DIA issues first major guidance suite as New Zealand's sole AML/CFT supervisor
Financial crime · Guidance published following 1 July 2026 transition; institutions have until 30 June 2027 to update programmes
Following its 1 July 2026 transition to sole AML/CFT supervisor, the Department of Internal Affairs has published a wide suite of new guidance covering customer due diligence, risk assessments, wire transfers and prescribed transaction reports, alongside a transitional implementation period to 30 June 2027.
Why it matters — Banks and reporting entities now work from a single rulebook instead of three, but DIA has signalled it won't take a softer line on enforcement — compliance teams should treat the transition window as a deadline, not a grace period.
[UPDATE] Australia's Scams Prevention Framework: AFCA locked in, banks face 14 August deadline
Financial crime · AFCA membership recommended by 14 Aug 2026; framework starts 1 Sep 2026; full penalty regime from 31 Mar 2027
AFCA has been confirmed as the single external dispute-resolution scheme for scam complaints under Australia's Scams Prevention Framework, and is urging regulated businesses — banks, telcos and platforms — to complete membership by 14 August to be ready for the 1 September start. New detail also emerged: a proposed A$3,000 automatic-reimbursement threshold for smaller verified losses, and civil penalties of up to A$50m per contravention once AFCA starts accepting SPF complaints from 31 March 2027.
Why it matters — This converts a known future obligation into a hard near-term compliance deadline with real financial exposure — any bank operating in Australia (or planning to) needs AFCA membership sorted within the next fortnight, and the A$3,000 auto-reimbursement threshold sets a concrete new bar for scam-loss handling.
FATF virtual-assets review finds organised crime still moving billions through crypto, some stablecoins engineered to resist seizure
Financial crime · FATF targeted update published 16 July 2026
FATF's latest review of how countries are implementing its virtual-asset standards found crypto-enabled crime growing more complex and interconnected, spotlighting a Cambodia-based network that laundered an estimated US$4 billion tied to fraud and DPRK-linked cyber theft, and noted some criminal groups now issue their own stablecoins designed to resist freezing or seizure. Only around a third of the 149 jurisdictions assessed were rated "largely compliant" with FATF's crypto standards.
Why it matters — New Zealand is actively working through how to license virtual-asset and stablecoin activity (MBIE's payment-services review, the NZDD 'not a financial product' ruling, DIA's new sole AML/CFT supervisory role, and the pending AML/CFT Omnibus Bill's sanctions-enforcement powers) — FATF's finding that some stablecoins are built to resist freezing strengthens the case for banks and regulators to tighten monitoring and freezing capability for crypto-linked flows rather than treat NZ's lighter-touch stance as settled.
NZ Cabinet locks in AML/CFT levy structure — banks to fund 85% of a $27.3m annual bill from 2027
Financial crime · Cabinet approval reported ~9 July 2026; levy collection begins 1 July 2027
Cabinet has approved the final funding model for New Zealand's AML/CFT industry levy: banks and deposit takers with over $101 billion in reported assets carry 80% of the cost (smaller banks a further 5%), casinos/TAB/Entain 9%, and non-bank financial institutions and DNFBPs the remaining 6% — recovering an estimated $27.33 million a year to fund DIA supervision and Police's Financial Intelligence Unit.
Why it matters — The first concrete price tag on the AML/CFT overhaul: banks now have a firm cost and timeline to budget for, and the skewed allocation toward banks will likely feed into fee and pricing conversations ahead of the Omnibus Bill's introduction.
AML/CFT moves to a single supervisor (DIA) from 1 July 2026
Financial crime · Law passed 18 May 2026, effective 1 July 2026
DIA becomes the sole AML/CFT supervisor for all reporting entities, replacing the RBNZ/FMA/DIA split, and gains stronger powers including onsite inspections and compelled interviews, part-funded by a new industry levy. A companion package relaxes some requirements on a risk-proportionate basis — lighter trust CDD and address verification, fewer duplicative reports — with a third "Omnibus" bill expected to follow.
Why it matters — Re-point onboarding/KYC controls and reporting to DIA, and use the relaxed rules to strip duplicative checks from onboarding while preparing documentation for a tougher, inspection-led supervisor.