At the end of June the long awaited changes to the various regulations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (‘Act’) were released.  The regulations being amended are:

• Anti-Money Laundering and Countering Financing of Terrorism (Cross-border Transportation of Cash) Amendment Regulations 2023

• Anti-Money Laundering and Countering Financing of Terrorism (Definitions) Amendment Regulations (No 2) 2023

• Anti-Money Laundering and Countering Financing of Terrorism (Exemptions) Amendment Regulations 2023

• Anti-Money Laundering and Countering Financing of Terrorism (Prescribed Transactions Reporting) Amendment Regulations 2023

• Anti-Money Laundering and Countering Financing of Terrorism (Requirements and Compliance) Amendment Regulations 2023

(the ‘Amended Regulations’.)

The Amended Regulations package is the result of the report on the review led by the Ministry of Justice (‘MoJ’) on the Act and its regulations held between July 2021 and 30 June 2022 (‘Report’), following a public consultation on the exposure draft regulations earlier this year.

Amended Regulations

In March this year we wrote about some of the main changes that the proposed regulatory amendments would bring to the AML/CFT regime under the exposure draft regulations. These changes were intended to provide regulatory relief to certain areas, while introducing new obligations for reporting entities. We now have a clearer picture and timetable on the precise form of the changes by way of the Amended Regulations. These will have a staggered implementation over three dates:

1. 31 July 2023; 
2. 1 June 2024; and 
3. 1 June 2025.

We have summarised the main key changes under the Amended Regulations below. This should be treated as a snapshot only as there are also numerous other changes, many of which are fairly technical and detailed in nature.

Amendments commencing on 31 July 2023

• Clarifying the definition of a ‘beneficial owner’ in the Act, by confirming it includes a person with ‘ultimate ownership or control’ of a customer, and also includes a ‘person on whose behalf of which a transaction has been conducted’ (‘POWBATIC’) but only if that POWBATIC also has ultimate ownership or control of the reporting entity’s customer, whether directly or indirectly. This narrowing of the scope of the definition means POWBATICs with no link to beneficial ownership do not need to be subject to CDD requirements, as the MoJ’s view was they may have been unnecessarily caught previously.
• Clarifying customer due diligence (‘CDD’) requirements for a designated non-financial business or profession, including where relevant services are provided to repeat customers outside of an ongoing business relationship.
• Prescribing CDD obligations for the formation of a legal person or legal arrangement. This applies to the designated non-financial business or profession sectors when forming, arranging, or acting for legal persons or arrangements, with the practical change being CDD will be required on the legal person or legal arrangement being formed.
• Declaring a person who provides safekeeping or administration of virtual assets on behalf of any person is a financial institution under the Act, and introducing a definition for ‘virtual assets’.  However, the definition of ‘virtual asset service provider’ included in the draft regulations has not been included in the Amendment Regulations.
• Clarifying timeframes for when real estate agents must conduct CDD. 
• Exempting the movement of accompanied cash into or out of New Zealand on a craft (for example, cruise ships) from having to provide a cash report under certain circumstances. 
• Defining who is a ‘customer’ in relation to real estate agents, liquidators, executors or administrators of estates.
• Prescribing the ‘customer’ as the relevant legal person or arrangement when acting or arranging for someone to act as a nominee director, nominee shareholder or a trustee.
• Prescribing wire transfers of $1,000 outside of a business relationship as an ‘occasional transaction’.
• Introducing new exemptions for trustee or nominee companies who provide relevant services on behalf of a parent reporting entity.
• Extending a range of exemptions for Crown entities, registered charities (who provide loans not exceeding $6,000) and non-court appointed liquidators, and applying new exemptions to TAB NZ (this is connected to its partnership with Entain New Zealand Limited, who is declared a reporting entity). 

Amendments commencing on 1 June 2024

• Declaring virtual asset transactions of a threshold of $1,000 or more to be an occasional transaction under certain circumstances. 
• Declaring that wire transfers include a virtual asset to virtual asset transfer, and a virtual asset to fiat currency transfer (or vice versa).
• Requiring border cash reports for unaccompanied cash to be submitted at least 72 hours before the cash arrives or leaves New Zealand.
• Expanding the information required as part of standard CDD in respect of customers who are either a legal person or a legal arrangement under the Act.
• Clarifying enhanced CDD is required on a customer if there are grounds to report a suspicious activity.
• Prescribing additional enhanced CDD measures if the usual enhanced CDD measures (ie. obtaining and verifying information regarding source of wealth or funds) are not sufficient to manage the risk of money laundering and terrorism financing.  The four additional measures are:
  
  • obtaining further information from a customer in relation to a transaction;
  • examining the purpose of a transaction;
  • enhanced monitoring of a business relationship; or
  • obtaining the approval of senior management to continue the transaction or business relationship.
• A reporting entity who is a member of a designated business group may rely on another member of the group who is resident overseas if that resident has CDD procedures to at least the standard required under the Act and its regulations.
• Prohibiting reporting entities from establishing or continuing a correspondent banking relationship with any bank registered in North Korea.
• Specifically requiring reporting entities to review their risk assessments to take into account new or developing technologies or products or delivery mechanisms before they are implemented or used.
• Introducing a specific record keeping obligation for prescribed transaction reports to require records be kept for at least 5 years after the end of the business relationship with the customer.
• Requiring reporting entities to expressly set out adequate and effective policies, procedures and controls in their AML/CFT compliance programmes if it is a beneficiary institution for a international wire transfers, and where any functions are carried out by an agent of the reporting entity.
• Requiring AML/CFT compliance programmes to expressly differentiate between the circumstances where CDD is conducted to obtain information regarding either the source of funds or source or wealth of a customer, or both. Given the Act currently does not differentiate between source of funds and source of wealth, our expectation is there should be further legislative direction or guidance on this issue.
• Revoking the exemptions provided in respect of certain remittance card facilities.

Amendments commencing on 1 June 2025

• Revoking the current exclusion for providers of internet auctions and introducing a narrower exemption for transactions between a provider of an online marketplace and buyers/sellers if the transaction(s) do not exceed $10,000 in any 12 month period (unless the transaction is considered a suspicious activity).
• Requiring reporting entities to risk-rate a new customer when conducting CDD under the Act and to keep a record of the rating, with the rating to be reviewed as appropriate.

Extension of class exemptions

In addition to releasing the Amended Regulations, the first 13 class exemptions (other than some elements of the managing intermediaries exemptions) in the Anti-Money Laundering and Countering Financing of Terrorism (Class Exemptions) Notice 2018 which expired on 30 June 2023 were renewed for a further 18 month period. This timeframe aligns with the MoJ’s broader work in the AML/CFT regime so it can conduct a full review of the class exemptions and consult on any proposed changes.

Given the narrowing of the scope of the ‘beneficial ownership’ definition in the Amended Regulations so it will no longer apply to ‘customers of customers’, a shorter 6 month extension (to 31 December 2023) has been applied for the Part 5 and Part 6 exemptions for reporting entities in respect of licensed managing intermediaries (‘LMI’) and specified managing intermediaries (‘SMI’) customers. This will allow for a transition period for the first set of the Amended Regulations to come into effect before the redundant elements as applicable to LMI and SMI customers in the class exemptions are phased out.

Our take

There are some aspects of the Amended Regulations that are welcome, particularly where some useful clarifications have been made, for example, by narrowing the ‘beneficial owner’ definition in respect of a POWBATIC and in relation to virtual asset transactions. The changes coming up on 31 July should not represent a significant change in current practice for most reporting entities (those directly impacted by the exemptions excluded). However all reporting entities will need to understand or seek advice on the Amendment Regulations and consider whether any changes are required to their AML/CFT processes and procedures generally, or to their risk assessment and compliance programme.

Disappointingly twelve proposed changes featured in the exposure draft regulations have dropped out of the Amended Regulations, with the MoJ stating these will need to wait until the Act itself is amended. These proposals included relaxing the requirement to verify an address for standard CDD and extensions to prescribed transaction report reporting times, both of which would have been very welcome in easing the compliance burden.

Legislative jigsaw 

The piecemeal approach taken under the Amended Regulations and their staggered implementation dates is far from user friendly. Practically navigating around the numerous Amended Regulations and the Act is very challenging for non-experts and must be a frustration for most reporting entity business wanting to find out the legislative source of their AML/CFT obligations.

If a culture of AML/CFT compliance is to be fostered, it is a real barrier for reporting entities if the AML/CFT law itself cannot be readily identified or understood without engaging expert advice. This will only become more difficult with further changes to the Act flagged ‘in due course’ to deal with some of the original changes which dropped out of the Amended Regulations, and possibly other legislative type recommendations in the Report. We predict a treadmill of further legislative amendments over the next few years.

We recognise it would not be an easy exercise, but strongly encourage the MoJ to prioritise the consolidation the Act and its Amended Regulations as soon as it can. It should be the case, for example, that a reporting entity be able to find its CDD obligations in one place and read these with the relevant guidance so they can apply it in practice.

Risk-based guidance needed

The AML/CFT supervisors should also not lose sight of the biggest issue identified by the MoJ in the Report. This was the Act was not taking a sufficiently risk-based approach and AML/CFT efforts by businesses are not always prioritised towards the areas that have the highest risk. The Report recognised some requirements in the Act are overly prescriptive which prevents a flexible, a risk-based approach being taken. In some limited areas the Amended Regulations make some incremental steps towards introducing a more flexible and risk based approach, but essentially the AML/CFT regime remains overly prescriptive.  In the absence of further and more timely meaningful relief, we encourage the AML/CFT supervisors to issue updated and/or more practical guidance to assist reporting entities so they have more information and awareness about how to apply a more flexible risk-based approach to their AML/CFT compliance obligations.