New Zealand's anti-money laundering regime runs on about thirty pieces of jargon, and most of the guidance defines each one using the other twenty-nine. This page is the plain version. Where a term has a legal definition, it's quoted from the AML/CFT Act 2009 or its regulations, followed by what it actually means when you're the one who has to comply.
Terms are grouped by what you'd be doing when you meet them, rather than alphabetically — the alphabet isn't much help when you don't yet know the word you're looking for.
Am I even covered?
Reporting entity
The Act's term for a business that has AML/CFT obligations. Statutory definition:
"reporting entity— (a) means— (i) a casino: (ia) an online casino operator: (ii) a designated non-financial business or profession: (iii) a financial institution: (iv) a high-value dealer: (v) TAB NZ"
In practice: if you're a law firm, accounting practice, conveyancer, real estate agency or trust and company service provider, you're asking whether you fall inside "designated non-financial business or profession" — the next entry. Being a reporting entity is what triggers everything else: risk assessment, programme, customer checks, annual report.
Designated non-financial business or profession (DNFBP)
The category that captures professional firms. Statutory definition:
"designated non-financial business or profession means— (a) a law firm, a conveyancing practitioner, an incorporated conveyancing firm, an accounting practice, a real estate agent, or a trust and company service provider, who, in the ordinary course of business, carries out 1 or more of the following activities: (i) acting as a formation agent of legal persons or legal arrangements: (ii) acting as, or arranging for a person to act as, a nominee director or nominee shareholder or trustee in relation to legal persons…"
In practice: note the words "who, in the ordinary course of business, carries out one or more of the following activities". Your professional title alone doesn't capture you — the activity does. A litigation-only practice generally sits outside; a firm doing conveyancing or setting up trusts and companies generally sits inside. This is the single most misunderstood definition in the Act.
Trust and company service provider (TCSP)
"trust and company service provider— (a) means a person (other than a law firm, a conveyancing practitioner, an incorporated conveyancing firm, an accounting practice, or a real estate agent) who carries out any of the activities described in paragraphs (a)(i) to (vi) of the definition of designated non-financial business or profession"
In practice: the catch-all for people doing company and trust work who aren't already a lawyer, accountant or agent. If you are one of those, you're captured under your own heading, not this one.
High-value dealer
"high-value dealer— (a) means a person who is in trade and in the ordinary course of business, buys or sells all or any of the following articles by way of a cash transaction or a series of related cash transactions, if the total value… is equal to or above the applicable threshold value: (i) jewellery: (ii) watches: (iii) gold, silver, or other precious metals: (iv) diamonds, sapphires, or other precious stones: (v) paintings…"
In practice: jewellers, dealers in precious metals and art, and similar — but only where they take cash at or above the threshold. Take no cash and this doesn't reach you.
AML/CFT supervisor
"AML/CFT supervisor means the public service agency that… is for the time being responsible for supervising reporting entities under this Act"
In practice: since 1 July 2026 the Department of Internal Affairs (DIA) supervises every reporting entity. The old three-supervisor split is gone.
Who's my customer, and what do I check?
Customer
"customer, in relation to a reporting entity, means a person who was in a business relationship with the reporting entity immediately before any provisions of this Act began to apply"
In practice: for a real estate agency this is the vendor or landlord — the person who signs the agency agreement — not the buyer or tenant. Firms routinely check the wrong party.
Business relationship
"business relationship means a business, professional, or commercial relationship between a reporting entity and a customer that has an element of duration or that is expected by the reporting entity, at the time when contact is established, to have an element of duration"
In practice: an ongoing client, as opposed to a one-off. The "element of duration" is what separates it from an occasional transaction.
Occasional transaction
"occasional transaction— (a) means a cash transaction that occurs outside of a business relationship and is equal to or above the applicable threshold value (whether the transaction is carried out in a single operation or several operations that appear to be linked)"
In practice: a one-off over the threshold. Note "several operations that appear to be linked" — splitting a payment doesn't avoid it, and deliberate splitting is itself a red flag.
Customer due diligence (CDD)
Not defined in one place — it's the process set out across ss.14–31. Three levels:
- Standard CDD — identify the customer, any beneficial owner, and anyone acting on their behalf, and verify that identity.
- Simplified CDD — a reduced version, available only for specific low-risk customer types the Act lists.
- Enhanced CDD — the fuller version, including establishing source of funds or wealth. Required for higher-risk situations: politically exposed persons, trusts and asset-holding vehicles, and wherever your own risk assessment says the risk warrants it.
In practice: "have you done your CDD" means "did you check who this person really is, record how you checked, and decide how risky they are".
Beneficial owner
"beneficial owner— (a) means the individual who— (i) has effective control of a customer or person on whose behalf a transaction is conducted; or (ii) owns a prescribed threshold of the customer… and (b) includes an individual— (i) with ultimate ownership or control of the customer, whether directly or indirectly"
In practice: when your client is a company or trust, you can't stop at the entity. You have to get to the real people who own or control it. This is where most firms' files fall short.
Politically exposed person (PEP)
"politically exposed person means— (a) an individual who holds, or has held at any time in the preceding 12 months, in any overseas country the prominent public function of— (i) Head of State or head of a country or government; or (ii) government minister or equivalent senior politician; or (iii) Supreme Court Judge or equivalent senior Judge; or (iv) governor of a central bank…"
In practice: senior overseas officials, plus their immediate family and close associates. A PEP customer always requires enhanced due diligence. Note the definition is directed at overseas positions.
When the checks must be done
This is the question that catches people, because real estate agents follow a different rule from everyone else.
For most reporting entities, s.14(1) sets the triggers: taking on a new customer, an occasional transaction, or a material change in an existing relationship.
But s.14(3) says:
"Despite subsections (1) and (2), a real estate agent must conduct standard customer due diligence at the times… specified in rules made under section 156B."
For real estate agents, reg 16 of the AML/CFT (Requirements and Compliance) Regulations 2011 sets the timing by transaction type:
"(a) in relation to a commercial lease transaction, before the real estate agent presents a lease agreement to the landlord: (b) in relation to an assignment to lease transaction, before… presents an assignment of lease to the assignee: (c) in relation to a sublease transaction, before… presents a sublease agreement to the outgoing tenant: (d) in relation to any other real estate transaction, once there is a fully signed agency agreement and before carrying out any further real estate agency work for the customer."
In practice: on a sale, the trigger is the fully signed agency agreement — early. On a commercial lease, it's much later: before the lease agreement goes to the landlord. Applying the sales rule to a leasing business gets you the wrong answer by months, in the wrong direction.
What do I have to have in place?
Risk assessment
Required by s.58. A written assessment of the money laundering and terrorism financing risks your business faces — your services, customers, delivery channels, and the countries you deal with.
In practice: it comes first, because your programme has to be built on it. Since 19 May 2026 it must also incorporate the relevant risks from DIA's sector risk assessments and the national one — which means a risk assessment written before mid-2026 generally doesn't meet the current requirement as drafted.
AML/CFT programme
"AML/CFT programme means a compliance programme established under section 56(1)"
s.57 requires it to be in writing, based on your risk assessment, and to contain "adequate and effective" procedures across a list of areas: vetting, training, customer due diligence, suspicious activity reporting, record keeping, and more.
In practice: the risk assessment says what could go wrong; the programme says what you do about it. DIA's consistent criticism is generic programmes — a template that doesn't trace back to risks in your own assessment doesn't comply.
AML/CFT compliance officer
"(2) A reporting entity must designate an employee as an AML/CFT compliance officer… (3) In the case of a reporting entity that does not have employees, the reporting entity must appoint an individual… (4) The compliance officer must be a senior manager or report to a senior manager… (5) Despite subsections (2) to (4), if a reporting entity is a partnership, the partnership may designate one of the partners… irrespective of whether the partnership has employees"
In practice: someone must own this by name. In a firm with staff it has to be one of your own employees. If your business has no employees — a one-person company, for instance — DIA's published guidance is explicit that an external person may be appointed: "Only where a reporting entity has no employees can an external person be appointed as a Compliance Officer." A partnership can designate a partner either way.
Designated business group (DBG)
"designated business group means a group of 2 or more persons in which— (a) each member of the group has elected, in writing, to be a member of the group…"
In practice: related entities, or firms sharing premises, can elect to share a risk assessment, programme and some CDD. One member can file on behalf of others. Useful for franchise and multi-entity structures; it does not transfer responsibility away from each entity.
What do I have to report?
Annual AML/CFT report
Filed between 1 July and 31 August each year, covering the year to 30 June, using the prescribed form in Schedule 2A of the Act. DIA states it cannot grant extensions.
In practice: it's a report about your risk assessment and programme — which is why firms without those documents find the form impossible to answer honestly.
Suspicious activity report (SAR)
Required by s.40:
"(1) A reporting entity other than a high-value dealer or law firm must, as soon as practicable but no later than 3 working days after forming its suspicion, report… (2) A law firm must, as soon as practicable, but no later than 5 working days after forming its suspicion, report… (3) Despite subsection (2), a law firm is not required to disclose any information that the law firm believes on reasonable grounds is a privileged communication."
In practice: 3 working days for most firms, 5 for law firms, and legal privilege is preserved. The clock starts when you form the suspicion — not when you get round to it.
Prescribed transaction report (PTR)
"prescribed transaction, in relation to a reporting entity, means a transaction conducted through the reporting entity in respect of— (a) an international wire transfer of a value equal to or above the applicable threshold value; or (b) a domestic physical cash transaction of a value equal to or above the applicable threshold value"
Reported under s.48A, no later than 20 working days after the transaction.
In practice: if you never handle cash and never send money internationally, no prescribed transaction arises — but you still need a written procedure for the day one does.
Tipping off
You must not tell a customer, or anyone else, that you've filed a suspicious activity report or that one is being considered.
In practice: you can decline to act. You cannot explain why in terms that reveal a report.
Systems and admin
goAML
The Police Financial Intelligence Unit's system for filing suspicious activity and prescribed transaction reports. Separate from DIA's portal.
In practice: register before you need it. Registering during an actual suspicion wastes the days you're on the clock for.
AML Online
DIA's portal for annual reports, updating your details and asking questions. Accessed with a RealMe login, by invitation once you're onboarded as a reporting entity.
In practice: check your access works well before 31 August. If an invitation has lapsed, DIA must issue a new one on their timetable.
Independent audit
Your risk assessment and programme must be audited by an independent person, appointed by you, who is appropriately qualified. They don't have to be a chartered accountant.
How often: s.59(2) of the Act says every 2 years — but that figure is displaced by regulation 13, which sets it at every 3 years, or every 4 if your supervisor has notified you that a 4-year period applies. Published material stating "two years" is quoting the Act without the regulation.
In practice: whoever writes your documents cannot audit them. Budget for two separate people, and note the clock runs from your last audit report date.
Sector risk assessment (SRA) and National Risk Assessment (NRA)
DIA publishes sector risk assessments; the Financial Intelligence Unit publishes the national one. Since 19 May 2026, your own risk assessment must incorporate the relevant risks they identify.
In practice: these are updated over time, and each update is a reason to revisit your risk assessment rather than leave it sitting.
Still not sure whether any of this applies to you?
The capture test is about activity, not job title — and getting it wrong in either direction costs something. Firms file reports they never needed to; others discover an obligation that's been running for years.
If you'd like a straight answer, tell us what your firm actually does and we'll tell you whether you're captured. We won't invoice you for a report you don't have to file.
This page quotes legislation as at July 2026 and is general information, not legal advice. Deplexify is a compliance service led by a chartered accountant.