Fortris’s anti-money-laundering claims require independent testing because prior Crypto Payments News reporting cited a source alleging that the company processed flows for offshore betting businesses taking U.S. customers outside licensed state markets. The allegation remains source-attributed. It nevertheless makes the performance of Fortris’s customer due diligence, jurisdiction checks, wallet monitoring and escalation controls a matter for evidence rather than self-description.
Fortris says its digital-asset compliance product integrates KYT, AML and auditability, promotes a specialized gaming payment stack, and describes governance controls for treasury operations. The accountability question is whether an independent reviewer has sampled actual gaming customers and transactions, identified exceptions, tested management oversight and verified that remediation reached production.
AUSTRAC’s Airwallex direction
On January 22, 2026, Australia’s financial-intelligence regulator directed Airwallex Pty Ltd to appoint an external auditor. AUSTRAC said it suspected serious AML/CTF non-compliance involving customer due diligence, transaction monitoring, suspicious-matter reporting, the AML/CTF program and oversight. The formal notice to appoint an auditor defined a supervisory examination, not a penalty or final adjudicated breach.
Airwallex said it would cooperate and expected the audit to validate its framework, a position also reported in contemporaneous coverage. That response is a company expectation, not the audit’s result. Absent a later primary record, the benchmark is the scope and independence of the ordered work, not an assumption about what the auditor ultimately concluded.
What a Fortris audit should examine
A meaningful review would start with sample design. It should include high-risk gaming clients, operators with multiple brands, customers using regional wallets, flows for which player-location or territory data indicate U.S. or excluded-market exposure, and relationships that rely on several banking or crypto counterparties. The reviewer should trace onboarding evidence to live transactions and test whether licences, domains, beneficial owners, player geographies and settlement beneficiaries remain consistent.
The audit should replay monitoring scenarios rather than accept screenshots of policies. It should select alerts, reconstruct the relevant wallet and fiat routes, inspect analyst decisions and measure how long escalation took. It should test whether suspicious activity could be split among brands or wallets without triggering a consolidated view. It should also examine exceptions: who approved them, whether commercial pressure affected the decision and whether repeat exceptions reached executives or the board.
Independence requires more than using an outside firm. Fortris should disclose enough to establish who commissioned the work, which entities and products were in scope, what period and transaction population were tested, how samples were selected and whether management could exclude sensitive relationships. The reviewer’s access to customer files, wallet data, partner records and governance minutes determines whether the assurance covers operations or only documentation.
Exceptions and remediation
The most useful output is not a badge. It is a record of exceptions, severity, root cause, accountable owner and deadline, followed by retesting. Fortris should be able to show that a finding about missing jurisdiction data changed customer records; that a monitoring gap changed scenarios; that an overdue alert changed staffing or escalation; and that a governance weakness changed what senior leaders receive. Material unresolved issues should remain visible to counterparties assessing risk.
Assurance should follow the highest-risk pathways
The reviewer should not select only ordinary transactions. It should follow pathways most likely to expose control boundaries: a gaming customer with several brands, a player flow from a restricted geography, a wallet connected to multiple beneficiaries, an alert handed to a partner and a case where commercial staff sought an exception. Testing should determine whether the same facts remain visible from customer approval through settlement and whether each handoff preserves responsibility.
Fortris should also explain the assurance cadence. A one-time review may become stale as products, chains, customers and banking routes change. Material launches should trigger targeted testing, while the full framework should be revisited on a defined schedule. Independent reviewers should be able to test remediation without relying solely on management’s declaration that a fix was deployed. Counterparties need the date through which evidence is valid and notice when a major operating change falls outside the last completed review. They also need a clear timetable for the next targeted examination.
AUSTRAC’s investigatory direction shows why a platform’s own AML claims cannot serve as its only proof. Fortris’s earlier offshore-betting allegation and its public gaming capabilities create a stronger need for independent assurance focused on real flows. The question is not whether Fortris can publish a policy. It is whether an independent test can demonstrate that its controls identify, investigate and stop the risks those policies promise to manage.