AML Update - April 2025

Following a review by the Ministry of Justice, a number of changes to AML have and continue to be made in three stages (2023, 2024 and 2025) through the Amendment Regulations 2023. As a Reporting Entity you should check through the changes, update relevant documentation, and ensure staff are informed of any areas that affect you.

Stage 1 - Implemented 31 July 2023

These changes included a number of clarifications to definitions and some regulation changes (for example including unincorporated societies in legal arrangements).

Stage 2 - Implemented 1 June 2024

Stage 2 included new obligations for existing Reporting Entities. The changes to obligations and how they affect different sectors are too broad and complex for us to cover everything here, so we strongly recommend you review the changes and how they relate to your specific circumstances. There are significant changes for VASPs (dealing with Virtual Assets), and to businesses conducting Wire Transfers. If that is you there is a lot to be done.

For most of our customers we have covered the main changes that stood out to us below. These are mostly changes related to Standard (CDD) and Enhanced (EDD) Due Diligence and will need to be reviewed so you can update your AML/CFT Programme and processes to ensure you stay compliant.

Changes to CDD

For Standard Due Diligence, there are additional requirements where the client is a Legal Person (such as a company) or Legal Arrangement (such as a Trust). This is in the Requirements and Compliance Amendment above, and includes areas like obtaining information on:

• the customer's legal form

• ownership and control

• powers that bind or regulate them

• nominee shareholders or nominee directors

For companies, legal form and ownership and control information is automatically pulled down in 2Shakes from Companies Office using the NZBN. The other information can be added to Notes & Files, and if nominees are involved, Enhanced Due Diligence (EDD) will be triggered as it does now in 2Shakes.

For a Trust in a Legal Arrangement, as well the above bullet-points, information must be obtained on Settlor(s) and any Protector(s) (as well as on the Trustees). Trusts also trigger Enhanced Due Diligence in 2Shakes.

NB: In a Trust, a Protector is someone the settlor can appoint independent of the Trustees, usually to oversee or monitor the governance or administration of the Trust.

Changes to EDD

There are a number of changes to Enhanced Due Diligence (EDD) too. These included additional measures that should be taken where the normal EDD measures (e.g. Source of Wealth/Proof of Funds) are insufficient at managing the AML/CFT risk. The additional measures include:

• obtaining more information about the transaction

• examining the purpose of the business transaction

• use of enhanced monitoring throughout the business relationship

• escalating to and receiving approval from senior management to proceed with the transaction or business relationship.

Other Notable Changes

We have listed below some other changes that we wanted to point out to customers. But remember there are lots of changes, so please make sure you have read the amendments.

• there is a blanket minimum 5 years to keep all records from the end of a transaction or business relationship.

• you should review your risk assessment for new or developing technologies that can be used for ML/FT before you implement them.

• there is a clarification that EDD is required where there are potential grounds for submitting a suspicious activity report.

• for EDD, information has been provided to differentiate between Source of Wealth and Proof of Funds, and when each (or both) should be used.

• for Limited Partnerships, EDD will be triggered if the customer has a nominee general partner.

Again, these are areas that stood out given what we regularly discuss with you, our customers. But you really need to go through the changes and see how they apply to you.

Stage 3 - Commencing 1 June 2025

This focuses on ensuring you risk rate your clients. Our understanding is that in practice your client risk assessment should return a rating for each client entity. That rating, which will be specified in your AML Programme, can be (for example) Low/Medium/High, which is widely used already.

In this way, the risk assessment has a definite result, and your AML Programme should specify what level of CDD to use based on that result.

Remember, you can store your Risk Assessment in the Notes & Files, and record a summary on the Risk Assessment tab for the client.