Most mistakes we see with New Zealand's AML/CFT Act aren't caused by people failing to read it. They're caused by people reading it and stopping too early.
The Act is built to a pattern: a general rule, then a carve-out that removes a particular sector from it and sends them somewhere else entirely. The general rule reads as though it applies to everyone. Three lines later, a subsection says it doesn't apply to you. If you never reach that subsection, you'll apply the wrong rule with complete confidence — and the wrong rule is often wrong by months.
This page maps them. Every provision below is quoted from the Act or its regulations.
The tell: "Despite subsection…"
Before applying any section of this Act, look for the phrase "Despite subsection…" nearby. In legislative drafting it means ignore what you just read. It's how every sector carve-out in this Act is signposted.
Searching the whole Act for that phrase gives you the complete list:
| General rule | Who's carved out | Where they go instead | |---|---|---| | s.14(1)–(2) standard CDD triggers | Real estate agents | s.14(3) → reg 16 | | s.18(1)–(3) simplified CDD | Real estate agents | s.18(3A) → reg 16 | | s.22(1)–(5) enhanced CDD | Real estate agents | s.22(6) → reg 16 | | s.56(2)–(4) compliance officer | Partnerships | s.56(5) — may designate a partner | | s.40(2) SAR reporting | Law firms | s.40(3) — privileged communication protected | | Reliance on a DBG member | — | Responsibility stays with the reporting entity | | Reliance on a third party for CDD | — | Responsibility stays with the reporting entity |
All three real estate carve-outs land in the same place. Regulation 16 opens: "For the purpose of sections 14(3), 18(3A), and 22(6) of the Act…" — one regulation covers standard, simplified and enhanced due diligence timing for real estate agents.
Carve-outs also live outside the Act — in the Definitions Regulations (the "Exclusion:" provisions, such as reg 21B for property management), in the separate Exemptions Regulations, and in ministerial exemptions under s.157. Check those too before concluding you're in or out.
When customer due diligence is required
For most reporting entities, s.14 sets the triggers:
(1) A reporting entity must conduct standard customer due diligence in the following circumstances: (a) if the reporting entity establishes a business relationship with a new customer: (b) if a person seeks to conduct an occasional transaction or activity through the reporting entity: (c) if, in relation to an existing customer, and according to the level of risk involved,— (i) there has been a material change in the nature or purpose of the business relationship; and (ii) the reporting entity considers that it has insufficient information about the customer
Then:
(3) Despite subsections (1) and (2), a real estate agent must conduct standard customer due diligence at the times, and with any other modifications, specified in rules made under section 156B.
If you're a law firm, accounting practice, conveyancer or trust and company service provider, s.14(1) is your rule. If you're a real estate agent, none of it applies to you — and this is the single most common place people go wrong, because s.14(1)(a) reads perfectly sensibly and is easy to stop at.
The real estate timing rule
Regulation 16 of the AML/CFT (Requirements and Compliance) Regulations 2011:
(1) For the purpose of sections 14(3), 18(3A), and 22(6) of the Act, a real estate agent must conduct customer due diligence,— (a) in relation to a commercial lease transaction, before the real estate agent presents a lease agreement to the landlord: (b) in relation to an assignment to lease transaction, before the real estate agent presents an assignment of lease to the assignee: (c) in relation to a sublease transaction, before the real estate agent presents a sublease agreement to the outgoing tenant: (d) in relation to any other real estate transaction, once there is a fully signed agency agreement and before carrying out any further real estate agency work for the customer.
(2) Nothing in subclause (1) applies to an agent who is a conjunctional agent.
The trap is applying (d) to a leasing business. On a sale, the trigger is the fully signed agency agreement — early, at the listing. On a commercial lease, it's much later: before the lease agreement goes to the landlord. Those are months apart, and an agency doing commercial leasing that applies the sales rule will believe it's in breach when it isn't.
Why the rule sits where it does: s.37 prohibits carrying out the transaction if due diligence can't be completed. Presenting the agreement is the last moment the agent can still stop. Checking after signing would achieve nothing — the transaction is already done.
Do you have to redo the checks every time?
No — and this surprises people.
Reg 12B(2) The [designated non-financial business or profession] is not required to obtain or verify any documents, data, or information that it has previously obtained and verified relating to a customer that it has conducted customer due diligence on… unless— (a) there are reasonable grounds to doubt the adequacy or veracity of the documents, data, or information previously obtained; or (b) the level of risk involved otherwise requires it.
Due diligence attaches to the customer — the vendor or landlord who signs your agency agreement — not to the individual transaction. Check a landlord once, properly, and it carries to their next listing. You redo it if you have grounds to doubt what you hold, or if the risk has changed. So a deal falling over doesn't waste the work.
There's a related provision for firms whose relationship with a client started outside the Act:
Reg 12A(3) …the [firm] may carry out verification of identity after it is engaged to provide the relevant service if— (a) it is essential not to interrupt normal business practice; and (b) money laundering and financing of terrorism risks are effectively managed through appropriate risk management procedures; and (c) verification of identity is completed as soon as is practicable after [engagement].
That covers, for example, a property management client — outside the Act under reg 21B — who later asks you to handle a commercial lease, which is captured. It relaxes verification timing only, and only if all three conditions hold. It isn't a general grace period.
What never stops
Reg 12B(3) says specifically that reusing prior due diligence does not exempt you from s.31:
(2) A reporting entity must conduct ongoing customer due diligence and undertake account monitoring in order to— (a) ensure that the business relationship and the transactions relating to that business relationship are consistent with the reporting entity's knowledge about the customer and the customer's business and risk profile; and (b) identify any grounds for reporting a suspicious activity…
(4) …must do at least the following: (a) regularly review the customer's account activity and transaction behaviour; and (b) regularly review any customer information obtained…
"Regularly" isn't defined — s.31(3) makes it risk-based, so a firm with a handful of clients isn't held to the same cadence as a large agency. But it has to be a written procedure that actually happens and gets recorded.
Reporting deadlines
s.40(1) A reporting entity other than a high-value dealer or law firm must, as soon as practicable but no later than 3 working days after forming its suspicion, report… (2) A law firm must, as soon as practicable, but no later than 5 working days after forming its suspicion, report… (3) Despite subsection (2), a law firm is not required to disclose any information that the law firm believes on reasonable grounds is a privileged communication.
Prescribed transaction reports — international wire transfers and domestic physical cash transactions at or above the threshold — go in under s.48A, no later than 20 working days after the transaction.
The compliance officer
(2) A reporting entity must designate an employee as an AML/CFT compliance officer… (3) In the case of a reporting entity that does not have employees, the reporting entity must appoint an individual to act as its AML/CFT compliance officer. (4) The compliance officer must be a senior manager or report to a senior manager of the reporting entity. (5) Despite subsections (2) to (4), if a reporting entity is a partnership, the partnership may designate one of the partners… irrespective of whether the partnership has or does not have employees.
If you have staff, it must be one of them. If you have no employees, DIA's published guidance is explicit: "Only where a reporting entity has no employees can an external person be appointed as a Compliance Officer." Sole-operator companies often don't realise that option exists.
The risk assessment, and what changed on 19 May 2026
s.58(3) The risk assessment must be in writing and— (a) identify the risks faced by the reporting entity…; (b) describe how the reporting entity will ensure that the assessment remains current; (ba) incorporate all relevant risks that are identified by any risk assessments produced under sections 131 and 142; (c) enable the reporting entity to determine the level of risk…
Paragraph (ba) was inserted on 19 May 2026. Section 131 is your supervisor's sector risk assessments; section 142 is the National Risk Assessment.
The practical consequence: a risk assessment written before mid-2026 will not incorporate them, so as drafted it doesn't satisfy s.58(3). And the annual report asks you to state whether your risk assessment complies.
The audit interval — where the Act and the regulation disagree
s.59(2) A reporting entity (other than a high-value dealer) must ensure that its risk assessment and AML/CFT programme are audited every 2 years or during a different time period prescribed by rules made under section 156B…
That 2-year figure is displaced by regulation 13:
"the time period… is— (a) every 4 years, if the reporting entity's AML/CFT supervisor notifies the reporting entity that a 4-year period applies; or (b) in any other case, every 3 years."
So the answer is three years, or four if your supervisor has told you so. If you've seen "two years" published somewhere, that's the Act quoted without the regulation applied — a good illustration of why the carve-out pattern matters.
And s.59B(1): the audit "must be carried out by an independent person, appointed by the reporting entity, who is appropriately qualified." No requirement to be a chartered accountant — but whoever wrote your documents can't audit them.
The short version
- Find the general rule.
- Look for "Despite subsection…" — and for exclusions in the Definitions and Exemptions Regulations.
- If there's a carve-out for your sector, the general rule isn't yours. Follow it to the regulation.
- For real estate agents, that regulation is reg 16, and the trigger depends on the transaction type.
If you'd rather not work through this yourself, that's what we do — tell us what your firm actually does and we'll tell you which rules apply to you. If you're not captured, we'll tell you that too, and there'll be no invoice.
This page quotes legislation as at July 2026 and is general information, not legal advice. Deplexify is a compliance service led by a chartered accountant.