Red Teaming A System: How One Adversarial Exercise Stopped a Flawed Payments Rollout
The trials were already running. Real venues, real players, real money moving through a cashless gaming system that an Australian jurisdiction intended to roll out across gaming machines and wagering. Political commitment had been made. Industry had invested. The project had momentum, and momentum is a powerful thing.
Then a room full of people spent a structured session thinking like criminals, and the project stopped.
The facilitator who ran that exercise has often reflected on it since. Not because the outcome was dramatic – although it was. It is because of what it reveals about how organisations test the systems they build, and how rarely they test them against the people who will actually try to exploit them.
The logic of the proposal
On paper, cashless gaming looked like an anti-money laundering win. Removing cash from the system appeared to remove the launderer’s favourite instrument. Every transaction becomes traceable. Every player is identified. Every dollar has a digital history. The harm minimisation case was strong, too, and the two objectives together made the reform feel not just sensible but overdue.
That logic is intuitive, and intuitive logic is exactly where risk hides. The design had been tested the way most regulatory and commercial systems are tested. Did it meet the policy objectives? Did it satisfy the legal requirements? Was it technically feasible? Would the industry cooperate? Those are compliance questions, and the system passed them.
Nobody had asked the other question. If a money launderer were looking at the system, how would it be exploited?
One room, every perspective
The exercise brought together people who almost never sit at the same table. Gaming machine and app manufacturers, who understood exactly what the technology could and could not enforce. Police, who understood how organised crime actually behaves in venues rather than how legislation assumes it behaves. Banks, who understood the payment pathways the new system would travel through. The regulator, who understood the framework. And the federal financial intelligence agency, which understood what laundering looks like in transaction data at national scale.
The composition mattered more than any single area of expertise in the room. Money laundering is a system-level activity. It works by moving value across boundaries: between venues, between products, between institutions, between jurisdictions. Each participant could see their own segment clearly. None of them, alone, could see the whole pathway a criminal would take. The entire purpose of the exercise was to assemble those partial views the way an adversary would, deliberately and methodically, looking for the seams.
That assembly does not happen by putting smart people in a room and hoping. Red teaming is a disciplined technique with structure, roles, and rules. Participants are pushed out of their institutional positions and into the adversary's chair, which is harder than it sounds. A bank does not naturally want to describe how its own products could be misused. A manufacturer does not enjoy explaining the limits of its technology in front of the regulator. Skilled facilitation exists to make that honesty safe, and to keep the group anchored to the adversary's incentives rather than drifting back into defending the design.
What the exercise found
The specific exploitation pathways are not detailed here, for obvious reasons. However, the shape of what happened can be described , because that shape is the lesson.
The design rested on a set of assumptions that had never been stress-tested. The central one was that traceability equals deterrence: that if every transaction is visible, criminals will stay away. It is a comfortable assumption and it is wrong. Sophisticated laundering has never depended on invisibility. It depends on plausibility, on volume, on the ability to make illicit flows look like ordinary behaviour inside a busy system. A fully digital environment does not necessarily frustrate that. In some configurations, it assists it, by creating clean, bankable records for value that entered the system dirty.
Once the group started reasoning from the criminal's side, the seams appeared quickly. Assumptions about identity at onboarding. Assumptions about how limits and controls would behave across multiple venues and products. Assumptions about who would be watching the data, with what tools, and how fast. Each assumption looked reasonable in isolation. Assembled into an end-to-end pathway, they produced a conclusion nobody in the project had anticipated: the proposed system would not stop money laundering, and in several respects, it would have made laundering easier, at greater speed and scale, with a veneer of digital legitimacy that cash never provides.
The finding was structured, evidenced, and accepted by a room that included the technology builders, the police, the banks, the regulator, and the national financial intelligence agency. That consensus is what gave it force. The project was halted and returned to the scoping stage, with live trials already in the field and momentum already built. Those who have worked in or around government know how institutionally difficult that decision is. It happened because the intelligence was impossible to dismiss.
The cheapest intelligence a company will ever buy
The comparison the facilitators keep returning to is instructive. In the same country, in the same regulatory system, two major gaming operators went through public inquiries in 2021 and 2022 that found them unsuitable to hold their licences. Both were data-rich. Both had invested heavily in compliance. Both ultimately received their intelligence about what was happening inside their own businesses from external inquiries, after the fact, at a cost measured in hundreds of millions of dollars, along with destroyed board careers and, in one case, the survival of the company itself.
The cashless gaming exercise delivered its intelligence before deployment, in one day, at the cost of one facilitated workshop.
Same threat. Same country. The only meaningful difference was when the intelligence arrived.
That difference is the entire argument for adversarial testing, and it applies well beyond one Australian payments reform. Every part of the iGaming industry is currently building or rebuilding systems under pressure: new payment methods, new markets, new platforms, new regulatory frameworks, new identity and verification methods. Each of those is a set of assumptions waiting to be tested. The only question is who does the testing first: the organisation or its adversary.
Making it work in practice
A few things separate genuine red teaming from a workshop that merely borrows the name.
The first is timing. The technique earns its keep before commitment, when a design can still change. Red teaming a system after launch produces a list of problems the organisation now owns. Red teaming it at the scoping or design stage produces a better system. If trials are already running, as they were in this case, it is late but not too late, and the courage to act on the findings matters as much as the findings themselves.
The second is composition. The exercise should bring together people who see the parts of the system that others do not. For an operator, that might mean payments partners, fraud teams, affiliates and, where the relationship allows it, the regulator. Homogeneous rooms produce comfortable answers.
The third is facilitation. The value of the exercise lives in disciplined challenge, in keeping participants inside the adversary's logic and outside their own defensiveness. That is a specialist skill, and it is the difference between an exercise that changes a decision and one that produces a slide nobody reads.
The final consideration is the mandate. A red team finding only matters if it connects to a decision-maker who can act on it. Intelligence that sits in a file is not intelligence. It is useless.
The gaming industry does not lack information. It is drowning in it. What it lacks, too often, is the willingness to point that information at its own designs and ask the uncomfortable question before someone with worse intentions asks it first. One Australian jurisdiction asked it in time. The inquiries of 2021 and 2022 show what happens when nobody does.
Author Bio: Anne-Maree Quarmby is Director and Chief Operating Officer of Intelligence Rising, a specialist intelligence advisory and training firm operating the world's first internationally accredited online learning centre for intelligence officers.
One of Australia's most experienced regulatory intelligence practitioners, she contributed directly to the intelligence work underpinning Australia's landmark gaming industry inquiries and led red team reviews of proposed gaming legislation, including cashless gaming. Her international work includes advising the Anti-Money Laundering Council of the Philippines on behalf of the US Department of Justice and the National Gaming Control Board of Papua New Guinea, and she is a speaker at SPiCE Southeast Asia 2026.
Explore these and other topics at Eventus International’s upcoming events: https://www.eventus-international.com/
