Verified PayID pokies, the Accountability Register standard

What verification means on the Accountability Register

Verification on the Accountability Register is a defined process, not a marketing claim. When we describe an operator as verified we mean that the operator has been through a structured audit against the seven safety categories set out on the homepage and has been documented in an evidence file that any reader can reason about.

A verified listing does not mean the operator is safe, endorsed or recommended. It means the operator has been indexed, that our best available evidence has been recorded, and that the entry is being kept current on our six month refresh cycle. Readers should still read the entry and form their own view.

Verification is a snapshot in time. Terms change, ownership shifts, regulators sanction, complaint volumes spike. The verification date on every entry tells you how fresh the snapshot is. Where the snapshot is older than nine months we mark the entry as under refresh and readers should weight it accordingly.

Under the Interactive Gambling Act 2001 (Cth) offshore operators are prohibited from offering online casino games to Australian residents. Verification indexes operator behaviour for research and consumer safety; it does not endorse offshore play. GambleAware sits on 1800 858 858, twenty four hours a day, and is the first call if the fun is no longer the fun.

The verification checklist we run on every candidate

Every candidate operator is taken through a documented checklist before any entry appears on the register. The checklist is deliberately conservative and errs on the side of not verifying rather than verifying prematurely. We would rather run a small register we can defend than a large register we cannot.

1. 1Identify the legal entity. Extract the operator legal name, registered address, licence authority and licence number from the current terms and conditions. Archive the source page.
2. 2Verify the licence. Cross reference the licence on the regulator's public register. Confirm the licence is current, the licence holder matches the operator legal name, and no sanctions are pending.
3. 3Run a payment audit. Deposit AUD 20 via PayID from an Australian ADI. Record the payee name resolution, the merchant descriptor, the reconciliation time and any friction points.
4. 4Attempt a small withdrawal. Play through no more than the deposit amount (no bonus), then request a withdrawal. Record approval time, settlement time and any KYC friction.
5. 5Sweep complaints. Pull complaint data from the six primary sources for the operator legal entity and any known trading brands over a twelve month rolling window.
6. 6Publish the file. Draft the register entry, request right of reply from the operator, incorporate any response, publish, and log for the next refresh cycle.

The full checklist has thirty two sub items across the six steps. The list above is the abbreviated form and is enough for a reader to understand what we did before publishing an entry.

Licence integrity check across the four main jurisdictions

Licence integrity is the single most falsifiable element of any operator listing. Either the licence exists and is current, or it does not. Our verification pass on licences uses the primary public register for each of the four jurisdictions we track most frequently.

Curacao. Since September 2024 the Curacao Gaming Control Board publishes a public licence register at gamingcontrolboard.cw. Direct licences under the LOK regime carry a distinctive number format and are cross referenced with the legal entity name. Legacy master and sub licences are still visible during a transition period and we flag any operator still relying on legacy structures as needing scrutiny.

Malta. The MGA publishes its licensee register at authorisations.mga.org.mt. Search by licence number and confirm the entity, authorised URLs and licence expiry date. MGA licences are the highest quality signal in our workflow because MGA sanctions carry weight and MGA complaint outcomes are published.

Kahnawake. The Kahnawake Gaming Commission publishes a licensee list at gamingcommission.ca. It is thinner than MGA or Curacao documentation but the KGC has been active in enforcement over the last three years, including public rulings on complaint mediations.

Anjouan. Anjouan does not publish a functionally useful register. Where an operator claims an Anjouan licence we email the licensing authority for verification, log the response (or non response) and mark the licence dimension accordingly. Anjouan only listings default to a low confidence licensing score.

Where the register cannot verify a licence claim, the entry is not published as verified. It may be published in an evidence gap watchlist with a clear note explaining why full verification was not possible.

Payment audit protocol at the transaction level

The payment audit is the part of verification we own outright. Every candidate operator receives a small transaction level test conducted from one of our rotating Australian bank accounts. The protocol below is what we run in every case.

We open a fresh account, submit routine KYC as an ordinary Australian resident would, and deposit AUD 20 via PayID. We record: the PayID handle resolved by NPP, the payee name returned by the Addressing Service, the merchant descriptor on our bank statement, the elapsed time from bank confirmation to gaming balance credit, and any messaging seen in the cashier during the flow.

We then play through no more than the deposit amount at low volatility titles from mainstream providers. We do not accept promotional bonuses in the verification pass because a bonus complicates the withdrawal test with wagering conditions. We want a clean unencumbered withdrawal audit.

We submit a withdrawal request for the remaining balance, whatever it is. We record the approval time (from request to operator approval), the settlement time (from approval to receipt in our bank), and any additional KYC requests during that window. Multi stage KYC requests during a first withdrawal is a specific flag we score heavily.

We repeat the sequence approximately one week later, from a different Australian ADI. Consistency across two independent test cycles is a significant reliability signal. Where the two cycles diverge materially we run a third cycle and, if the divergence persists, flag reliability as an unresolved risk in the entry.

Terms review workflow with version diff analysis

The terms and conditions are the operator's contract with the player. Reading them takes time; reading them well takes longer. Our terms review workflow codifies the reading so that no material clause is missed and so that silent changes over time are surfaced.

Every candidate operator's terms are archived on first review, both to the Wayback Machine and to our own internal document store with a SHA256 fingerprint. We extract structured facts from the terms into a fixed schema: maximum bet during bonus play, wagering multiplier, maximum win cap on bonus balances, minimum withdrawal amount, maximum daily and monthly withdrawal caps, KYC document list, dormant account fee structure, jurisdiction exclusions list, dispute resolution mechanism, governing law and forum, and self exclusion mechanics.

On each refresh we re archive the terms and produce a diff against the previous archived version. Silent changes are flagged in the entry with a before and after side by side, the effective date if we can identify it, and an editorial note describing the direction of the change (favourable or unfavourable to the player).

Certain clause patterns are treated as automatic red flags regardless of the rest of the terms. A clause reserving the right to void winnings for undefined bonus abuse is one. A clause reserving the right to change any term with only prospective notice, applied to existing balances, is another. A clause requiring arbitration in an inaccessible foreign forum with fees payable up front by the player is a third.

Complaint density analysis and the twelve month window

Raw complaint counts are misleading. A larger operator will attract more complaints in absolute terms simply because it has more customers. Our verification pass calculates a complaint density, expressed as complaints per hundred registered users where we can approximate the denominator, and compares it against a peer benchmark across the register.

We use a rolling twelve month window rather than an all time count because operator behaviour changes materially with ownership shifts, senior staff turnover and licensing regime changes. A three year old spike in complaints under a previous ownership is less informative about current risk than a three month recent trend.

Complaint density is broken out by our eleven category taxonomy. An operator with high overall complaint density concentrated in payout delays is a very different accountability signal from an operator with similar density concentrated in bonus disputes. The first is a payments reliability signal, the second a promotional integrity signal, and they warrant different reader response.

Where complaint mediation outcomes are visible, we track the operator's engagement rate (does the operator respond to mediation), agreement rate (do agreed outcomes materialise), and reversal rate (does the operator reverse its position under mediation pressure). Engagement rate below sixty percent is a reliable indicator of a mediation resistant operator and is flagged on the entry.

Responsible gambling tooling audit on the operator side

Responsible gambling tooling is a category where operator behaviour varies most widely. A well run operator makes deposit limits, session limits, cool off periods and self exclusion visible, easy and binding. A poorly run operator buries them behind friction or, worst case, does not enforce them consistently.

Our audit tests each tool functionally. We set a low deposit limit and confirm the cashier respects it on the next deposit. We start a session with a short session limit and confirm the system logs us out on time. We request a twenty four hour cool off through the account interface and confirm we cannot log in during the cool off period. We request a six month self exclusion and confirm the account is inaccessible for the specified period.

Any friction encountered during any of these tests is flagged. Friction includes: requiring a live chat contact to enable a limit that should be self serve, ignoring the limit on the next transaction, sending reactivation offers during a cool off, or accepting a self exclusion request but processing it as an account closure that can be reversed on request.

The register does not accept operator marketing copy about responsible gambling tooling. Every operator claims to offer these tools; the audit is what verifies whether the claim is real.

GambleAware is on 1800 858 858, twenty four hours a day, and is the backstop when operator tooling is not enough. State helplines route through the same national number.

Game integrity check and provider chain of custody

Game integrity is the last of the seven categories and the one where our leverage is weakest, because game outcomes are set by the software provider rather than by the operator. What we can verify is the chain of custody from provider to player, and the audit certificates behind the provider's random number generation.

For each verified operator we list the software providers whose titles are actually delivered on the site. Named providers with public reputations (Pragmatic Play, NetEnt, Play'n GO, Microgaming, Yggdrasil, Nolimit City, Push Gaming, Hacksaw) are a positive signal. Unbranded or house branded titles are a negative signal because they operate outside the RNG audit regime that mainstream providers subscribe to.

Where the operator publishes RTP figures per title, we verify that the published figures match the provider's public documentation. Discrepancies here (an operator claiming 96.5 percent RTP on a title where the provider publishes a 94.5 percent configuration) are a serious flag because they may indicate that a lower RTP variant of the title has been provisioned without disclosure.

Testing house certificates (iTech Labs, eCOGRA, GLI, BMM) are a positive signal where genuine. We spot check the certificate against the testing house's own register where the register is public. Fabricated or expired certificates are, unfortunately, not unusual and warrant an immediate flag.

How verification scores are compiled into a register grade

The seven categories are each scored zero to ten and combined into an overall accountability index between zero and one hundred. The weights were calibrated against a back test of two years of historical operator outcomes so that the final index has predictive value about future operator behaviour, not simply descriptive value about the current state.

Category weights are: licensing integrity 20 percent, payment reliability 15 percent, terms transparency 15 percent, complaint responsiveness 20 percent, responsible gambling tooling 15 percent, data handling 5 percent, game integrity 10 percent. The two twenty percent categories (licensing and complaints) are the dimensions with the strongest predictive relationship to serious downstream harm.

Scores are grouped into four register grades. Grade A (index 80 to 100) reflects an operator meeting most best practices across categories, though still offshore and still not licensed in Australia. Grade B (60 to 79) reflects an operator with material weaknesses in one or two categories but no acute warning flags. Grade C (40 to 59) reflects an operator with several material weaknesses and requires caution. Grade D (below 40) reflects an operator we consider high risk and where any player engagement should be considered carefully.

The grade is a working consumer signal, not a certification. It is designed to help a reader triage the register at a glance while still reading the underlying entry for context.

Removal from verified status and re verification

Verification is not permanent. An operator can be removed from verified status when the underlying evidence changes materially. The register publishes clear removal criteria so that operators, readers and complainants know what triggers removal and what triggers reinstatement.

Removal triggers include: licence lapse or revocation, an unresolved complaint cluster of ten or more matching cases in ninety days, silent changes to terms that materially disadvantage existing players, a self exclusion refusal case, evidence of RTP misrepresentation, and any regulator sanction under a jurisdiction we track.

When removal is triggered, the entry moves to a formal watchlist with a note explaining the removal reason. The operator receives a removal notification, and the watchlist entry is subject to the same right of reply as any other entry.

Re verification is possible. An operator can request re verification when the underlying issue has been documented as resolved for at least ninety days, when the licensing issue has been remedied, or when the complaint cluster has been formally resolved through mediation. Re verification requires the full checklist to be run again from step one.

Roughly six percent of the register churns between verified and watchlist status on a rolling twelve month basis. That churn is informative in itself about the volatility of the offshore operator landscape.

Compliance context and the IGA 2001 footnote

Verification does not launder the underlying legal context. Under the Interactive Gambling Act 2001 (Cth) offshore online casino games are prohibited from being offered to Australian residents. That prohibition attaches to the operator, not to the player, but it is a live prohibition and it shapes what a verified listing can and cannot mean.

What verification means in this context is that we have documented the operator's behaviour, that the entry is evidence based, and that a reader researching offshore behaviour has a defensible source to work from. Verification does not mean the operator is lawful in Australia, is safe in Australia, or is recommended for Australian players.

ACMA maintains a blocked domain list under Section 313 arrangements. Where a verified operator later appears on the ACMA blocked list, the register entry is updated to reference the ACMA action. Blocked status does not automatically unverify an entry (the operator may still be reachable via alternative domains and the underlying behavioural evidence still stands) but it is displayed prominently.

Australian bank obligations under AUSTRAC AML/CTF rules mean your ADI may query PayID transfers to certain payees. That is a legitimate compliance function and is not a signal about the operator per se, but it is a friction Australian players should be aware of.

Using a verified listing without overtrusting it

Verified listings on the register are a research aid. Readers can and do use them to inform decisions about offshore play, but the register was not designed to replace personal judgement, and we would rather readers leave with a healthy scepticism than with false confidence.

Reading tips. Look at the accountability index but also read the categories underneath it. A grade B operator with strong licensing and weak responsible gambling tooling is a different risk profile from a grade B operator with the reverse pattern. The category detail is what matters, not the aggregated score.

Check the review date. A twelve month old verification is not the same as a two month old one. Offshore operator behaviour can change quickly under commercial pressure, and a stale entry is a stale entry.

Read the complaints block. The specific complaint samples we link from each entry are more informative than the aggregate density. Reading three or four representative cases gives a much better feel for what may go wrong with the operator than any numerical score.

Set your own limits. Any offshore operator, verified or otherwise, sits outside Australian consumer protection regimes in most respects. Deposit only amounts you can afford to lose. Set operator level deposit limits before you play. Register on BetStop for the licensed AU sector even if you plan to play offshore.

Keep the GambleAware number close. 1800 858 858, twenty four hours a day. If the fun is not fun anymore, that call is the first step.