VPN-friendly casinos in Australia — what the ACMA record actually shows

The phrase “VPN-friendly casino” gets used the way a marketing word gets used: to make an offshore product sound accommodating rather than what it is. This page walks through the eleven offshore casino brands the Australian Communications and Media Authority (ACMA) has issued formal warnings over for serving Australians, and reads what each warning, each block order and each payment-method claim actually carries.

Currency stamp: current as of 20 October 2026, verified against the ACMA’s own formal-warning register and the Interactive Gambling Act 2001 as amended.

The starting point is simple and uncomfortable. No Australian state or territory licenses online casino games, online pokies or in-play betting. The Interactive Gambling Act 2001, strengthened in 2017, makes it an offence to provide those products to a person physically in Australia. What is licensed is wagering on races and sporting events placed before the event — operated, in practice, under Northern Territory licences. Anything outside that frame is a prohibited interactive gambling service, regardless of what licence number the offshore site displays in its footer.

A VPN does not move a player outside that frame. It changes what the offshore site sees about the player’s IP address. It does not change which country’s consumer protection law applies to them, which complaints body has jurisdiction over a refused withdrawal, or whether the site is connected to BetStop, the National Self-Exclusion Register. That is the whole of the difference, and it is smaller than the marketing language suggests.

Eleven offshore brands the ACMA has formally warned

The ACMA’s enforcement arm has two visible shapes: a formal warning naming an operator and a brand, and a block order directing Australian internet service providers to cut access. Both are public record. The table below gathers the eleven brands covered on this page, in the order the ACMA has published warnings over them, with the operator entity the regulator named and the subject support each brand’s own listings claim. Subject support is what each operator’s own listings pages say about payment methods and VPN access — reported here as those listings report it, not endorsed.

Five of the eleven brands have no claim to any subject support their listings pages will stand behind — no payment-method listing, no VPN-access note, no responsible-gaming hook. The page reads them on the ACMA record alone.

The shape of the record

Two operators account for six of the eleven warnings. Dama N.V. takes Level Up (May 2022), Woo Casino (March 2025) and Spirit Casino (May 2025), with an earlier RocketPlay warning carried forward into a new Pulsup Ltd warning in March 2026. Consolutetish S.R.L. picks up National Casino and Bizzo Casino in the same July 2025 round, the latter stacking on a 2022 TechSolutions warning that pre-dates the current operator entity. The point is not the name — Curaçao-registered shelf companies come and go — it is that the warning follows the brand pattern, not the corporate pattern, and a rebrand does not reset the record.

The remaining five sit across separate operators: Hollycorn N.V. (Sky Crown), Sterplay Holding Ltd (Casino Intense), EOD Code SRL (Instant Casino), Bamboo Media (Ignition Casino), and Ryker B.V. (Jackbit). None of those operators holds an Australian licence to offer online casino games, because none can — no Australian licence exists for that product.

What each warning actually says

A formal warning under the Interactive Gambling Act 2001 is the regulator’s first move. It names the operator entity, the brand, the prohibited service, and the date. It is not a fine and it is not a prosecution. What it does is put the operator on notice that further ACMA action — block orders, civil penalty proceedings — follows if the service keeps taking Australian customers. The same regulator has, separately, asked Australian ISPs to block 1,751 illegal gambling and affiliate marketing websites since November 2019, with 12 more added in the round reported on 26 June 2026. The block list is the second move; the warning is the first.

What “VPN-friendly” actually changes — and what it does not

A VPN replaces the IP address a casino’s server sees with the IP address of an exit node, typically in another country. The site’s geo-location logic now reads “we have a visitor from Frankfurt” or “we have a visitor from Toronto”, and lets the page load where it would otherwise have shown a block screen or an empty lobby.

That is the entire technical change. Everything else stays the same:

• The player is still physically in Australia. The Interactive Gambling Act applies to provision of the service to a person in Australia, not to where the IP address sits.
• The payment still leaves an Australian bank account. Card-issuer gambling blocks, PayID-holder name checks and the AUSTRAC reporting environment do not stop working because the casino’s server thinks the player is somewhere else.
• The complaint pathway is still the operator’s own terms page. ACMA cannot compel a Curaçao-registered shelf company to release a disputed withdrawal. The Curaçao master licence under which most of these brands operate has its own complaint mechanism, but it sits outside any Australian framework.
• The self-exclusion mechanism is still BetStop — and BetStop binds only Australian-licensed wagering services. An offshore casino is not connected to it.

A site that brands itself “VPN-friendly” is, technically, a site that does not run aggressive geo-IP blocking on its login or signup pages. Some actively tell players how to configure a VPN; others just do not detect one. The marketing language makes the first shape sound like a feature; it is not a feature the regulator recognises.

Why offshore operators advertise it

Three reasons, each pragmatic. First, Australian ISPs block domains at the regulator’s request, and a block order is a fixed list of URLs — if the player can reach the site through a different network path, the block does not bite. Second, the offshore site’s own geo-IP filter would normally refuse an Australian IP at signup, and skipping that filter is the whole point of “VPN-friendly”. Third, marketing. A player who already intends to use a VPN is a player the operator wants to keep, and a label that names the workaround is a label that buys that player’s trust.

The reason it is worth saying plainly: the operator’s incentive is to make the workaround feel safer than it is. The “VPN-friendly” badge does not move the player outside the Interactive Gambling Act, and it does not put an Australian consumer protection regime between the player and a refused withdrawal.

The fundamentals of how an offshore casino actually sits in the Australian market

The marketing claim “VPN-friendly” only has weight against the background of what is actually licensed. The shape of that background is small and specific.

What is licensed in Australia

Wagering on racing and on sporting events placed before the event. Lotteries. Keno. The Interactive Gambling Act carves those out as licensed interactive wagering services, and most of them operate under Northern Territory licences issued by the Northern Territory Racing and Wagering Commission. The Commission regulates 52 of Australia’s online bookmakers — Sportsbet, Bet365, Ladbrokes among them — for tax reasons, with a small in-person footprint that meets once a month in Darwin. Online casino games and online pokies are not on that list. No state or territory licenses them, and no path exists to license them under the current Act.

What is prohibited

Online casino games. Online pokies. In-play betting on sporting events. The Act makes it an offence to provide those products to a person in Australia. The minimum age is 18. The IGA targets the provider — the offshore operator — not the individual player. A player who opens an account on an offshore site is not prosecuted, but they are also outside the Australian framework that protects them when something goes wrong.

What enforcement looks like

Two visible instruments. The first is the formal warning, which names an operator and brand. The second is the block order, which asks Australian ISPs to cut access. As of June 2026, the ACMA reports 1,751 illegal gambling and affiliate marketing websites blocked since the first blocking request in November 2019, and more than 230 unlicensed gambling services that have left the Australian market since enforcement was strengthened in 2017. The June 2026 round alone added 12 names: 7Signs, ChromaBet, Donbet, Duospin, Freshbet, Slots Gem, Jacks Club, Lucky Start, Pointsbetz, Spinrise, Vinyl Casino and Wildsino. None of those twelve appear in the table above, because none has yet drawn a separate formal-warning publication naming the brand.

Where the money goes

H2 Gambling Capital’s 2025 estimate puts Australian losses to illegal gambling sites at roughly A$3.9 billion a year, and traces the share of gambling going through legal channels falling from 74% in 2021 to 64% — a ten-point drop over four years that the licensed wagering market has not absorbed. The estimate is not a regulator’s figure; it is a private-sector read of the same flow the ACMA’s block list is trying to cut. Reading the two together, the block list is large and the flow is larger.

What the payment shape adds

A licensed Australian wagering service cannot take credit cards, credit-related products or digital currency — that restriction came into force on 11 June 2024, with operator penalties up to A$247,500. The legal deposit routes are debit card, bank transfer, PayID/Osko and BPAY. An offshore site that asks an Australian for a credit card or a crypto deposit is operating outside those rules. The payment shape is, in practice, a fingerprint of which side of the framework a site sits on.

What an offshore casino actually sees when the player uses a VPN

The technical side is narrow enough to state plainly.

What changes

The casino’s web server reads the IP address of the VPN exit node, not the player’s home IP. The geo-IP database the operator subscribes to then returns a country — typically the country the exit node sits in — and the site’s “you are in a restricted country” logic does not trigger. That is the entire change. KYC checks, when the operator runs them at all, still depend on the documents the player submits, not on the IP at login.

What does not change

The payment instrument. A PayID transfer to a name the player does not recognise still arrives. An Apple Pay transaction routed through a card with a gambling block still fails at authorisation, because the block sits at card level — Westpac’s gambling block refuses authorisation of transactions registered under the merchant category code “Betting/Casino Gambling” on eligible personal credit and debit cards, and ANZ’s block, once activated in the ANZ app, also blocks gambling transactions made through a digital wallet such as Apple Pay on an eligible card. The VPN does not move the payment rail.

What the operator’s listings actually say

The “Subject support” column in the table above names what each brand’s own listings pages claim — payment methods, responsible-gaming hooks, regulatory references. Where the cell is empty, the brand’s listings pages have not stood behind any subject the regulator’s record would recognise. That is what those listings report; it is not a judgement about what the brand’s own server actually does.

Reading the eleven brands individually

The brand-by-brand read below carries the same shape each time: the ACMA warning as published, what the warning actually says, what the brand’s own listings pages claim, and a verdict on what the record looks like from the outside. The verdict is a judgement of the public material, not of the brand’s product.

RocketPlay

The ACMA issued a formal warning to Pulsup Ltd over Rocketplay.com.au in March 2026, stacking on an earlier Dama N.V. warning in May 2022. The brand’s listings pages on Gambling Insider cite VPN access support. The warning is current and the operator entity has already changed once. From the outside, that is two regulator notices over the same brand pattern, with the current operator entity newer than the most recent action. The verdict sits in the warning itself: the regulator has now named this brand twice.

Level Up Casino

The ACMA issued its formal warning to Dama N.V. over Level Up in May 2022, as part of the same round that covered Bambet, Dazard, Rocketplay, Wild Tornado and Cobra Casinos. The brand’s listings pages cite Westpac’s gambling block as a feature reference — that is, they describe a feature in terms of a bank-level card block rather than the casino’s own product. Four years have passed since the ACMA warning, and the brand’s footprint remains minimal.

Woo Casino

Dama N.V., March 2025. The brand’s listings pages carry no subject support — no payment-method listing, no VPN-access note, no responsible-gaming hook the page can quote. This warning is a recent addition to the ACMA record, and the brand offers no verifiable support information to the public.

Spirit Casino

Dama N.V., May 2025. Same shape as Woo: a recent warning, no listings-page claim. The two brands sit two months apart on the regulator’s timeline. Given the recent date of this warning, the absence of any public-facing support claims makes the brand’s position unclear.

National Casino

Consolutetish S.R.L., July 2025. The brand’s listings pages cite the ACMA, AUSTRAC and BetStop — three Australian regulatory references in a single listing. BetStop binds only Australian-licensed wagering services, so a brand claiming BetStop coverage is either describing a non-BetStop exclusion tool under that name, or describing BetStop from the outside. The 2025 ACMA warning stands, and the brand’s loose inclusion of Australian regulatory references serves more to confuse a reader than to offer genuine assurance.

Bizzo Casino

Consolutetish S.R.L., July 2025, with an earlier 2022 warning to TechSolutions (CY) Group Limited and TechSolutions Group N.V. The brand’s listings pages cite Gambling Insider. Two operators over the same brand, with a four-year gap between warnings. The verdict sits in the pattern: the regulator has named this brand twice under two different operator entities.

Ignition Casino

Bamboo Media, July 2025. No subject support from the brand’s listings pages. Following the recent ACMA warning, there is no evidence that this operator supports any of its claims on its own pages.

Instant Casino

EOD Code SRL, February 2025. The brand’s listings pages cite ecoPayz and PayID — PayID is an Australian real-time payment rail, and citing it on an offshore casino site that is the subject of an ACMA warning is a payment-method claim that runs against the regulator’s record. The 2025 regulator notice highlights a brand that deceptively claims payment methods that do not operate within the Australian legal system.

Jackbit

Ryker B.V., April 2026. No subject support from the brand’s listings pages. As the newest warning on the ACMA list, this operator has yet to establish any verifiable public footprint or support claim.

Casino Intense

Sterplay Holding Ltd, April 2025. The brand’s listings pages cite AUSTRAC, BetStop and Gambling Insider. Three Australian regulatory references in a single listing, with the same BetStop caveat as National Casino. With a 2025 ACMA warning on the record, the loose claims found on the brand’s own listings pages lack any verifiable regulatory backing.

Sky Crown

Hollycorn N.V., September 2022. The oldest warning on this page, and the only one without a follow-up. The brand’s listings pages carry no subject support. The verdict is that the warning is four years old and the public footprint is empty.

Reading the operators behind the brands

A formal warning names an operator entity, and the eleven warnings on this page sit across seven distinct operators. Reading them as operators, rather than as brands, tightens the picture.

Dama N.V. takes Level Up (May 2022), Woo Casino (March 2025), Spirit Casino (May 2025) and the original RocketPlay (May 2022). A second RocketPlay warning to Pulsup Ltd arrived in March 2026. That is five warnings over the same Curaçao-registered shelf company, with one brand re-appearing under a new operator entity.

Consolutetish S.R.L. takes National Casino and Bizzo Casino in a single July 2025 round, with Bizzo stacking on a 2022 warning to TechSolutions (CY) Group Limited. The brand survived the rebrand; the warning record did not.

Hollycorn N.V. takes Sky Crown and Blue Leo in a single September 2022 publication. The ACMA’s formal-warning page names both brands in one document. EOD Code SRL takes Instant Casino (February 2025). Sterplay Holding Ltd takes Casino Intense (April 2025). Bamboo Media takes Ignition Casino (July 2025). Ryker B.V. takes Jackbit and CasinOK in a single April 2026 publication.

The pattern is consistent: warnings cluster by operator, and one operator can carry several brand names over several years. The brand-level marketing and the operator-level regulator record are two different shapes, and the regulator’s record is the one that holds across rebrand and across re-registration.

How quickly the ACMA’s block list has grown

The arithmetic on this page is the blocking rate the regulator has maintained since the first block order in November 2019. The 26 June 2026 round reports a running total of 1,751 blocked sites and affiliate marketing pages. The first blocking request was November 2019. That is roughly 80 months of enforcement, with the June 2026 round adding 12 more names in a single day.

A reasonable read is a band, not a single figure. Across the full enforcement period the ACMA has averaged roughly 21 blocked sites per month — the 1,751 total divided by the 80 months since November 2019. The June 2026 round alone averaged 12 per day for one working day. The two numbers are not contradictory; the regulator’s cadence is uneven, with quieter months punctuated by larger published rounds. A reader who treats the monthly average as a forecast should weight it against the variance: 12 sites can land in a single round, and the next month can carry none.

The 12 names added in the June 2026 round are themselves an uneven batch. 7Signs, ChromaBet, Donbet, Duospin, Freshbet, Slots Gem, Jacks Club, Lucky Start, Pointsbetz, Spinrise, Vinyl Casino and Wildsino. Five are recognisably the same template — a small Curaçao-registered operator running a single brand under one of the standard white-label platforms. Pointsbetz is the obvious outlier: the .com.au convention is Australian and the brand name implies wagering rather than casino, but it sits in the same enforcement round as the casino brands. The ACMA does not separate casino sites from wagering sites in a blocking round; the test is whether the service is a prohibited interactive gambling service offered to a person in Australia.

What “VPN-friendly” looks like at the payment layer

The marketing language is about the network. The friction is at the payment layer, and the friction is harder to route around.

Card-issuer gambling blocks

Three of Australia’s largest banks run card-level gambling blocks. Westpac’s block refuses authorisation of transactions registered under the merchant category code “Betting/Casino Gambling” on eligible personal credit and debit cards. ANZ’s block, activated in the ANZ app, also blocks gambling transactions made through a digital wallet such as Apple Pay on an eligible card, and once activated requires a 48-hour waiting period before it can be removed. Commonwealth Bank’s CommBank app lets customers apply a gambling lock to eligible cards, automatically blocking most gambling transactions — though the bank states it cannot guarantee all gambling-related purchases will be stopped.

The blocks sit at the card-issuer level, not at the casino level. A VPN that takes the player past the casino’s geo-IP filter does not take the player past Westpac’s merchant category filter. The two are different layers, and only the first is changed by a VPN.

Digital wallets and the 2024 credit-card ban

The Interactive Gambling Act, as amended in 2023, bars Australian-licensed online wagering services from accepting payment by credit card or other credit-related products — a restriction that also constrains gambling use of linked digital wallets. Apple Pay itself does not charge consumers a fee for using it in stores, online or in apps; any surcharge comes from the merchant’s own card-processing fees, not from Apple. The transaction limits and PIN requirements for Apple Pay purchases are set by the card issuer or merchant, not by Apple. By the end of 2025, Apple Pay, Google Pay and Samsung Pay transactions collectively accounted for around 45% of all card payments in Australia by number.

The point of the numbers is what they are not. They do not say how many of those wallet transactions were gambling transactions — they say how the payment surface looks. A reader who uses Apple Pay on a card with a gambling block reaches a card-issuer refusal regardless of whether the wallet interface shows a successful authentication.

PayID, Osko and the name-on-the-account check

PayID-based instant transfers are available at over 100 Australian financial institutions, with more than 25 million PayID identifiers registered on Australia’s New Payments Platform as of April 2025. With Osko, a bank transfer between participating Australian banks arrives in under a minute, 24/7 including weekends. Paying to a PayID shows the name of the account holder before the transfer is sent.

The Australian Payments Plus operator of PayID and Osko warns that being asked to transfer money to a PayID on an illegal gambling site almost certainly means a scam site. The warning is from the payments platform itself, and it sits in the same sentence as the technical description. A reader who sees a PayID deposit option on an offshore casino site that has been formally warned by the ACMA is reading a payment-method claim against a payments-platform warning.

BPAY

BPAY has operated in Australia since 1997, is available in the online banking of over 140 banks and financial institutions and is offered by over 95,000 businesses. It is a bill-payment service in online banking: the payer enters the Biller Code and the Customer Reference Number (CRN) printed on the bill. It is run by Australian Payments Plus, the same operator that runs PayID and Osko. It is a closed-loop Australian payment rail: the biller needs a BPAY account, and an offshore casino site would need to maintain one to claim BPAY support. The claim is unusual on offshore sites; the rail is unusual for offshore services.

AUSTRAC reporting thresholds

AUSTRAC’s threshold-transaction-report rule, which requires reporting of transfers of A$10,000 or more, applies only to physical cash. Ordinary electronic bank transfers are not subject to that per-transaction reporting requirement, regardless of the amount sent. The threshold is a shape on the cash side of the payments surface; it is not a shape on the bank-transfer side.

What the 2026 reform package actually changes

The Interactive Gambling Amendment (Gambling Reform) Bill 2026 passed Parliament on 19 August 2026. Its advertising and inducement measures commence 1 January 2027. Law with a start date, not yet in force. The page that describes what a 2026 reader sees in the market is describing the pre-1-January-2027 market; the page that describes what a January-2027 reader sees will look different.

The reform’s centre of gravity is the inducement side — the bonus structures, sign-up offers and “free bet” language that licensed Australian wagering services have used to recruit customers. The offshore side of the market is largely untouched by the reform’s language, because the IGA already prohibits the products. The reform is a tightening of the licensed side, not a softening of the offshore side.

The responsible-gaming picture for someone considering an offshore site

The responsible-gaming shelf on this page exists because the topic is on the page. It is not a section about how offshore operators handle responsible gaming; it is a section about what a player who lands on an offshore site can actually use.

BetStop and what it actually binds

BetStop, the National Self-Exclusion Register, has been live since August 2023. It binds Australian-licensed online and phone wagering services. An offshore casino is not connected to it. A player who excludes themselves through BetStop has excluded themselves from the licensed wagering market, not from the offshore casino market.

A player considering an offshore casino and looking for a self-exclusion mechanism needs to use the mechanism the offshore casino itself offers, if it offers one, and to understand that an offshore mechanism is not enforced by an Australian regulator. BetStop is not available on these sites because BetStop is an Australian framework and these sites are outside it.

Gambling Help Online and the helpline

The National Gambling Helpline is 1800 858 858, free, 24/7, with chat available at Gambling Help Online. The line is a service, not a regulator. It does not enforce, it does not arbitrate, and it does not compel an operator to act. It is what it is: a place to talk through what is happening and to find a counsellor who knows the Australian framework.

Bank-level gambling blocks as a practical backstop

Westpac, ANZ and Commonwealth Bank all run card-level gambling blocks. ANZ’s block, once activated, requires a 48-hour waiting period before it can be removed. The block sits at card level and works at authorisation. It does not depend on the offshore site cooperating, because the block is upstream of the casino’s payment processing.

A player who is unsure whether they want to keep playing on an offshore site has, in the bank-level block, an instrument that does not require the offshore site to do anything. It cuts the payment rail before the casino’s server sees the transaction.

Why offshore operators’ own responsible-gaming claims are thin

A responsible-gaming claim on an offshore site is a claim by the operator about itself. It is not a claim that an Australian regulator has signed off on. A claim of “BetStop support” on a National Casino or Casino Intense listings page is a claim about what those pages describe, not a claim that BetStop itself has any relationship with the site. A reader who treats those claims as operator fact reads them more generously than the regulator’s record supports.

What the reader actually has to weigh

The question is not whether an offshore casino is well-designed. Some are, and some are not. The question is what the player gives up by sitting outside the Australian framework, and what the marketing language on the operator’s site adds up to.

What is given up

Australian consumer protection. The complaints body that operates when a licensed Australian wagering service refuses a withdrawal is not available to a player on an offshore site. The recourse for a refused withdrawal on a Curaçao-registered site is the operator’s own terms page and, in some cases, the Curaçao master licence’s complaint mechanism — neither of which sits in the Australian framework.

Connection to BetStop. The National Self-Exclusion Register does not bind offshore casinos. A self-exclusion through BetStop does not extend to an offshore site.

Block-list vulnerability. A site on the ACMA’s block list can be cut at the Australian ISP level. A VPN moves the network path, but the block list is updated and a player who has a balance on a blocked site when the next round lands has a balance they cannot reach. The ACMA’s June 2026 round added 12 names in a single publication; the next round is a moving target.

What the marketing adds up to

A “VPN-friendly” badge is a description of the operator’s own geo-IP behaviour. It does not change which country’s consumer protection applies, which complaints body has jurisdiction, or which self-exclusion register binds the site. The marketing language is, in practice, the operator describing a workaround it actively supports.

A PayID deposit claim on an offshore site is a description of what the operator’s payment page shows. The PayID rail itself is Australian, and Australian Payments Plus has published a warning that being asked to transfer money to a PayID on an illegal gambling site almost certainly means a scam site. The claim does not contradict the warning — they describe different sides of the same transaction.

An Apple Pay claim on an offshore site is a description of a wallet interface. The wallet sits on top of a card, and the card-issuer gambling block sits below the wallet. The block does not care which interface the player used to authenticate.

The cost the marketing does not name

The cost is the same cost any prohibited interactive gambling service carries: no Australian consumer protection, no Australian complaints body, no BetStop coverage, and the prospect of the next block order cutting access. The marketing language tends to soften that cost. The arithmetic on the page above — the running total of 1,751 blocked sites and the cadence of the ACMA’s rounds — is what the cost looks like in plain numbers.

Where the page lands

The page lands where the topic lands. “VPN-friendly” is a label. What it labels is an offshore casino that does not aggressively geo-IP block Australian players, served to a player who is still physically in Australia, with a payment rail that may itself be blocked at card level, on a site that may itself be cut by the next ISP block order. The reader who lands on this page with a question — can I use a VPN to make this legal, or safer, or both — leaves with the answer the ACMA’s record already gives: the activity is not licensed in Australia, the protection is not Australian, and the VPN changes what the casino’s server sees rather than what the law applies.

Frequently asked questions

Why would a casino specifically advertise itself as “VPN-friendly” in the first place?

Because Australian ISPs block domains at the ACMA’s request, and a casino that does not aggressively check the player’s IP lets Australian customers reach the site through a different network path. The marketing label describes the operator’s own geo-IP behaviour — it does not move the player outside the Interactive Gambling Act, and it does not change which country’s consumer protection law applies to them.

Does using a VPN to access an offshore casino change whether the activity is legal for someone in Australia?

No. The Interactive Gambling Act 2001, as amended in 2017, makes it an offence to provide online casino games to a person in Australia. The Act targets the provider, not the individual player, so the player is not prosecuted — but the activity is still a prohibited interactive gambling service, and an offshore casino gives no Australian consumer protection, no Australian complaints body and no recourse if a withdrawal is refused. A VPN changes the IP address the casino sees, not the physical location the law applies to.

How does a VPN change what an offshore casino site can actually see about where a player is connecting from?

It replaces the player’s IP with the IP of the VPN exit node, so the casino’s geo-IP database reads the exit node’s country rather than Australia. KYC checks, when the operator runs them, still depend on the documents the player submits, not on the IP at login. The payment rail is unchanged — a card with a gambling block is refused at authorisation regardless of where the IP says the player is.

What risk does a player take on by using a VPN to reach a casino that has been formally warned before?

The risk is the same risk an offshore casino carries without the VPN: no Australian consumer protection, no BetStop coverage, no Australian complaints body, and a balance that can be cut off when the next ACMA block round lands. The VPN does not protect the balance from a future block order, because the block list is updated. A formal warning is the regulator’s first move; the block order is the second, and the second can follow quickly.

Is a casino that “allows VPN use” any different, technically, from one that simply does not check?

No. The two describe the same thing from two angles. A site that advertises “VPN-friendly” is a site that does not run aggressive geo-IP blocking on its login or signup pages. A site that does not check is the same site on a different description. The marketing label is the operator’s framing of its own geo-IP behaviour, not a separate technical feature.

What should someone consider before treating VPN access as a safe workaround rather than a legal one?

The activity is a prohibited interactive gambling service under the Interactive Gambling Act, the consumer protection is not Australian, the self-exclusion register does not bind the site, and the payment rail may itself be blocked at card level. A VPN changes the network path, not the legal position. The card-issuer gambling blocks at Westpac, ANZ and Commonwealth Bank cut the transaction at authorisation regardless of the IP address, and the ACMA’s block list is updated over time. A reader who treats the VPN as a safe workaround is treating a network change as a legal change, and the two are different.