Are PayID pokies legal? The answer a regulator would give

What "are PayID pokies legal" is really asking

The phrase "PayID pokies" describes a payment method, not a licensing category, so the question of legality has nothing to do with PayID itself. PayID is a bank-operated transfer identifier run over the New Payments Platform; it carries no view on what it is being used to pay for and no gambling-specific rules attach to it. The legal question that actually matters is whether the site accepting that PayID payment is entitled to offer online casino games or pokies to someone in Australia at all.

Under Australian law, the answer for essentially every offshore site using "PayID pokies" as a search term to attract Australian visitors is no. That does not mean using PayID to deposit is itself illegal for the player. It means the underlying service is being provided without the authorisation Australian law requires, and the payment rail chosen to fund it does not change that status one way or the other.

A distinction worth holding onto throughout this page

Two separate questions get collapsed into one all the time: is the payment method legitimate, and is the gambling service legal. PayID passes the first test easily, it is a mainstream, bank-regulated transfer mechanism used for everyday payments across Australia. Whether the recipient is entitled to take that payment for online pokies is an entirely different test, governed by a different piece of legislation, and it is the one this page is actually about.

The Interactive Gambling Act 2001: the baseline rule

The Interactive Gambling Act 2001 (IGA) is the Commonwealth law that makes it an offence to provide, or to advertise, an interactive gambling service to a customer physically located in Australia, where that service is not authorised under an Australian licence covering the relevant activity. Online casino games and pokies fall squarely inside the services the Act treats as prohibited when offered to Australians, regardless of where the operator is based or which currency or payment network it uses to collect money.

The Act was not written to ban gambling outright. Licensed wagering on sport and racing, and licensed lotteries, can operate lawfully within Australia's existing state and territory frameworks. What the IGA specifically targets is real-money online casino-style gambling, of which pokies are the clearest example, offered interactively over the internet to people here. That distinction, wagering versus online casino, is central to almost everything else on this page.

Why the Act applies to a business with no Australian office

The IGA is not limited to companies incorporated or headquartered in Australia. It applies based on where the customer is, not where the server or the company sits, which is exactly why an operator registered overseas, with no local staff and no Australian bank account, still falls within its reach the moment it accepts an Australian customer. This is the legal basis ACMA relies on when it investigates and later blocks a site that has never had an Australian office to begin with; ACMA's own summary of the Interactive Gambling Act sets this scope out plainly.

The 2017 amendment: closing the gaps

The original 2001 Act left some ambiguity that certain operators used to argue their service was not squarely covered. The Interactive Gambling Amendment Act 2017, which took effect on 13 September 2017, tightened the definitions, extended the prohibition explicitly to unlicensed wagering services and to in-play sports betting placed by phone or online outside a licensed operator's terms, and gave the regulator clearer grounds to act against services that had previously sat in a grey area.

The practical effect was immediate and measurable. More than 230 gambling and wagering services either exited the Australian market voluntarily or ceased advertising to Australians in the period following the amendment, rather than risk enforcement under the tightened rules. That single figure is often cited as the clearest evidence that the 2017 amendment was not a symbolic tightening; it changed operator behaviour at scale.

Provider, not player: who the offence actually targets

One detail causes more confusion than almost anything else on this topic: the IGA's offence provisions are directed at the entity providing or advertising the service, not at the individual placing a bet. A player depositing through PayID to an offshore pokies site is not committing an offence under the Act by doing so. The people who can be prosecuted, and who face penalties running into hundreds of thousands of dollars per contravention, are the operators and, in some cases, those who knowingly facilitate the service on the provider's side.

This asymmetry is deliberate. Commonwealth policy has consistently treated the player as someone to be protected or, at most, discouraged, rather than someone to be criminalised for using a service that was marketed to them in the first place. Michael Byrne, our reviewer, puts it plainly from his time inside the regulator: "the Act was built to squeeze the supply side. Chasing individual players was never the design, and it still isn't."

Why "not prosecuted" is not the same as "protected"

It would be a mistake to read the absence of player prosecution as a form of official comfort. The IGA not targeting players does not create any consumer protection for them. It simply means the legal risk sits with the operator, while the practical risk, losing money to a site with no licensing oversight, no dispute mechanism recognised in Australia, and no obligation to hold player funds separately, sits entirely with the player.

Why there is no Australian online-casino licence

A question that comes up constantly is whether an offshore pokies site could simply apply for an Australian licence and become compliant. It cannot, because no such licence exists to apply for. Australian gambling regulation permits licensed wagering on sport and racing, and permits state-regulated land-based casinos and poker machine venues, but no state, territory, or Commonwealth body issues a licence for a real-money online casino or online pokies product offered directly to consumers over the internet.

This is a structural gap, not an oversight that might be fixed by a future application process. Commonwealth policy since the IGA's introduction has been to prohibit this category of service outright rather than to license and regulate it, which is a different regulatory choice to the one made for online sports wagering. Any site describing itself as "licensed" for online casino or pokies is referring to a licence issued somewhere other than Australia, and that licence carries no authority here.

ACMA enforcement: investigations and blocking

The Australian Communications and Media Authority is the body responsible for enforcing the IGA in practice. Since its first blocking request in November 2019, ACMA has had more than 1,560 illegal gambling and gambling-affiliate websites blocked at the internet service provider level, a figure that has grown steadily as new investigations close and is updated on ACMA's own list of blocked gambling websites. ACMA does not need a court conviction before requesting a block; its own investigation process, confirming that a service is providing prohibited or unlicensed interactive gambling to Australians, is sufficient grounds to act.

In the 2025-26 reporting period alone, ACMA investigated 70 interactive gambling services, found breaches of the Act in every one of them, had 49 blocked at the ISP level, and saw a further 7 withdraw from the Australian market once the investigation became known to them. That pattern, a high breach rate among services actually investigated, is consistent with how the regulator prioritises its casework: it tends to open investigations where there is already strong reason to believe the Act is being breached.

What ACMA blocking does and does not do

A block instructs major Australian internet service providers to stop resolving or routing to a specific domain. It reduces casual, accidental, or search-driven access to the blocked site for people in Australia. It does not delete the site, does not recover money already lost on it, and does not prevent an operator from registering a new domain or a mirror site, which is a common response and one reason the blocked-site count keeps climbing rather than levelling off.

A worked example: from investigation to block

Consider a hypothetical offshore site, built around the pattern ACMA's own published casework describes. Complaints and automated monitoring flag the site to ACMA in, say, the first week of a given month. Investigators spend several weeks confirming the site is providing online pokies to Australian customers without any licence covering that activity, a process that in ACMA's own reporting has typically taken somewhere between six and twelve weeks from opening a case to reaching a final view, depending on how cooperative the operator is and how much evidence needs gathering.

Once a breach is confirmed, ACMA issues a formal warning in some cases, though for clear-cut prohibited online casino services it often proceeds directly to a blocking request sent to Australian ISPs. Providers then have a short window, commonly around ten business days, before the block takes effect. In this hypothetical but representative timeline, a site identified in early March could realistically see its domain blocked by late April or May, with the operator having already had the chance to withdraw voluntarily at any point in that window, an option 7 of the 70 services investigated in the 2025-26 period actually took.

Nothing about that timeline is affected by which payment method the site accepts. A site taking PayID moves through exactly the same investigation and blocking pipeline as one taking cards or crypto; the payment rail is irrelevant to ACMA's enforcement process.

The credit and crypto ban, 11 June 2024

From 11 June 2024, the Interactive Gambling Amendment (Credit and Other Measures) Act 2023 made it unlawful for a wagering or gambling service to accept credit cards, or digital currency such as cryptocurrency, in connection with gambling activity involving people in Australia. Penalties for breaching this provision run up to AU$234,750 per contravention, applied to the provider, and the change was framed explicitly around reducing gambling harm funded by borrowed money, which does not have to be repaid at the moment it is lost the way a debit-linked payment does.

This is a separate, later piece of legislation from the IGA itself, and the two should be kept apart. The credit and crypto ban does not create or remove any licensing requirement, it narrows the payment methods any wagering-related service, licensed or not, is permitted to accept. It is one reason account-based transfer methods such as PayID have become more prominent on offshore sites since mid-2024, those sites lost two payment options at once and account-to-account transfers filled part of the gap.

Why removing credit and crypto does not fix the underlying licensing problem

A site that stops accepting credit cards and crypto in order to comply with the 2024 measure has addressed exactly one legal requirement. It has not obtained an Australian licence, because none exists for it to obtain, and it remains a service prohibited under the IGA if it continues offering online casino games or pokies to people in Australia. Compliance with the payment-method rule and lawful status under the Act are two different things, and a site can achieve the first while remaining squarely in breach of the second.

What "unlicensed" means for you as a player

"Unlicensed" is not a technicality. An Australian licence for a wagering or gambling product typically comes bundled with obligations the operator must meet: holding player funds separately from operating funds, submitting to independent dispute resolution, meeting minimum standards for responsible-gambling tools, and being subject to a regulator that can compel a payout dispute to be resolved. None of that framework attaches to an unlicensed offshore site, because no Australian body has authority over it.

In practice, this means that if an offshore pokies site delays a withdrawal indefinitely, changes its terms after the fact, or simply stops responding, there is no Australian regulator, ombudsman, or licensing body a player can escalate the dispute to. Whatever internal complaints process the site itself offers is the entire avenue available, and it is run by the same party the complaint is against. ACMA publishes a short guide on how to check if a gambling operator is legal, which is a useful first step before assuming a site carries any oversight at all.

The gap between "reachable" and "regulated"

A site being reachable, taking PayID smoothly, and paying out reliably for months does not indicate regulatory oversight of any kind; it indicates that the operator has, so far, chosen to run its business that way. Nothing compels it to continue. That is the practical meaning of "unlicensed" for a player: the experience may look identical to a regulated product right up until the point something goes wrong, at which point the differences become obvious and there is little recourse.

Where legal status meets payments and safety

Legal status, payment mechanics, and player safety are three separate questions that this site deliberately keeps apart, because collapsing them is where most of the confusion around "PayID pokies" comes from. How the payment itself moves is covered on the PayID deposits page and the fast withdrawals page, neither of which has any bearing on whether the receiving site is licensed. How PayID compares to other payment options offshore sites use, including the methods now closed off by the 2024 credit and crypto ban, is covered on the PayID vs alternatives page.

Safety is a related but distinct concern from legality. A site can be entirely unlicensed under the IGA and still be one a player chooses to use; that choice carries its own risks around bank blocks, self-exclusion, and problem-gambling warning signs, all covered in full on the safe and responsible play page, which also explains honestly what BetStop does and does not cover.

The one-sentence version, if nothing else is retained

PayID is a legitimate bank payment rail; the sites using it to accept "PayID pokies" deposits are, with essentially no exceptions, operating without any Australian licence, in breach of the Interactive Gambling Act, and outside any Australian consumer protection, regardless of how quickly the payment itself settles.

Frequently asked questions