The NZ AML/CFT Regulatory Framework and Core Obligations
Who does what
The regime sits under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (the Act), supported by regulations and by supervisor-issued guidelines. Three supervisors divide the market: the Reserve Bank of New Zealand (banks, non-bank deposit takers, life insurers, NZ-registered branches of foreign banks), the Financial Markets Authority (financial advisers, brokers, fund managers, derivatives issuers, trustee companies), and the Department of Internal Affairs (casinos, remittance and money-changing, trust and company service providers, and other non-financial businesses). The Financial Intelligence Unit inside Police receives reporting; it is not a supervisor. The AML/CFT (Definitions) Regulations and the Identity Verification Code of Practice fill in detail.
The reporting entities' core duties
A reporting entity must: appoint a compliance officer; conduct and periodically renew a risk assessment; maintain a written AML/CFT programme; perform customer due diligence (CDD); conduct ongoing CDD and transaction monitoring; and submit suspicious activity reports (SARs) and prescribed transaction reports (PTRs). The Act is risk-based: you apply measures proportionate to assessed risk, not a rigid checklist.
Traps to watch
- Confusing the FIU (receives reports) with supervisors (inspect and enforce).
- Assuming the Act covers all businesses - coverage is by activity, not by size.
- Treating the risk assessment and the programme as the same document; the assessment informs the programme but is separate.
- Forgetting that supervisors can impose civil penalties and that the Act has criminal offences for serious breaches.
Rule of thumb
“Assess, programme, identify, monitor, report.” If a question describes a duty, slot it into one of those five verbs - that usually reveals whether the answer is about risk assessment, the programme, CDD, monitoring, or reporting.