NZ AML/CFT Compliance Officer common mistakes
NZ AML/CFT Compliance Officer · Understand the traps and how to avoid them.
Treating the AML/CFT Act 2009 as if it were the Financial Advisers Act or the FMCA, and citing 'the FMA' as the sole supervisor for every reporting entity.
Candidates learn 'AML in NZ = FMA' from financial-services study and never map the three supervisors (RBNZ, FMA, DIA) to entity types, nor note that the Act sits alongside the Privacy Act and the Financial Transactions Reporting Act 1996.
What to do instead
Build a one-page matrix: reporting entity type → supervisor (banks/NBDTs/insurers = RBNZ; fund managers, brokers, financial advisers, derivatives issuers = FMA; casinos, TAB, real estate, high-value dealers, lawyers/accountants/POSPs = DIA). Memorise the definition of 'reporting entity' in s5 and the fact that the Act is administered by the Ministry of Justice.
Answering 'AML/CFT supervisor' when asked who issues the AML/CFT Programme Rules or who can impose civil penalties, and confusing the supervisor with the Ministry of Justice's AML/CFT Group.
The Act splits functions across supervisors, the Commissioner of Police (FIU), and the Ministry; candidates assume one body does everything.
What to do instead
Learn the division: supervisors = monitoring, inspection, enforcement, and issuing sector risk assessments/guidelines; Police FIU = receiving STRs/PTRs and cross-border reports; Ministry of Justice = policy and national risk assessment. Civil liability for breaches of the Act attaches to the reporting entity, enforced by its supervisor.
Writing a risk assessment that lists generic risks ('money laundering is a global problem') without assigning likelihood and consequence ratings per customer/product/channel/geography, and without a documented methodology.
Candidates memorise the four risk factors but never practise producing a scored, evidence-based assessment with an explicit methodology and residual-risk conclusion.
What to do instead
Practise producing a short risk assessment with: methodology, inherent risk scored on likelihood × consequence, controls mapped to each risk, residual risk, and a sign-off. Remember s58 requires the assessment to be in writing and reviewed when circumstances change.
Applying enhanced CDD to every customer 'to be safe' or applying simplified CDD to all low-risk customers without checking the s18/s22 conditions and without supervisor approval where required.
Candidates conflate 'risk-based' with 'more is better' and forget that simplified CDD is a permissive exception with conditions, not a default for low-risk customers.
What to do instead
State the rule precisely: standard CDD under s11–17; simplified CDD only where the entity has assessed the customer as low risk and the supervisor has been notified/approved as the Act requires; enhanced CDD under s22 for high-risk, PEPs, and correspondent relationships. Always cite the section and the condition.
Performing CDD but failing to identify and verify the beneficial owner when the customer is a company or trust, or stopping at the immediate shareholder without tracing through to the natural persons who ultimately own or control.
Candidates stop at 'director/shareholder' because that is what the Companies Office shows, and they misread the 25% threshold as applying to the immediate holding company rather than ultimate beneficial ownership.
What to do instead
Apply the s5 definition: identify the natural person(s) who ultimately own or control the customer, directly or indirectly, including through chains of companies and trusts; the 25% ownership/control threshold applies at the ultimate level; if no beneficial owner can be identified, identify the senior managing official. Document the ownership chain.
Treating a PEP as a one-off check at onboarding only, and not recognising that a domestic PEP or an international organisation PEP also triggers enhanced CDD, senior management approval, and source-of-funds/source-of-wealth analysis.
Candidates only recall 'foreign PEP' from FATF headlines and miss that NZ's definition in s5 covers domestic and international organisation PEPs, and that PEP status can change.
What to do instead
Memorise the s5 PEP definition (foreign, domestic, international organisation) and the s22 enhanced measures: senior management approval, source of funds and source of wealth, enhanced ongoing monitoring. Note that family members and close associates are also caught.
Relying on a single identity document (e.g. a driver licence) as both identification and verification without electronic verification or a second source, and not recording the verification method and date.
Candidates treat 'sight the ID' as sufficient and forget that s11–17 require identification (name, DOB, address) and verification of identity through reliable, independent sources, with records kept.
What to do instead
Use a two-source approach: primary identity document plus electronic verification or a second independent document; record the document type, number, expiry, verification method, date, and who performed it. Note the Act's record-keeping obligations under s51 and the 5-year retention rule.
Setting up transaction monitoring with fixed dollar thresholds only (e.g. every transaction over $10,000) and no behavioural or typology-based rules, and never tuning or documenting the rule set.
Candidates confuse the PTR $10,000 cash threshold with a monitoring programme and assume monitoring is just a threshold alert.
What to do instead
Design monitoring as a documented programme: risk-based rules and scenarios (structuring, rapid movement, unusual geography, profile deviation), alert triage, investigation, escalation to STR, and periodic tuning with records of rationale. Distinguish this from PTRs, which are a reporting obligation, not a monitoring control.
Confusing STRs with PTRs: filing a PTR for every cash transaction over $10,000 but failing to file an STR for suspicious activity below the threshold, or filing an STR when a PTR was required.
Candidates blur the two reporting streams and forget that STRs are suspicion-based with no threshold, while PTRs are threshold-based (cash ≥ $10,000, international wire transfers ≥ $1,000) and are due within 10 working days of the transaction.
What to do instead
Learn the three report types: STR (suspicion, no threshold, file as soon as practicable), PTR (cash ≥ $10,000, international wire ≥ $1,000, within 10 working days), and cross-border cash report (≥ $10,000). Note that STRs go to the Commissioner of Police (FIU) and that tipping off is an offence under s46.
Describing the AML/CFT programme as 'a policy document' without the s56–57 elements: senior manager accountability, risk assessment linkage, CDD and monitoring procedures, record keeping, and independent audit/review.
Candidates write a generic compliance-manual answer and omit the statutory programme requirements and the designated senior manager's role.
What to do instead
Structure the answer around s56–57: the programme must be in writing, based on the risk assessment, include CDD, monitoring, and record-keeping procedures, and be reviewed and audited. Name the designated senior manager (s56) as accountable and note the supervisor's power to require an independent audit.