- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
The AML/CFT Act: what New Zealand firms must do after the 2026 reforms
The AML/CFT Act 2009 sets New Zealand's rules for risk assessment, customer due diligence and reporting. Two Acts passed in 2026 changed who supervises and how, and a third bill is before Parliament.
- The AML/CFT Act 2009 covers accountants, lawyers, conveyancers, real estate agents and trust and company service providers when they carry out specified activities, alongside financial institutions and casinos.
- Since 1 July 2026 the Department of Internal Affairs (DIA) is New Zealand's only AML/CFT supervisor.
- The AML/CFT Amendment Act 2026 came into force on 19 May 2026 and reworked parts of customer due diligence, including the definition of beneficial owner.
- An industry levy is payable from July 2027 by reporting entities in higher-risk sectors, once regulations are made.
- The AML/CFT (Omnibus) Amendment Bill was introduced on 1 September 2026. It is not law, and as drafted it would come into force one year after Royal assent.
What it is
The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (the AML/CFT Act) is New Zealand's anti-money laundering law. Each reporting entity must assess its money laundering and terrorism financing risk, run an AML/CFT programme with a compliance officer, carry out customer due diligence, and have suspicious activity reporting, audit and annual reporting processes. Professional firms joined the regime in 2018 and 2019 (Ministry of Justice).
Two Acts received Royal assent on 18 May 2026. The AML/CFT Amendment Act 2026 came into force on 19 May 2026. It makes targeted changes so that due diligence and record keeping apply in proportion to risk, and it rewrites the definition of beneficial owner. The AML/CFT (Supervisor, Levy, and Other Matters) Amendment Act 2026 came into force on 1 July 2026. It makes DIA the single supervisor in place of the Reserve Bank, the FMA and DIA, and it lets the government set an industry levy.
The last stage is the AML/CFT (Omnibus) Amendment Bill. As introduced, it gives firms more room to decide when simplified or enhanced due diligence fits, adds duties to assess and mitigate UN targeted financial sanctions risk, creates infringement offences for minor breaches and raises maximum penalties. None of it applies yet.
Who it applies to
The Act applies to reporting entities. Professional firms are covered by activity, so a firm can be in scope for some work and outside it for other work. DIA lists these sectors:
- Lawyers and conveyancers
- Accountants
- Real estate agents
- Trust and company service providers
- Financial institutions and casinos
- High value dealers, virtual asset service providers and online marketplaces
The 2026 Amendment Act rewrote the trust and company service provider definition so it excludes law firms, conveyancing practitioners, accounting practices and real estate agents, which are covered in their own right.
What you have to do
The core duties sit in the Act, with DIA codes of practice and guidelines filling in detail. Each duty below is matched to the kind of work that meets it. Your programme sets the specifics.
- Assess your risk
Assess the money laundering and terrorism financing risk your business faces (s 58). The assessment drives every other control, including when you apply simplified or enhanced due diligence.
- Keep a programme and a compliance officer
Maintain a written AML/CFT programme and appoint a compliance officer to run it (s 56).
Set up once, then kept current - Verify identity
Identify and verify customers, beneficial owners and anyone acting for them when standard due diligence applies (s 14). Since 19 May 2026 a beneficial owner is the individual with effective control of the customer, or who owns a prescribed threshold of it.
- Collect ownership and structure details
For companies and trusts, record each person and entity on the structure so you can show who has ultimate ownership or control. Enhanced due diligence applies in the higher-risk cases the Act sets out (s 22).
- Check for PEPs and sanctions
Take reasonable steps to find out whether a customer or beneficial owner is a politically exposed person (s 26). The Omnibus Bill would add duties to assess and mitigate UN targeted financial sanctions risk.
- Keep due diligence current
Ongoing customer due diligence means keeping information up to date and watching for changes in a client's risk, including a new PEP or sanctions match.
- Report and get audited
Report suspicious activity to the Police Financial Intelligence Unit, file your annual report with DIA, and have your risk assessment and programme audited as the Act requires.
Procedural, your own process
What firms get wrong
Most errors come from the 2026 changes landing in pieces with different dates.
From 1 July 2026 DIA supervises every reporting entity, including those the Reserve Bank and the FMA used to supervise. Guidance and enforcement now come from DIA.
It is still a bill. Its commencement clause says it comes into force on the first anniversary of Royal assent. Until then the Act as amended on 19 May 2026 applies.
If you match a selfie to an ID photo, the Biometric Processing Privacy Code 2025 also applies. Under rule 1 you may collect biometric information only where the purpose is lawful, the collection is necessary, safeguards are in place and the processing is proportionate. Processing that predates the Code had to comply by 3 August 2026 (Privacy Commissioner).
The levy is payable from July 2027 and needs regulations. Cabinet agreed in June 2026 that three groups in higher-risk sectors pay: banks and deposit takers (85.25% of costs), the gambling sector (9.25%), and non-bank financial institutions and DNFBPs (5.5%) (Ministry of Justice).
What happens when
- In force
Lawyers, conveyancers and trust and company service providers come under the Act Source
- In force
Accountants come under the Act Source
- In force
Real estate agents come under the Act Source
- In force
Biometric Processing Privacy Code 2025 comes into force Source
- In force
Royal assent to the AML/CFT Amendment Act 2026 and the Supervisor, Levy, and Other Matters Amendment Act 2026 Source
- In force
AML/CFT Amendment Act 2026 in force Source
- In force
DIA becomes the sole AML/CFT supervisor Source
- In force
Transition ends for biometric processing that began before the Code Source
- Proposed
AML/CFT (Omnibus) Amendment Bill introduced to Parliament Source
- July 2027 (day not set)Commencing
AML/CFT levy becomes payable, subject to regulations Source
- Not yet setProposed
Omnibus Bill commences, one year after Royal assent if passed Source
Not yet confirmed. We will update this when the date is set.
Related guides
Questions people ask
What is the AML/CFT Act?
The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 is New Zealand's anti-money laundering law. It requires reporting entities to assess risk, run a programme with a compliance officer, carry out customer due diligence, report suspicious activity and file annual reports.
Who is the AML/CFT supervisor in New Zealand now?
The Department of Internal Affairs. Since 1 July 2026 it supervises every reporting entity under the Act, replacing the earlier model in which the Reserve Bank, the FMA and DIA each supervised different sectors.
Does the AML/CFT Act apply to accountants and real estate agents?
Yes, for the activities the Act describes. Accountants have been covered since 1 October 2018 and real estate agents since 1 January 2019. Lawyers and conveyancers have been covered since 1 July 2018.
What is the AML/CFT levy and who pays it?
It is a charge to part-fund the AML/CFT system, payable from July 2027 once regulations are made. Cabinet agreed that banks and deposit takers, the gambling sector, and non-bank financial institutions and DNFBPs in higher-risk sectors will pay it.
When will the Omnibus Amendment Bill take effect?
No date is set. The bill was introduced on 1 September 2026 and its commencement clause says it comes into force one year after Royal assent. Commentary expects select committee in 2027.
Can we verify identity with a selfie and an ID photo?
Verify within DIA's codes of practice and your programme. If you use face matching, the Biometric Processing Privacy Code 2025 also applies, so document why it is necessary and proportionate. See biometric identity verification.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- Department of Internal Affairs, AML/CFT homepage (DIA sole supervisor; reporting entity sectors)
- Department of Internal Affairs, AML/CFT legislation (Act obligations)
- NZ Legislation, Anti-Money Laundering and Countering Financing of Terrorism Amendment Act 2026 (2026 No 16)
- NZ Legislation, AML/CFT (Supervisor, Levy, and Other Matters) Amendment Act 2026 (2026 No 17)
- NZ Legislation, AML/CFT (Omnibus) Amendment Bill, Government Bill 342-1
- Ministry of Justice, Legislative changes to the AML/CFT Act
- Ministry of Justice, National AML/CFT Strategy 2026-30 (levy)
- Ministry of Justice, AML/CFT Tranche 2 consultation (sector start dates)
- Office of the Privacy Commissioner, Biometric Processing Privacy Code
- Office of the Privacy Commissioner, Biometrics rule 1 guidance
- MinterEllison, AML/CFT overhaul: final Amendment Bill introduced (secondary, expected timeline)
Where StackGo fits
StackGo is compliance middleware. IdentityCheck can carry the identity, screening, intake and risk assessment steps in your AML/CFT programme. It does not replace your programme, your compliance officer or your own judgement, and the Act does not require any particular product.
- Biometric identity verification: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories.
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients.
- Intake forms, including multi-entity forms that collect each person and entity on a company or trust structure.
- Risk assessment forms with scoring and enhanced due diligence steps that you configure to your programme.
- Two-way integrations with Xero Practice Manager, Xero, Karbon and HubSpot. By default the connected system receives a link to the result plus the outcome and status, with no personal details written back.
- It does not file suspicious activity reports or annual reports. Those go to the FIU and DIA through your own process.
- It does not write your Biometric Processing Privacy Code proportionality assessment or privacy notices. Those decisions sit with you as the agency collecting the information.
- Government document verification (DVS) and credit bureau beneficial ownership reports are Australian add-ons only and are not offered for New Zealand clients.
- No transaction monitoring and no legal advice.
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.