AML/CFT and identity verification
What this domain tests
AML/CFT is a supervisor favourite: risk assessment, customer due diligence, beneficial ownership, PEPs, reporting, and records.
The AML/CFT framework
The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 requires reporting entities to have a risk assessment, an AML/CFT programme, a designated compliance officer, and training. The FMA supervises many financial institutions. Customer due diligence means verifying identity and address, identifying beneficial owners, screening against sanctions and PEP lists, and understanding source of funds and wealth and the nature of the relationship.
Standard CDD applies to ordinary clients; enhanced CDD applies to higher-risk cases such as foreign PEPs, complex structures, and high-risk jurisdictions. Simplified CDD is limited and must still be risk-based. Ongoing CDD and transaction monitoring are required. Suspicious activity reports go to the Financial Intelligence Unit at New Zealand Police, and tipping off is prohibited. Records must be kept for at least five years after the relationship ends or the transaction.
Worked example
A company client has a 30% shareholder who is a foreign PEP. The dealer must identify the beneficial owner at the 25% ownership or control threshold, conduct enhanced CDD, obtain senior management approval, and scrutinise source of wealth. A copy of the passport alone is not enough.
Traps
Treating a passport copy as verification without checking authenticity. Missing beneficial owners through layered trusts. Filing a suspicious activity report but continuing the relationship without a risk assessment. Relying on the client's assurance about source of funds.