New Zealand AML/CFT Compliance Checklist

Part 2

How to Use This Checklist

Start with the legal scope. A business may have no AML/CFT duties for one service but be covered for another.

Ask for evidence for each tick. The programme should describe the process, and the customer or system records should show that the process is followed.

1. Step 1

   Mark what is complete

   Tick an item only when it is in use and the record can be found.

2. Step 2

   Record each gap

   Name what is missing, who will fix it and the date by which it will be fixed.

3. Step 3

   Deal with higher risk first

   Missed CDD, missed reports and weak controls over higher-risk customers should be dealt with first.

Part 3

Evidence That Should Be Easy to Find

A clear evidence set makes oversight, a DIA request and an independent audit easier to manage.

• The current risk assessment, programme and version history.
• The compliance officer appointment and senior manager reporting records.
• A scope note for each captured activity.
• Customer files, beneficial ownership checks and customer risk ratings.
• Ongoing CDD, account monitoring and written findings.
• SAR and prescribed transaction escalation and filing records.
• Staff vetting, training and attendance records.
• Annual reports, audit reports and action logs.

Part 4

Key Timing Rules

A calendar should be kept because several duties run on different dates.

1. Step 1

   Before CDD and the programme

   The written risk assessment must be completed first. The programme must then be based on it.

2. Step 2

   Before new technology or a new product is used

   The risk assessment must be reviewed and updated for the new risk before the change is used.

3. Step 3

   Each year

   An annual AML/CFT report must be prepared and filed when required by DIA.

4. Step 4

   Usually every three years

   The risk assessment and programme must be independently audited. A four-year period can apply if DIA gives notice, and DIA can ask for another time.

5. Step 5

   For at least five years

   Risk assessment, programme and audit records must be kept for at least five years after they stop being used on a regular basis. Other record periods also apply.

Part 5

Common Mistakes

• A programme is copied from another business and does not match the risk assessment.
• The latest National Risk Assessment or Sector Risk Assessment is not considered.
• A customer risk rating is saved without reasons.
• CDD is done at onboarding but ongoing CDD and account monitoring are missed.
• A strange transaction is noted but no written finding is kept.
• The annual report is prepared from memory because data was not collected during the year.
• New software or a new service starts before the risk assessment is updated.
• The audit date is measured from the wrong starting point.