AML/CFT Guide for Financial Institutions and Lenders in New Zealand
New Zealand financial institutions and lenders are reporting entities when they carry on one or more financial activities described in section 5 in the ordinary course of business. This guide explains scope, sector risks, practical controls, examples and official sources in plain English.
How this guide was researched and reviewedOn this page
Short answer
New Zealand financial institutions and lenders are reporting entities when they carry on one or more financial activities described in section 5 in the ordinary course of business.
Scope is based on the listed activity, the ordinary-course test and the New Zealand connection. Check current regulations, exemptions and DIA guidance before relying on a result.
At a glance
Start With These Four Checks
Map the activity
Write down exactly what the business does and match it to section 5.
Know the customer
Identify the customer, beneficial owners, people acting for them and the purpose of the work.
Follow the sector risk
Build controls around how money, property, structures, products and instructions move in this sector.
Keep the evidence
Scope, CDD, risk, monitoring, reports, training and review should be easy to prove.
Plain English
Key Words Explained
These words are used in the law and official guidance. This is what they mean on this page.
- Captured activity
- An activity that brings a person or business within section 5 of the New Zealand AML/CFT Act.
- Reporting entity
- A person or business that must meet AML obligations for the covered service or activity.
- Beneficial owner
- The individual who ultimately owns or controls the customer or on whose behalf the work is done.
- Enhanced CDD
- Extra customer and source checks used when the law or higher risk requires them.
- SAR
- A suspicious activity report submitted to the New Zealand FIU through goAML when reasonable grounds for suspicion exist.
Part 1
When AML/CFT May Apply
Accounts, lending, payments, custody, investment and other financial activities should be mapped across products, legal entities and outsourced providers.
- Accepting deposits or other repayable funds.
- Lending, financing or providing relevant credit.
- Transferring money or value and providing payment services.
- Issuing or managing means of payment.
- Safekeeping, custody, investment or dealing activities listed in the Act.
- Other captured financial activities carried out in the ordinary course of business.
A licence or broad financial-services label does not replace the section 5 analysis. The exact role, product, customer and flow of value should be mapped.
Part 2
Main Risks in This Sector
These are starting points, not a ready-made risk rating. The business still needs to assess its own customers, services, countries, channels, transactions and technology.
- Accounts and payments can move criminal proceeds quickly and at scale.
- Identity fraud, mule accounts and stolen companies can defeat onboarding.
- Layered ownership and intermediaries can hide beneficial owners.
- Cross-border flows can involve sanctions, high-risk countries or weak transparency.
- Large alert volumes, models and outsourcing can create unseen backlogs or data gaps.
Part 3
A Practical Control Plan
- Step 1
Confirm scope
Build an activity inventory for every product, channel and legal entity.
- Step 2
Build the customer process
Connect customer risk, CDD, sanctions, fraud and transaction information.
- Step 3
Set the risk controls
Set risk-based onboarding, ongoing review, alert and enhanced CDD rules.
- Step 4
Train and connect people
Measure data quality, backlogs, overrides, false positives and missed cases.
- Step 5
Test and improve
Test full customer journeys and reconcile goAML reporting with source data.
Part 4
Worked Examples
These examples show how the scope and risk questions can be joined. They do not replace the law or the facts of a real matter.
| Situation | Why it matters | Practical response |
|---|---|---|
| A new business account receives many unrelated deposits and sends funds overseas. | The account may be a mule or layering vehicle that does not match its purpose. | Review ownership, source, customers and counterparties and assess enhanced CDD and a SAR. |
| A lender receives a large early repayment from an unrelated party. | The loan may be used to integrate or redirect criminal funds. | Identify the payer and relationship, examine source and purpose and update risk. |
| A monitoring system has a growing unresolved backlog. | Suspicious activity may not be assessed or reported within three working days after suspicion is formed. | Prioritise by risk, add resources, tune with evidence and assess whether reports were missed. |
Part 5
Evidence That Should Be Easy to Find
- The section 5, ordinary-course and New Zealand connection analysis.
- The current sector risk assessment and the official sources used.
- A section 5 activity inventory and responsibility map.
- Data lineage for CDD, screening, monitoring and reporting.
- Customer-risk, alert, case and SAR quality measures.
- Independent testing of models, manual controls and outsourced work.
- Customer, beneficial ownership, risk, monitoring and reporting records.
- Training, internal review, independent assurance and remediation records.
Part 6
Common Mistakes
- Using the licence category as the scope decision.
- Separating fraud information from AML/CFT review.
- Relying on automated controls without checking data quality.
- Refreshing files by calendar only and missing material changes.
- Measuring case closure speed without testing decision quality.
Helpful answers
Common Questions
Short answers to the questions businesses ask most often.
Does every business in this sector have AML/CFT duties?
No. The exact activity, ordinary-course facts and New Zealand connection decide the answer. A business may carry out both captured and uncaptured work.
What should the business do first?
Build an activity inventory for every product, channel and legal entity.
Can the sector risk assessment replace our own?
No. Official national and sector assessments are important sources, but the reporting entity must assess the risks it reasonably expects to face in its own business.
Can a generic AML/CFT template be used?
A template can help with structure, but it must be matched to the business’s scope, risks, people, systems and evidence. A document that is not implemented is not enough.
Does every financial product create AML/CFT duties?
Not automatically. Each activity should be checked against section 5, the ordinary-course test and any current exemption or regulation.
Can monitoring be outsourced?
Tasks can be outsourced, but the reporting entity keeps responsibility and needs sufficient data, oversight, escalation and evidence.
Reference
Official Sources
This guide cites the following sources.
- Primary lawNew Zealand LegislationAnti-Money Laundering and Countering Financing of Terrorism Act 2009
The current New Zealand AML/CFT Act, including CDD, programme, reporting, audit and record duties.
- Regulator guidanceDepartment of Internal AffairsFinancial institutions and casinos
Current DIA guidance and resources for banks, lenders, payment providers and other financial institutions.
- Regulator guidanceDepartment of Internal AffairsAML/CFT Programme Guidance 2026
Current guidance on establishing, implementing, maintaining and reviewing an AML/CFT programme.
- Regulator guidanceNew Zealand Police Financial Intelligence UnitNational Risk Assessment
The March 2025 national assessment of New Zealand money laundering and terrorism financing risk.