AML/CFT Guide for Casinos in New Zealand
New Zealand casinos are reporting entities with duties across customer identification, monitoring, source, suspicious activity, prescribed transactions, records and audit. This guide explains scope, sector risks, practical controls, examples and official sources in plain English.
How this guide was researched and reviewedOn this page
Short answer
New Zealand casinos are reporting entities with duties across customer identification, monitoring, source, suspicious activity, prescribed transactions, records and audit.
Scope is based on the listed activity, the ordinary-course test and the New Zealand connection. Check current regulations, exemptions and DIA guidance before relying on a result.
At a glance
Start With These Four Checks
Map the activity
Write down exactly what the business does and match it to section 5.
Know the customer
Identify the customer, beneficial owners, people acting for them and the purpose of the work.
Follow the sector risk
Build controls around how money, property, structures, products and instructions move in this sector.
Keep the evidence
Scope, CDD, risk, monitoring, reports, training and review should be easy to prove.
Plain English
Key Words Explained
These words are used in the law and official guidance. This is what they mean on this page.
- Captured activity
- An activity that brings a person or business within section 5 of the New Zealand AML/CFT Act.
- Reporting entity
- A person or business that must meet AML obligations for the covered service or activity.
- Beneficial owner
- The individual who ultimately owns or controls the customer or on whose behalf the work is done.
- Enhanced CDD
- Extra customer and source checks used when the law or higher risk requires them.
- SAR
- A suspicious activity report submitted to the New Zealand FIU through goAML when reasonable grounds for suspicion exist.
Part 1
When AML/CFT May Apply
Cash, chips, accounts, play and payouts should be seen as one customer journey. The programme should reflect the casino’s products, channels and customer risk.
- Providing casino gambling services covered by the Act.
- Opening or operating relevant customer or player accounts.
- Accepting, exchanging or paying cash, chips, credits or other value.
- Providing online casino activity where the current legal definition applies.
- Carrying out another captured financial or payment activity.
Different products and channels can have different customer, CDD and reporting points. The licence or venue should not be used as a substitute for mapping the actual service.
Part 2
Main Risks in This Sector
These are starting points, not a ready-made risk rating. The business still needs to assess its own customers, services, countries, channels, transactions and technology.
- Cash can be converted into chips or payouts that appear legitimate.
- Minimal play and rapid cash-out can move value without real gambling.
- Third parties, nominees and groups can hide the real customer.
- Online channels add device, identity, payment and country risk.
- VIP relationships can create pressure to weaken source or approval controls.
Part 3
A Practical Control Plan
- Step 1
Confirm scope
Map venue, online, cashier, account, chip and payout activity.
- Step 2
Build the customer process
Identify customer, CDD and reporting points for every product.
- Step 3
Set the risk controls
Join player, payment, device, visit and transaction information.
- Step 4
Train and connect people
Set enhanced controls for high-value, third-party, remote and higher-risk behaviour.
- Step 5
Test and improve
Reconcile SAR, STR, LCT and IFT reports with gaming and cashier data.
Part 4
Worked Examples
These examples show how the scope and risk questions can be joined. They do not replace the law or the facts of a real matter.
| Situation | Why it matters | Practical response |
|---|---|---|
| A patron buys chips with cash, plays little and cashes out. | Cash may be converted into a payout with an apparent casino source. | Review the visit and customer history, source and behaviour and assess reporting. |
| Several online accounts use one device and payment source. | One controller may be operating nominees or a laundering network. | Link the accounts, identify the people and purpose and apply enhanced controls. |
| A VIP’s source explanation conflicts with public information. | The relationship may involve unexplained wealth or proceeds of crime. | Resolve the conflict with reliable evidence and escalate independently of commercial pressure. |
Part 5
Evidence That Should Be Easy to Find
- The section 5, ordinary-course and New Zealand connection analysis.
- The current sector risk assessment and the official sources used.
- A service map across venue, online, cashier, account and payout activity.
- A joined customer view of play, payments, devices and related people.
- Source, approval and monitoring records for higher-risk customers.
- Reconciliation of gaming data and goAML reports.
- Customer, beneficial ownership, risk, monitoring and reporting records.
- Training, internal review, independent assurance and remediation records.
Part 6
Common Mistakes
- Reviewing buy-in, play and payout separately.
- Treating VIP status as a reason for weaker controls.
- Monitoring cash only.
- Failing to link accounts, devices, payments and related patrons.
- Closing alerts without written findings.
Helpful answers
Common Questions
Short answers to the questions businesses ask most often.
Does every business in this sector have AML/CFT duties?
No. The exact activity, ordinary-course facts and New Zealand connection decide the answer. A business may carry out both captured and uncaptured work.
What should the business do first?
Map venue, online, cashier, account, chip and payout activity.
Can the sector risk assessment replace our own?
No. Official national and sector assessments are important sources, but the reporting entity must assess the risks it reasonably expects to face in its own business.
Can a generic AML/CFT template be used?
A template can help with structure, but it must be matched to the business’s scope, risks, people, systems and evidence. A document that is not implemented is not enough.
Does genuine gambling remove suspicion?
No. Genuine play can sit beside suspicious funding, ownership or payout behaviour. The whole relationship should be assessed.
Do casinos follow the ordinary three-year audit cycle?
Casinos are generally subject to the ordinary independent-audit requirements. The current date and any DIA notice should be checked.
Reference
Official Sources
This guide cites the following sources.
- Primary lawNew Zealand LegislationAnti-Money Laundering and Countering Financing of Terrorism Act 2009
The current New Zealand AML/CFT Act, including CDD, programme, reporting, audit and record duties.
- Regulator guidanceDepartment of Internal AffairsFinancial institutions and casinos
Current DIA guidance and resources for land-based and other regulated casino operators.
- Regulator guidanceDepartment of Internal AffairsAML/CFT Programme Guidance 2026
Current guidance on establishing, implementing, maintaining and reviewing an AML/CFT programme.
- Regulator guidanceNew Zealand Police Financial Intelligence UnitNational Risk Assessment
The March 2025 national assessment of New Zealand money laundering and terrorism financing risk.