Two key AML/CFT developments for reporting entities

The AML/CFT Amendment Bill

The Bill is the latest, and in several respects the most far-reaching, instalment in the Government's reform programme. Associate Justice Minister Nicole McKee says the Bill “represents the most substantial reform of the AML/CFT Act since it was passed in 2009”.

Key changes include:

Customer due diligence flexibility

The Bill introduces a new risk-based discretion allowing reporting entities to apply simplified customer due diligence (CDD) where they have reasonably assessed the circumstances as low risk. This complements, rather than replaces, the existing prescribed simplified CDD categories.

Enhanced CDD (EDD) requirements will be restructured. Reporting entities must:

• obtain information necessary to mitigate identified risks
• verify that information according to the assessed risk level, and 
• complete EDD for customers in Financial Action Task Force ”black-list” jurisdictions. 

EDD requirements for trusts used to hold personal assets are being relaxed in many circumstances.

A reporting entity will not be required to conduct or complete EDD where it has determined that it must file a SAR and has reasonable grounds to suspect that continuing the EDD process would alert the person that the activity has been determined to be a suspicious activity.

Financial sanctions integration

The Bill integrates financial sanctions obligations into the AML/CFT framework. Reporting entities will need to assess and mitigate relevant sanctions risks in their risk assessments and AML/CFT programmes. 

Strengthened FIU powers

The Bill empowers the FIU to gather information from non-reporting entities (with or without a court order), secure ongoing production orders for financial records from reporting entities, and seek temporary freezing orders on high-risk accounts and transactions.

The investigative and intelligence branches of the New Zealand Police will gain direct access to SARs and prescribed transaction reports, and the New Zealand Security Intelligence Service and the Government Communications Security Bureau are able to receive disclosed information for law enforcement and intelligence purposes.

Mandatory and voluntary reporting groups

The Bill replaces the designated business group regime with a mandatory and voluntary reporting group framework.

Mandatory reporting groups are groups of related persons where each member is a New Zealand reporting entity or resident in any other country and that is supervised or regulated for AML/CFT purposes. They must assign a lead entity and establish a group AML/CFT programme. The Bill limits voluntary reporting groups to specific sector types (law firms, conveyancers, accountants, TCSPs, real estate agents, high-value dealers, and entities prescribed by regulations).

This new framework aims to ensure consistent and aligned compliance throughout related entities, reducing inconsistencies that criminals may exploit.

Virtual assets and cash restrictions

The Bill will restrict: 

• buying or selling virtual assets (such as tokens and cryptocurrency) via cash transactions above applicable thresholds; and
• money or value transfer services from accepting cash transactions above thresholds for international transfers. 

These provisions close gaps exploited by organised crime. The Associate Justice Minister confirmed that consultation on regulations for cash payments in remittance services and virtual assets will commence in early 2027, following the General Election.

Audits replaced by independent evaluations

References to “audits” throughout the AML/CFT Act will be replaced with “independent evaluations”, reflecting a modernised approach to compliance assessment.

New offences

The Bill introduces new offences, including structuring a legal person or legal arrangement to avoid AML/CFT requirements, and obstructing or providing false information to the Commissioner.

Changes to civil liability, increased penalties and enforcement tools

Civil liability threshold

The Bill introduces a qualitative compliance test, amending the definition of a "civil liability act" in section 78 from "fails to comply" to "fails to adequately comply" with any AML/CFT requirements. Reporting entities may face enforcement action, for example, even if they have an AML/CFT programme, conduct CDD, and file SARs, if the DIA considers efforts inadequate in the circumstances.

Increased penalties

• For civil liability acts, maximum pecuniary penalties will increase to $500,000 for individuals and the greater of $5,000,000 or three times the commercial gain (or 10% of turnover if gain cannot be ascertained) for corporates
• Money laundering offence maximum prison sentences under the Crimes Act 1961 will be doubled (from 7 to 14 years and 5 to 10 years respectively). Prosecution limitation periods extend from 3 to 5 years; and 
• A new infringement offence regime is introduced for minor non-compliance (such as failing to designate a compliance officer or file an annual report), with infringement fees up to $20,000.

Enforcement implications

The introduction of a qualitative compliance standard, combined with significantly increased penalties, extended limitation periods, and other new enforcement powers signals a major shift in DIA’s enforcement approach (DIA having become New Zealand's sole AML/CFT supervisor from 1 July 2026). Going forward, the quality of compliance, not just its existence, will be a key focus for reporting entities.

This shift emphasises the importance of robust risk assessments and record-keeping practices. A critical unanswered question is how the DIA will apply proportionality when imposing penalties. For example, will “adequate compliance” differ between a major bank and a small non-bank deposit taker? 

Timeframe and Commencement

The operative date of the Bill will depend on the pace of Parliamentary progress which, given the impending General Election, we expect will be for the next elected Government to determine. However, as the Bill will come into force one year after it receives Royal assent, it is unlikely to commence before 2028. 

Class Exemptions Amendment Notice 2026

The Class Exemption Amendment Notice amends the Anti-Money Laundering and Countering Financing of Terrorism (Class Exemptions) Notice 2018, and comes into force on 31 December 2026.

Renewed exemptions

The following class exemptions have been renewed:

• Parts 1, 4, 10 and 15 (bodies corporate and body corporate managers, PAYE intermediaries, specified securities investment schemes, and barristers sole) have been renewed until 30 December 2028; and
• Parts 2, 3, 7, 8, 9 and 12 (Public Trust, Māori Trustee and trustee companies, retirement schemes, shared compliance officer for designated business groups, financial advice providers for retirement schemes, specified employee security purchase schemes, and statutory supervisors of retirement villages) have been renewed until 30 December 2031.

These exemptions remain substantially identical to existing versions, except for minor wording changes.

Exemptions expiring

The following exemptions will expire on 31 December 2026 and have not been renewed:

• reporting entities whose customers are licensed managing intermediaries (Part 5)
• reporting entities whose customers are specified managing intermediaries (Part 6)
• casino loyalty schemes (Part 11)
• designated issuers that issue debt securities to specified subscribers through intermediaries (Part 13), and
• transactions of tax pooling intermediaries (Part 14).

Of particular significance is the expiry of the Part 5 and Part 6 intermediary exemptions. These exemptions are commonly relied upon in the financial services sector to reduce duplication of AML/CFT obligations where multiple reporting entities are involved in providing a product or service to the same underlying customer.

The recent change to the definition of “beneficial owner” in the AML/CFT Act (effective 19 May 2026) which clarifies when reporting entities must undertake CDD on a “customer of a customer” largely removes the need for these exemptions in many cases. However, the Department of Internal Affairs (DIA) will provide a one-year good faith period to 31 December 2027 to allow affected entities to undertake internal policy work and consult with the DIA on the implications of these expiries. 

Next steps

Reporting entities should:

• familiarise themselves with the Amendment Bill, and track its progress through Parliamentary stages
• consider making submissions at the Select Committee stage
• consider their reliance on any class exemptions and be aware of relevant changes
• if relying on Parts 5 or 6 intermediary exemptions, begin planning now for any required changes to AML compliance processes and contractual arrangements with intermediaries. Engage with the DIA during the good faith transition period if affected
• consider how the new mandatory and voluntary reporting group frameworks will apply to their corporate structures when the Bill comes into force
• be ready to update AML/CFT risk assessments and compliance programmes to reflect the Bill’s new CDD flexibility and sanctions integration, and
• for virtual asset and cash transaction sectors, assess the impact of the new restrictions.