Palmerbet Allowed Excluded Player to Gamble for 18 Months; Here’s the Data Error That Did That

Key Points

• ACMA identified 535 contraventions of the Interactive Gambling Act 2001 after Palmerbet failed to close a self-excluded customer’s account, counting one breach for each day past the practicable closure date.
• Palmerbet submitted a shortened first name and incorrect date of birth to the NSER, causing false negatives that kept the account active for 18 months despite a check being submitted just days after the customer registered.
• BetStop breach penalties increase substantially from 1 January 2027 under recently enacted federal legislation, giving operators limited time to fix documented compliance failures.

One self-excluded player had made 312 wagers at Palmerbet within 18 days. In the past year prior to that period, Palmerbet was continually providing incorrect name and date of birth information to the exclusion database in Australia. This resulted in false negatives being created each time, and the account remained active.

The report was issued by the Australian Communications and Media Authority on 23 September 2026. Palmer Bookmaking Pty Ltd (Palmerbet) made an 18-month court-enforceable undertaking due to its failure to comply with the self-exclusion rules for online gambling. The self-excluded player had enrolled with the BetStop, National Self-Exclusion Register of Australia, on 2 September 2023.

The ACMA investigation report confirmed the 312 bets were accepted across 18 days between December 2024 and February 2025. ACMA counted one contravention for each day the account remained open past a practicable closure date. That reached 535 contraventions of section 61MB(5) of the Interactive Gambling Act 2001. A further 18 contraventions of section 61KA(3) were confirmed for providing wagering services to a self-excluded person.

Wrong Data, Not a Broken System

The NSER functions by matching personal data operators submit against the register’s database. Under BetStop rules, operators must provide exact legal names, dates of birth, and postcodes. Palmerbet submitted a shortened first name and an incorrect date of birth for this customer. Every submission Palmerbet made returned a negative match from the register. That mismatch remained uncorrected, and the account stayed active for 18 months.

Palmerbet first submitted a BetStop check for this customer on 6 September 2023. That was four days after the customer registered, but the personal data submitted was already inaccurate. When the Register returned a positive match on 22 February 2025, Palmerbet closed the account that same day.

ACMA concluded Palmerbet had failed to take “reasonable precautions and exercise due diligence” in verifying customer identity data. Before BetStop launched, the Register operator issued technical specifications requiring exact names and dates of birth drawn from government documents. ACMA issued its own compliance guidance and reiterated those matching requirements formally in March 2024. Palmerbet updated its onboarding processes in mid-2023 to verify dates of birth and other customer details. Those changes were never extended to legacy accounts, including the account belonging to this customer. ACMA estimated that accurate data submitted in September 2023 would have led to closure within 24 hours.

Palmerbet has repaid all deposits the customer made from BetStop registration through to the February 2025 closure. Under the 18-month undertaking, Palmerbet must commission an independent review of its NSER compliance systems. The company must also fund and implement all improvements the review recommends. If the operator breaches the undertaking, ACMA can apply to the Federal Court to enforce its terms.

A Pattern Regulators Are Tracking Closely

Palmerbet joins a widening list of Australian operators facing BetStop enforcement in 2026. Earlier in September, ACMA issued Dabble Sports with 54 penalties totalling more than A$1 million over self-exclusion breaches. Dabble failed to close 157 wagering accounts after customers registered with BetStop. The operator also sent 839 electronic messages to 165 self-excluded people via SMS, email, and app notifications. ACMA had raised the inactive account risk with Dabble directly in August 2024. The subsequent investigation found those risks had not been adequately addressed.

Entain faced a court-enforceable remediation programme in May 2026 after its Ladbrokes and Neds brands accumulated over 500 breaches. Self-excluded customers across both brands could open new wagering accounts after registering with BetStop. In January 2026, six licensed operators including Tabcorp, LightningBet, and Betfocus were found in breach of BetStop requirements. Tabcorp paid an AU$112,680 penalty and entered its own court-enforceable undertaking.

The BetStop statutory review, published in December 2025, heard accounts of marketing sent to people after their exclusion period ended. Reports of contact during active self-exclusion were also received by the review, including birthday offers and push notifications sent to registered customers.

Penalties Set to Rise Sharply in 2027

Federal legislation confirmed earlier this year that penalties for BetStop breaches will increase substantially from 1 January 2027. For Palmerbet, the timing matters; the 18-month undertaking runs directly into that penalty shift. Across the wider sector, ACMA continued to identify BetStop breaches from multiple operators throughout 2026.

ACMA member Carolyn Lidgerwood was unequivocal following the Dabble ruling. “Persons who sign up with BetStop have made it abundantly clear that they wish to remove themselves from online betting,” she stated. “Providers have an obligation to respect that choice by closing those accounts and ensuring they do not receive gambling inducements.” “There needs to be a strong system in place at wagering providers to protect self-excluding persons.”

Expert Analysis: The System Protects Players Only If the Data Does

The Palmerbet investigation reveals something the industry is still reluctant to confront about BetStop’s design. Its matching process is only as reliable as the data operators choose to submit. ACMA’s compliance guidance and the Register operator’s technical specifications were in place before the register launched. Palmerbet submitted incorrect data for an account it had already flagged, and the mismatch went undetected for 18 months.

BetStop is presented publicly as a comprehensive safety net for people choosing to exclude themselves from wagering. The statutory review’s admission that the full extent of data-matching failures remains unclear raises a harder question. How many self-excluded Australians are still actively betting because an operator submitted a wrong date of birth? Nobody knows; the regulator doesn’t know, and the review itself couldn’t measure it. A system that cannot quantify its own failure rate cannot honestly claim to protect everyone relying on it.

We believe operators should be required to verify customer identity against government sources before submitting data to the NSER. BetStop’s framework currently places the entire verification burden on operators accurately self-reporting customer data, with no independent check to catch wrong information at submission. When a submission is incorrect, the register returns a negative match. Nothing flags it as potentially wrong data rather than a genuine non-match. ACMA’s finding that closure would have happened within 24 hours shows precisely how much the system depends on data precision. That kind of reform would change what self-exclusion compliance actually means.