27 Oct 2026Public consultation on the Future of Payments (faster payments, stronger safeguards, competition and innovation) closes, informing the post-API-Centre regulatory settings.
28 Oct 2026RBNZ Monetary Policy Review and OCR decision (2pm), following the September hike to 2.75%.
31 Oct 2026ECB deadline for supervised banks to submit quantum-threat action plans to their Joint Supervisory Team, part of the EU's push toward post-quantum cryptography migration by 2030.
7 Nov 2026New Zealand general election, with banking-sector policy (bank levy/reform proposals, NZ First's floated BNZ-Kiwibank merger) a live campaign issue.
1 Dec 2026Kiwibank and remaining open banking services due to be live under the Customer and Product Data Act regulations (phased rollout deadline).
The FMA says AI-enabled deepfake and voice-cloning scams have contributed to $265 million in fraud losses, with no dedicated law yet targeting deepfake fraud specifically. Separately, advanced AI identity fraud is now costing NZ businesses an average $2.2 million per incident, and in one 24-hour period the FMA flagged 110 fraudulent investment ads using deepfake videos of NZ bank CEOs and politicians.
Heartland Group's special shareholder meeting to approve its $620 million acquisition of TSB Bank from Toi Foundation goes ahead on 30 September, having already secured Toi Foundation trustee approval. If approved, the combined TSB Heartland Bank would hold roughly $15 billion in NZ assets, with completion targeted for December.
Having closed submissions on its final DTA consultation tranche, RBNZ has now released near-final tranche 1 standards and relicensing guidance covering capital, IRB models, operational resilience, outsourcing, disclosure and related-party exposures, with most standards due by 31 May 2027 ahead of full DTA effect on 1 December 2028.
1 Regulatory — NZ horizon & global signals
New Zealand first; global banking, finance & payments items included where there's an NZ read-across.
Regulatory — NZ horizon & global signalshigh
FMA's merged conduct mandate faces its first real test two months in
Two months after absorbing consumer-credit licensing from the Commerce Commission, the FMA is now New Zealand's single conduct regulator across banks, insurers and lenders, with consumer lenders required to hold an FMA market-services licence in place of the former Commerce Commission certification.
Why it matters — A single conduct regulator raises the bar for consistency across banks and non-bank lenders alike — institutions should expect the FMA to apply bank-grade conduct expectations to BNPL and non-bank credit providers going forward.
Deposit Takers Act · Near-final standards released 14 Sep 2026; tranche 2 due Dec 2026
Having closed submissions on its final DTA consultation tranche, RBNZ has now released near-final tranche 1 standards and relicensing guidance covering capital, IRB models, operational resilience, outsourcing, disclosure and related-party exposures, with most standards due by 31 May 2027 ahead of full DTA effect on 1 December 2028.
Why it matters — Deposit takers now have a concrete text to plan relicensing against rather than a consultation draft — treasury, risk and compliance teams should start gap-assessing current practice against the near-final capital and outsourcing standards now.
Banks risk $230bn in payments revenue as stablecoins and tokenised deposits go mainstream
A new industry report projects banks stand to lose up to $230 billion in global payments revenue as stablecoins and tokenised deposits mature from pilots into mainstream payment rails, with nearly 60% of corporate clients willing to shift to non-bank stablecoin providers if banks lag.
Why it matters — NZ's big four are payments-revenue-dependent and largely stablecoin-absent; the read-across is a widening gap versus global peers already running live stablecoin pilots (Circle, US Bank, DBS/Citi) unless local banks or Payments NZ's successor body pick up the pace.
Focused on banking & payments, but includes cross-industry moves with read-across to financial institutions and their operations.
AI & automation — banking, payments & beyondhigh
Westpac unveils 'Adapt' AI platform and hires CBA's data chief to run it
AI transformation · Adapt platform unveiled 15 Sep 2026
Westpac has publicly launched its Adapt data platform — migrating over 14,000 pipelines and a petabyte of data off legacy systems — and hired CBA's former chief data and analytics officer, Andrew McMullan, as its new Chief Data, Digital and AI Officer reporting directly to the CEO. Roughly 35,000 staff now have AI tool access, with 95% using it monthly.
Why it matters — A big-four AU parent doubling down on AI infrastructure and leadership signals where NZ subsidiary operating models are headed next — expect AI-driven home-loan and service workflows to migrate south faster than usual technology-transfer cycles.
AI & automation — banking, payments & beyondmedium
Generative AI forces a rethink of KYC as identity fraud gets harder to spot
Industry analysis argues generative AI has fundamentally reshaped digital identity fraud, with AI-fabricated documents and synthetic identities now routinely defeating conventional document-and-selfie KYC checks, pushing vendors toward liveness and behavioural-signal-based verification.
Why it matters — NZ banks' onboarding vendors are largely global platforms in the same arms race — compliance teams should ask vendors directly what liveness and behavioural defences are on their roadmap, not just document-matching accuracy claims.
[UPDATE] Open banking volumes keep climbing as API Centre's final month begins
Open banking · July 2026 data; API Centre closes 30 Sep 2026
New data shows open banking usage still accelerating ahead of the API Centre's planned closure this month: over 401,000 payments worth more than $130 million were completed in July, more than 221,000 customers authorised a payment or data-sharing consent, and data requests topped 19 million for the first time.
Why it matters — The governance handover to MBIE is a structural risk point precisely when usage is inflecting upward — participants should confirm MBIE's standards-continuity plan covers this growth curve, not just a static rulebook.
SWIFT pushes ahead on blockchain ledger and cross-border retail payments framework
Payments infrastructure · Framework live; blockchain ledger announced Sep 2026
More than 25 banks have committed to SWIFT's new cross-border retail payments framework covering corridors including Australia, the UK, US, China and India, promising certain-cost, full-value, traceable transfers. SWIFT separately announced plans to add a blockchain-based shared ledger to its infrastructure to enable always-on instant settlement.
Why it matters — Every NZ bank's correspondent banking relationships run through SWIFT — the direction of travel (instant, traceable, blockchain-settled) sets the technical bar NZ cross-border payments will eventually be measured against, regardless of local rail timelines.
21-bank stablecoin consortium and Circle's Arc chain mark stablecoins' shift to infrastructure
Digital assets · September 2026
September saw a cluster of stablecoin infrastructure moves: a 21-bank USD stablecoin consortium announced in Manhattan, Circle's Arc chain going live on public mainnet, and a US Bank cross-border stablecoin settlement pilot on Stellar — evidence stablecoins are moving from roadmap items to production payment rails.
Why it matters — None of NZ's banks are currently party to a bank-issued stablecoin consortium; if global correspondent banks settle in stablecoins by default, NZ banks risk becoming rail-takers rather than rail-setters in cross-border corporate flows.
Australia's Consumer Data Right reset cuts data retention, extends to non-bank lending
Open banking · Non-bank lending CDR obligations began Jul 2026
Australia's CDR 'reset' has cut mandatory data retention from seven years to two and reduced compliance costs, while extending CDR obligations to non-bank lenders from July 2026, even as overall accredited-data-recipient adoption remains below original expectations.
Why it matters — NZ's own open banking transition to MBIE is smaller-scale than Australia's CDR, but the Australian experience — slow uptake despite regulation, followed by a deliberate compliance-cost reset — is a live case study for what NZ's post-API-Centre standards body should and shouldn't copy.
RBNZ lifts OCR to 2.75% as inflation stays above target
Monetary policy · OCR raised 2 Sep 2026
The RBNZ's Monetary Policy Committee unanimously raised the OCR by 25 basis points to 2.75% — its second hike since tightening resumed in July — after June-quarter inflation rose to 4.1%, driven largely by fuel prices linked to the Middle East conflict. The Bank expects inflation to stay above 3% for the rest of 2026.
Why it matters — A second consecutive hike with inflation still nearly double target keeps funding costs and mortgage-rate pressure elevated into Q4 — treasury and ALM teams should assume no near-term easing bias.
Existing and emerging players across NZ and Australia, plus global names where they're relevant to NZ/AU banking.
Competitor watch — NZ, Australia & globalhigh
Revolut secures unrestricted Australian banking licence after five-year wait
Market entry · APRA licence granted Sep 2026
Revolut has received an unrestricted banking licence from APRA after a five-year application process, enabling it to take deposits and pay interest on savings. The London-based neobank — now valued at roughly US$75bn — plans to invest close to A$400 million in its Australian growth over the next five years.
Why it matters — A funded, licensed Revolut competing directly for deposits in Australia raises the competitive bar the NZ big four's AU parents must answer to, and strengthens Revolut's balance sheet ahead of its parallel NZ registered-bank application.
Revolut has applied to the RBNZ to become a registered bank in New Zealand, which would make it the first global digital bank to hold NZ registration. Revolut has processed NZ$350 million in transactions since launching in the country in 2023.
Why it matters — A registered Revolut could offer NZ-held deposits and compete on lending, not just FX and cards — incumbents should treat this as a leading indicator, not a formality, given Revolut just proved it can clear a comparable bar in Australia.
Heartland Group's special shareholder meeting to approve its $620 million acquisition of TSB Bank from Toi Foundation goes ahead on 30 September, having already secured Toi Foundation trustee approval. If approved, the combined TSB Heartland Bank would hold roughly $15 billion in NZ assets, with completion targeted for December.
Why it matters — A combined TSB Heartland Bank materially changes the competitive tier below the big five — expect renewed scrutiny of its capital position and integration risk as the deal moves from vote to completion.
Customer-impacting fraud, scam typologies and the liability landscape — NZ-first, with global threat signals.
Fraud & scamscritical
FMA warns AI deepfake scams have cost New Zealanders $265 million
Fraud & scams
The FMA says AI-enabled deepfake and voice-cloning scams have contributed to $265 million in fraud losses, with no dedicated law yet targeting deepfake fraud specifically. Separately, advanced AI identity fraud is now costing NZ businesses an average $2.2 million per incident, and in one 24-hour period the FMA flagged 110 fraudulent investment ads using deepfake videos of NZ bank CEOs and politicians.
Why it matters — With no deepfake-specific law and CEO-impersonation ads already circulating, banks should treat voice/video verification as compromised by default for high-value transaction authorisation, not as a trusted fallback channel.
Anti-Scam Alliance's 2026 programme extends Confirmation of Payee to fintechs and non-banks
Fraud prevention · 2026 work programme
The NZ Anti-Scam Alliance's 2026 programme will extend banks' Confirmation of Payee system to fintechs and other non-bank payment providers, alongside a new Online Scams Code backed by Google, Meta and TikTok and a dedicated NZ Police Economic Crime Team targeting prolific scam offenders.
Why it matters — Once Confirmation of Payee extends beyond banks, liability and reimbursement conversations get more complex — banks should get ahead of how disputes will be adjudicated when a fintech counterparty is in the payment chain.
Slower-burning structural risks and trends worth getting ahead of — technology, resilience and governance.
Emerging risks & trendshigh
ECB gives banks until 31 October to submit quantum-threat action plans
Post-quantum readiness · Action plans due 31 Oct 2026; EU migration deadline 2030
The ECB has instructed supervised banks to assess quantum-computing threats to their cryptography without delay and submit a comprehensive action plan to their Joint Supervisory Team by 31 October 2026, with an EU roadmap recommending critical systems be migrated to post-quantum cryptography by end-2030.
Why it matters — RBNZ has no equivalent PQC mandate yet, but NZ banks with EU/UK correspondent relationships or global vendor platforms will be pulled into this timeline indirectly — worth mapping cryptographic dependencies now rather than waiting for a local mandate.
Bank of England finalises third-party and operational incident reporting rules
Operational resilience · PS7/26 published Mar 2026
The Bank of England's PS7/26 policy statement sets out final rules on operational incident and third-party reporting, part of a broader international regulatory push — alongside the EU's DORA — to address concentration risk from banks' reliance on a small number of core technology and cloud providers.
Why it matters — RBNZ's own DTA operational resilience standards are being drafted against this same international backdrop — expect NZ's eventual outsourcing and third-party standards to converge toward BoE/DORA-style incident reporting rather than diverge from it.