NZ AML/CFT Compliance Officer cheat sheet

AML/CFT Act 2009 (the Act) is the primary legislation; the AML/CFT (Definitions) Regulations 2011 and AML/CFT (Requirements and Compliance) Regulations 2011 supplement it.

Reporting entities must be registered with the Department of Internal Affairs (DIA) before commencing business, and renew registration annually.

Core obligations: risk assessment, customer due diligence (CDD), ongoing CDD and transaction monitoring, suspicious activity reporting (SAR), prescribed transaction reporting (PTR), compliance programme, and record keeping.

Supervisors: DIA supervises most reporting entities; Financial Markets Authority (FMA) supervises issuers, licensed supervisors, and certain financial institutions; Reserve Bank of New Zealand (RBNZ) supervises banks, life insurers, and non-bank deposit takers.

Penalties for non-compliance include civil penalties up to NZD 2 million for individuals and NZD 20 million for bodies corporate, and criminal penalties including imprisonment.

Reporting entities must designate a compliance officer with sufficient seniority and resources to oversee the compliance programme.

The Act implements the FATF Recommendations; New Zealand is evaluated under the FATF mutual evaluation process.

AML/CFT (Definitions) Regulations define 'customer', 'beneficial owner', 'politically exposed person' (PEP), and 'foreign PEP'.

Risk-based approach: allocate CDD and monitoring resources proportionate to assessed money laundering/terrorism financing (ML/TF) risk.

Risk assessment must consider customer, product/service, delivery channel, country/geography, and transaction volume/type factors.

Inherent risk = likelihood × impact; residual risk = inherent risk minus effectiveness of controls.

Reporting entities must conduct an AML/CFT risk assessment and update it when new risks emerge or at least every 2 years.

Risk assessment must be documented and available to the supervisor on request.

Enhanced CDD (EDD) is required for high-risk customers, including PEPs, correspondent banking relationships, and customers in high-risk jurisdictions.

Simplified CDD may be applied to low-risk customers only after a documented risk assessment justifies it.

Transaction monitoring thresholds and rules should be calibrated to the entity's risk assessment and customer base.

CDD must be completed before establishing a business relationship or conducting an occasional transaction of NZD 10,000 or more (or higher prescribed thresholds for certain services).

CDD requires: identity verification, beneficial ownership identification, purpose and intended nature of relationship, and source of funds/wealth for higher-risk customers.

Identity verification: for individuals, use reliable and independent documents, data, or information (e.g., passport, driver licence, electronic verification).

EDD triggers: PEPs, high-risk countries, complex/unusual ownership structures, correspondent banking, and high-risk products.

EDD measures include: obtaining additional identity information, verifying source of funds/wealth, obtaining senior management approval, and enhanced ongoing monitoring.

Simplified CDD: may reduce verification measures but must still identify the customer and beneficial owner; cannot be applied to high-risk customers.

If CDD cannot be completed, the reporting entity must not establish the relationship or conduct the transaction, and must consider filing a SAR.

CDD records must be kept for at least 5 years after the relationship ends or the transaction is completed.

Beneficial owner: natural person(s) who ultimately own or control the customer (usually >25% ownership or voting rights) or on whose behalf a transaction is conducted.

For trusts: beneficial owners include trustees, beneficiaries with vested interests, and any natural person exercising ultimate control.

For companies: identify natural persons with >25% ownership or control; if no such person, identify senior managing official.

Verify beneficial ownership using reliable, independent sources (e.g., company registers, trust deeds, shareholder agreements).

Identity verification must be based on reliable and independent documentation, data, or information; electronic verification is permitted if reliable.

For legal persons, verify legal existence and structure (e.g., certificate of incorporation, partnership agreement).

PEPs: determine if customer or beneficial owner is a PEP; if so, apply EDD including senior management approval and source of wealth/funds verification.

Record keeping: retain copies of identification documents and verification records for at least 5 years.

Ongoing CDD: conduct ongoing due diligence on the business relationship, including keeping CDD information up to date and monitoring transactions.

Transaction monitoring: implement systems and procedures to detect unusual or suspicious transactions, including automated monitoring where appropriate.

Monitor for: transactions inconsistent with customer profile, unusual patterns, large or frequent transactions, and transactions with high-risk jurisdictions.

Review and update customer risk ratings and CDD information when there are changes in customer circumstances or risk profile.

Periodic review: high-risk customers should be reviewed more frequently (e.g., annually), low-risk less frequently (e.g., every 3 years).

Record monitoring alerts, investigations, and outcomes; escalate potential suspicious activity to the compliance officer.

Ongoing CDD includes screening against sanctions and PEP lists on an ongoing basis.

If ongoing CDD cannot be completed, consider terminating the relationship and filing a SAR.

SAR must be filed with the Financial Intelligence Unit (FIU) within the New Zealand Police as soon as practicable, and no later than 3 working days after forming a suspicion.

Suspicion threshold: 'reasonable grounds to suspect' that a transaction or activity may be related to ML/TF or other serious offence.

Do not tip off the customer or third parties about the SAR; tipping off is a criminal offence.

PTR: report prescribed transactions including cash transactions of NZD 10,000 or more, international wire transfers of NZD 1,000 or more, and certain other transactions.

PTR must be filed within 10 working days of the transaction (or as prescribed).

SAR and PTR are filed electronically via the goAML system.

Reporting entities must have internal procedures for identifying, investigating, and reporting suspicious activity.

Failure to report suspicious activity is an offence with penalties including fines and imprisonment.

Compliance programme must include: AML/CFT policies and procedures, risk assessment, CDD procedures, transaction monitoring, SAR/PTR procedures, record keeping, and staff training.

Compliance officer must be designated, with responsibility for administering and overseeing the compliance programme.

Senior management must approve the compliance programme and ensure adequate resources.

Staff training: regular AML/CFT training for all relevant staff, including induction and ongoing training; keep training records.

Independent audit: reporting entities must have their compliance programme independently audited every 2 years (or as required by supervisor).

Record keeping: keep CDD records, transaction records, SAR/PTR records, and risk assessments for at least 5 years (some records for 7 years).

Records must be in English or readily translatable, and available to supervisors on request.

Compliance programme must be reviewed and updated regularly to reflect changes in legislation and risks.