made under the Gambling Administration Act 2019 or earlier versions of Part 8 of the Act may be channelled into the Licensing Court for a defined transitional period.

Because the Regulations themselves do not contain penalty provisions or create new offences, litigation arising under the Regulations would most likely take the form of:

• judicial review or merits review of Commissioner approvals and determinations (for example, refusal to approve a facial recognition system or variation of permitted uses under r 10(1)(e)), potentially brought under preserved review rights in Sch 3 cl 3;
• contractual or regulatory disputes over whether a gaming machine complies with the ANZ standard or relevant Appendix as required for approval (r 5);
• compliance enforcement actions in relation to TITO technical failures or logging discrepancies (Sch 4), where a licensee disputes the regulator’s factual findings or regulatory response; and
• privacy or data protection litigation related to facial recognition retention and use rules under r 10(2), depending on interaction with privacy law.

The Regulations explicitly preserve administrative review avenues during transition. But the Regulations do not list cases, judicial interpretations, appeal outcomes or precedent. Practitioners should assume litigation questions will centre on interpretation of the standard‑setting wording in r 7 and r 10, economic‑viability determinations under r 5(3a), and the technical sufficiency of TITO systems under Sch 4 where system logs and host resilience are at issue.

For current litigation history or decisions involving these Regulations, users must consult court databases, licensing court records and the Commissioner’s determinations, as the Regulations document does not itself supply case law or adjudicative outcomes.

The Regulations contain several detailed prescriptions that can produce surprising operational or legal consequences if overlooked. These are practical pitfalls and points of friction that operators, suppliers and advisers should note, with clause references.

1. Default expenditure limit and user choice. If a customer registers for pre‑commitment but does not specify an expenditure limit, the system must set a default daily limit of $100 per day (Sch 2 item 7). That default will bind until changed and may produce customer complaints or revenue effects; the operator must design registration flows to capture user choice clearly and to apply default logic correctly.

2. Time delay for increasing expenditure limits. If a registered customer has played since registering and requests an increase to an expenditure limit, the increase may only be applied after 24 hours and only if the customer confirms the change in person or by other means (Sch 2 item 8.3). This introduces a mandatory cooling‑off and confirmation flow for increases which must be built into system UX and staff training; incorrectly applying increases immediately could breach the code.

3. Message acknowledgement blocks play. The pre‑commitment system must not allow removal of a reminder message from the primary screen until acknowledged, and must prevent continuation of play on ancillary screens until the customer acknowledges the reminder (Sch 2 items 10.8-10.9). Implementation requires careful UI testing; failure to enforce acknowledgement correctly could leave operators non‑compliant and create audit flags.

4. Ticket value ceilings at machines. A machine must not accept tickets for redemption if the ticket’s cash value exceeds $149.99 (r 9(4)). Higher value tickets may still be redeemed at cashier or redemption terminals per Sch 4 cl 3.13 and 6.7. Operators must ensure device‑level enforcement matches policy; otherwise a ticket accepted at machine would breach the Regulation.

5. Manual enabling of high‑value tickets. Tickets with credit value above $5,000 may only be issued if manually enabled by an authorised person designated by the licensee (r 9(5)). The Regulations do not specify who qualifies as authorised; licensees must implement internal authorisation protocols and logs to demonstrate compliance.

6. Ticket expiry and patron expectations. A ticket expires after 12 months from the date of issue and cannot be redeemed after that time (r 9(6)). Operators should maintain reporting on approaching expiries, host liability accounting for unredeemed tickets (Sch 4 cl 8.7), and customer communications to avoid disputes.

7. No promotional content on tickets. Tickets must not contain any form of promotional material or advertising (r 9(3); Sch 4 cl 2.6). Systems that previously printed branding or offers on tickets must be reconfigured.

8. Facial recognition retention window and scope. Facial images or identifying data for persons who are not barred must not be retained after 72 hours (r 10(2)(b)). The Regulations explicitly permit retention of barred person data beyond 72 hours by omission; operators must therefore have retention policies that distinguish barred persons from others in real time and that document legal bases for retention. The Regulations also prohibit use of facial recognition data for loyalty or promotional purposes and to identify barred persons at other premises (r 10(1)(a)-(d)), limiting cross‑use of datasets.

9. Commissioner discretion and open‑ended prohibitions. The Commissioner can determine “any other criteria” for facial recognition approval (r 7) and may notify “any other purpose” for which data must not be used (r 10(1)(e)). This creates regulatory uncertainty because the Commissioner may expand prohibited purposes or add technical criteria post‑approval, which operators must monitor and respond to.

10. Transitional standard shift for TITO. The TITO technical standard changes: Schedule 4 applies until 3 December 2020 and gambling administration guidelines under the Gambling Administration Act 2019 apply thereafter (r 9(2); Sch 3). Operators must track which standard applied at the date of installation or approval and ensure migration plans if moving into the post‑guidelines period; failure to do so risks non‑compliance with the currently operative instrument.

11. Audit log size and retention expectations. Various device types must maintain logs of the “last 35” accepted or issued tickets with time and date, amount and unique ticket identifier (Sch 4 cll 4.19, 5.14, 6.10-6.11). That log depth is minimal; operators implementing wider operational log retention must ensure the “last 35” record is always preserved and synchronised across components to meet the regulation’s evidential expectations.

12. “Economic viability” exception is narrow and fact dependent. The exception to modifying already‑approved machines only applies where the machine is already approved under s 40A and it is “not economically viable” to modify it to comply with the ANZ standard (r 5(3a)). The Regulations do not define “economically viable”, leaving scope for regulatory scrutiny and challenge. Licensees should document cost assessments and decisions when relying on this exception.

13. Data de‑identification for research. The licensee must provide de‑identified pre‑commitment data for research on request (Sch 2 item 19). Operators need lawful de‑identification protocols and secure transfer processes to satisfy the Commissioner’s request while complying with privacy obligations.

Operators and advisers should treat these points as operational checks: system configuration and staff SOPs must be aligned with each precise clause, and evidence trails should be created to demonstrate how technical and administrative requirements are met.

This section outlines concrete steps a licensee or system supplier should take to implement the Regulations. Each recommended action ties back to the specific clause or schedule reference.

1. Governance and compliance mapping

• Create a compliance register mapping each regulatory obligation to an owner, system, and audit evidence: r 5 (ANZ standard), r 7 (facial recognition approval criteria), r 8 and Sch 2 (pre‑commitment code), r 9 and Sch 4 (TITO requirements), r 10 (facial recognition use and retention).
• Track transitional and amendment timelines using the legislative history to determine which version applied at dates of approval or system change (Sch 3 and Legislative history table).

2. Gaming machine approvals and national standard alignment (r 5)

• Review each gaming machine and game intended for approval against the Australian/New Zealand Gaming Machine National Standard 2016 (or subsequent versions) and the relevant Appendix (r 5(3), (4)).
• For machines already approved, document economic assessments to justify any reliance on the economic‑viability exception (r 5(3a)). Preserve evidence of engineering reports, cost estimates and decision memos.

3. Facial recognition systems (r 7; r 10)

• Before installation, submit the system for Commissioner approval, ensuring the system meets the prescribed requirements: accurate handling of physical variances, security to prevent unauthorised access, and operability to meet technical and security criteria as determined by the Commissioner (r 7).
• Draft and obtain the Commissioner’s approval for the entrance signage format and placement (r 10(2)(a)).
• Implement data retention and deletion flows to purge facial images and identifying data for non‑barred persons within 72 hours (r 10(2)(b)). Log retention and deletion events for audits.
• Restrict all facial recognition data use cases to those permitted by the Regulations; explicitly block uses prohibited in r 10(1)(a)-(e) and build technical controls to prevent accidental use for loyalty, marketing or lotteries.
• Maintain a list and process for responding to any Commission notifications that extend prohibited purposes.

4. Pre‑commitment system deployment and operation (r 8; Sch 2)

• Ensure registration pathways are implemented: in‑venue written application, in‑person request to staff, and an online form (Sch 2 items 1.1-1.3).
• Provide customers with the written information required at registration and obtain consent to terms before registering them (Sch 2 items 3-4).
• Implement preferred language and communication preference capture and store these in the pre‑commitment profile (Sch 2 item 5).
• Default expenditure limit set‑up: configure the system to apply a default $100 daily limit where no limit specified (Sch 2 item 7).
• Allow customers to set daily/weekly limits, break in play periods, no play periods and personalised reminder messages; implement variation workflows per item 8 (including 24‑hour cooling for increases where applicable).
• Implement threshold notifications and acknowledgement controls specified in item 10: reminders at 50%, 75%, 90% and further reminders at 10%, 20% and 50% over limit; ensure primary and ancillary screen behaviours conform (Sch 2 item 10).
• Integrate staff notification mechanisms so staff receive alerts when customers exceed limits or fail to comply with no‑play/break requirements (Sch 2 items 3.4.2, 10.6).
• Implement periodic communication routines: request limit confirmation every 6 months and produce periodic activity statements every 6 months where the customer has played (Sch 2 items 14-15). Provide on‑demand activity statements for specified periods and ensure these are available in the preferred language (Sch 2 items 16-18).
• Provide secure, auditable de‑identified data extracts to the Commissioner upon request (Sch 2 item 19).

5. TITO system technical compliance (r 9; Sch 4)

• If the TITO system was placed before 3 December 2020, confirm it meets Schedule 4 technical requirements; for systems after that date ensure alignment with the gambling administration guidelines under the Gambling Administration Act 2019 as required (r 9(2); Sch 3).
• Ensure tickets comply with the content, unique identifier and no‑advertising provisions (Sch 4 cl 2.1-2.6). Implement machine and barcode formats per 16 or 18 digit unique identifiers, visible in both human readable and machine readable formats (Sch 4 cl 2.1.4).
• Configure device and host limits: implement maximum ticket in/out, minimum ticket out, maximum credit limit, floor expiry and system‑level expiry settings and ensure cashier terminals handle tickets above configured limits (Sch 4 cl 3.12-3.14).
• Implement logging and audit trails across TITO enabled devices, cashier terminals and the TITO host to capture at minimum the last 35 records with the required fields (time/date, amount, unique ticket identifier, staff identifier where relevant) (Sch 4 cll 4.19, 5.14, 6.10-6.11, 7.7-7.8).
• Ensure host resilience and redundancy: fault tolerance, data redundancy, version control, and auditability of software signatures for regulated files (Sch 4 cl 8.1-8.15).
• Implement error handling for partial ticket prints, orphaned tickets and duplication scenarios; test recovery and abort flows to ensure a ticket is only redeemable once (Sch 4 cll 3.6, 3.11, 4.11-4.19, 5.13-5.15).
• Ensure cash redemption and cashier terminals prohibit ATM/EFTPOS functions (Sch 4 cl 6.3) and have appropriate cash security measures (Sch 4 cl 6.5).

6. Staff training, authorisation and SOPs

• Define authorised person roles who can manually enable issuance of tickets above $5,000 and maintain logs of authorisations (r 9(5); Sch 4 cl 7.7-7.8).
• Train staff on pre‑commitment notifications, on‑site handling when customers exceed limits, and on how to process tickets that exceed machine limits (Sch 2 items 10.6; r 9(4); Sch 4 cl 3.13).
• Develop SOPs for facial recognition incident response, data breach handling and compliance with Commissioner notifications.

7. Documentation and audit evidence

• Keep records of approvals, Commissioner determinations and any public notifications relied upon (r 7; Sch 3 cl 2(1)).
• Maintain logs of deletion actions for facial recognition data (r 10(2)(b)); maintain log records of ticket audits and system events to satisfy a future inspection or review.
• For any reliance on the economic‑viability exception to modify machines, preserve a contemporaneous cost analysis and decision paper (r 5(3a)).

8. Monitor regulatory updates

• Track Commissioner notifications, gambling administration guidelines under the Gambling Administration Act 2019 for TITO, and changes to the ANZ Gaming Machine National Standard or South Australian Appendix (r 5(3), r 9(2), Sch 3 cl 2).
• Incorporate a legal/regulatory watch into governance to catch any Commissioner additions to the list of prohibited uses for facial recognition data (r 10(1)(e)).

9. Data protection and privacy alignment

• Map the Regulations’ retention and usage constraints against state and Commonwealth privacy obligations; implement technical controls that enforce retention windows and prevent cross‑use with loyalty or marketing systems (r 10(1)(a)-(c); r 10(2)(b)).

10. Testing and certification

• Before rollout, perform integrated system testing to validate message flows, acknowledgment gates, ticket printing/validation/recovery, host failover, and log integrity. Retain evidence of tests to produce in a compliance audit.

Implementing these steps will align operations with the prescriptive requirements in the Regulations. The most labour‑intensive elements are technical reconfigurations of TITO hosts and devices, staff training and the design and documentation of pre‑commitment workflows and privacy‑compliant facial recognition handling.