The Star AUSTRAC penalty: A$260 million, set by a judge rather than agreed

The Star AUSTRAC penalty is A$260 million, ordered by the Federal Court of Australia on 28 October 2026 for failures to run a compliant AML/CTF program and to monitor customers. It is the first large AML/CTF Act penalty fixed after a contested hearing, and it sets out how programs are tested and monitoring breaches counted.

• Justice Moore ordered The Star Pty Limited to pay A$195 million and The Star Entertainment Qld Limited A$65 million, in four equal instalments between 25 November 2026 and 25 May 2028.
• AUSTRAC asked for A$400 million within 28 days. Star argued for no more than A$100 million and said it could not pay more.
• The court found 1,190 ongoing due diligence contraventions at Star Sydney and 327 at Star Queensland, counted per customer, not per service.
• AUSTRAC lost its argument that an AML/CTF program lacks the required "purpose" whenever its design is not capable of managing risk.
• The penalty was reduced for A$200 million in earlier state penalties for overlapping conduct, licence suspensions and forecast remediation of A$371 million.

What did the Federal Court decide in the Star AUSTRAC penalty case?

The Federal Court ordered two Star subsidiaries to pay A$260 million for contraventions of sections 81 and 36 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 between 30 November 2016 and 30 November 2022. AUSTRAC filed the case on 30 November 2022, and the judgment, CEO of AUSTRAC v The Star Pty Limited [2026] FCA 1606, runs to 584 paragraphs. Section 81 bars providing designated services without a compliant AML/CTF program, and section 36 requires ongoing customer due diligence. The Star Pty Limited operated The Star Sydney, and The Star Entertainment Qld Limited operated Treasury Brisbane and The Star Gold Coast. Both belong to the ASX-listed The Star Entertainment Group.

Star admitted most of the facts in a 437-page statement of agreed facts filed on 31 March 2025. It admitted that Part A and Part B of its joint AML/CTF program did not comply with the AML/CTF Rules, and that it failed to monitor certain customers. What it disputed was the legal reach of two provisions and, above all, the size of the penalty.

The court's findings were blunt. Justice Moore found that a large part of Star's business depended on "turning a blind eye to customers who presented a high ML/TF risk" (paragraph 560 of the judgment). He found that Star "put profit over compliance, and did so on a large scale" (paragraph 561).

The AUSTRAC media release lists the failures: verifying customer information and source of funds, due diligence and monitoring. It adds third-party transactions and cash deposits where the third party's identity was not recorded, a private gaming operation inside the casino, and the courting of customers excluded from gambling in another state.

The Star AUSTRAC penalty in figures:

All figures in the table come from the orders and reasons in [2026] FCA 1606. The court stressed that the revenue figures are not a measure of the benefit from the contraventions.

Why does a contested AML penalty matter more than an agreed one?

A contested penalty matters more because the judge must reason out the figure, and that reasoning guides later cases in a way agreed penalties do not. The Star AUSTRAC penalty is the first contested penalty at this scale. Earlier large cases, including Westpac, Commonwealth Bank and Crown, ended in penalties the parties agreed and the court approved.

Justice Moore said almost every earlier proceeding involved agreed penalties, with one exception: a A$50,000 contested case against Castra Licensee in 2026. He declined to calibrate the Star figure against Crown or SkyCity, calling that comparison "an incorrect and inappropriate form of analysis" (paragraph 550).

The figures come from paragraphs 11 to 14 of the Star judgment, where the court said such agreed cases "provide little assistance" in fixing a contested penalty (paragraph 14).

How the Star AUSTRAC penalty compares with what each side asked for:

AUSTRAC put the net present value of Star's proposal at A$88.6 million (paragraph 10).

Two further points of method stand out. First, the court took the time value of money into account. Justice Moore said the A$260 million would have been smaller if it were payable within 28 days (paragraph 574). Second, he found the maximum penalty "so large as to not be meaningful" (paragraph 548), because section 81 contraventions occur each time a designated service begins.

What does the Star AUSTRAC penalty change for AML obligations?

The Star AUSTRAC penalty sets out how program and monitoring duties are tested and counted: the program is judged against the Rules, and each unmonitored customer is a separate contravention. Both points come from contested rulings, not concessions, so they carry more weight than findings in agreed cases.

AML/CTF program (sections 81 and 85). AUSTRAC argued that Part A of a program lacks its required "primary purpose" if, by design, it cannot manage the entity's risks. The court rejected that reading at paragraph 97: purpose cannot be equated with effect. The practical test for a program is therefore compliance with the specific requirements of the AML/CTF Rules, in Star's case Chapters 4, 9 and 15. Map your program to the Rules clause by clause.

Ongoing customer due diligence (section 36). The court held that section 36 imposes a duty to monitor customers, rather than a duty attached to each service. Your customer register, not your transaction log, is now the unit of exposure. Under the court's reading, each customer the entity failed to monitor as section 36 requires is a separate contravention, counted again for each reporting entity in the group that served them. Dated transaction monitoring records are the evidence that monitoring happened.

Source of funds and enhanced due diligence. AUSTRAC's release puts source of funds verification and due diligence on high-risk customers at the centre of the case. Teams should evidence enhanced due diligence on every high-risk customer, with a dated record of what was checked. Our guide to source of funds verification covers the evidence types.

Third-party payments and exclusions. Star accepted third-party transactions and cash deposits without recording who the third party was. It kept courting customers excluded in another state. Identify and verify any person funding a customer's account, and screen against exclusion orders from every jurisdiction where you operate.

Remediation credit. The Star AUSTRAC penalty was lower because of earlier state penalties, licence suspensions and a replaced board. The court also took forecast remediation and compliance investment of A$371 million into account (paragraph 566).

What is still uncertain after the Star AUSTRAC penalty?

Several questions remain open: parts of the reasons are still redacted, the rulings are first-instance and rest on the pre-reform Act, and AUSTRAC's loss on "purpose" may change how future cases are pleaded. None of these alters the Star AUSTRAC penalty of A$260 million, but each affects how far the judgment can be relied on.

Redactions. The court suppressed the confidential version of its reasons for four years. It ordered the parties to say by 13 November 2026 whether more of the public version can be unredacted. Details of Star's finances and some conduct may surface later.

The law has moved. The court applied the AML/CTF Act as it stood during the relevant period. According to AUSTRAC's reform page, amended program and due diligence requirements for current reporting entities started on 31 March 2026, unless deferred under transitional rules. How the per-customer counting and the "purpose" ruling carry over to the amended provisions is untested.

Appeal. Star told the ASX that it accepts the penalty (ASX announcement). AUSTRAC's release does not mention an appeal on the points it lost. Until any appeal period runs out, the per-customer and "purpose" rulings remain a single judge's first-instance decision.

Pleading strategy. AUSTRAC did not run a fall-back case on Star's construction of "purpose". Expect future claims to plead specific Rules breaches rather than a general design failure. That puts the burden on reporting entities to keep a written map from each Rules requirement to a control.

Ability to pay. Star said it could not pay more than A$100 million. The court gave its financial position no determinative weight, but used it to order instalments. Other entities may now argue for instalments, and AUSTRAC is likely to press for net present value adjustments, as it did here (paragraph 10).

Financing risk. Star told the ASX on 29 October 2026 that the quantum and payment terms of the penalty are a review event under its credit facility with WhiteHawk Capital Partners, while saying it is confident the facility will remain available (ASX announcement).

Does the Star AUSTRAC penalty matter beyond casinos?

Yes. The court accepted that general deterrence reaches non-casino providers of the same designated services, including remitters, betting account providers and financial institutions. AUSTRAC argued that a large penalty would show that underinvesting in compliance is economically irrational, and Justice Moore accepted that deterrence is not limited to the casino industry (paragraph 539).

Unless overturned, the per-customer reading of section 36 is likely to be applied to every reporting entity, from banks to digital currency exchanges. The finding that a program is tested against the Rules, not against its intent, is likely to apply just as widely. For UK teams, the same pattern appears in the Grosvenor Casinos settlement: written policy that existed but was not applied to high-risk customers.

How should compliance teams respond?

Start with a register-level review: list every customer rated high risk over a period as long as the six years the court examined, and check that each has a dated monitoring record and source of funds evidence. Under the per-customer reading, each customer not properly monitored is a separate contravention, so missing records show where your exposure lies.

Then map each AML/CTF Rules requirement, or the equivalent in your regime, to a named control and owner, and retest the map against the March 2026 amendments if you are an Australian reporting entity. Record who funds each account when a third party pays. Screen customers against exclusion orders and politically exposed person lists in every jurisdiction where you operate. Document any remediation, since the court took Star's forecast remediation into account. For casino and gaming teams, our guide to KYC for online casinos sets out the onboarding side.

Zyphe gives every customer check an exportable, dated audit trail, the per-customer evidence a register-level review needs. It verifies identity once with an NFC chip read to ICAO 9303 and two-step liveness, then lets customers re-present a reusable credential. Documents are encrypted into the customer's own vault, so there is no central store of customer PII. See our AML software or book a demo.

The bottom line

The Star AUSTRAC penalty gives Australian AML enforcement something it has lacked: a large penalty reasoned out by a judge rather than negotiated. Two rulings will outlast the headline figure. An AML/CTF program is tested against the specific Rules, not against whether it was well designed in the abstract. And every customer not monitored as section 36 requires is a separate contravention. For any team running KYC and ongoing due diligence, the customer register is now the place to start measuring exposure.

Cited sources

• Federal Court of Australia, CEO of AUSTRAC v The Star Pty Limited [2026] FCA 1606, orders and reasons, 28 October 2026
• AUSTRAC media release: The Star ordered to pay $260 million for serious AML/CTF breaches, 28 October 2026
• AUSTRAC, About the AML/CTF reforms: start dates for current reporting entities
• The Star Entertainment Group, ASX announcement: AUSTRAC civil penalty proceedings decision, 29 October 2026