Country-specific guidance Current
AML/CFT operating playbook for New Zealand accounting firms
Running a compliant practice is an ongoing operating discipline, not a one-off registration.
Accounting practices are Phase 2 reporting entities under New Zealand's AML/CFT Act, supervised by the Department of Internal Affairs. This playbook sets out what running a compliant practice actually involves, from enrolment through to ongoing reporting. It is general information, not legal or compliance advice.
Action plan
1 Confirm your practice is a reporting entity, and enrol with DIA Not every accounting service is captured; confirm your position before assuming either way.
The Department of Internal Affairs supervises accountants as reporting entities under the AML/CFT Act. Where your practice is captured, DIA's guidance sets out enrolling by emailing DIA with your name, your practice's details or New Zealand Business Number, your role, and a completed enrolment form, then accessing AML Online using a RealMe login with two-factor authentication.
- Confirm which of your practice's services bring it within the AML/CFT Act
- Enrol with DIA by email, including a completed enrolment form
- Set up AML Online access using RealMe, generally for your compliance officer
Done when: Your practice's reporting entity status has been confirmed and, where applicable, enrolment with DIA has been completed
DIA: AML Online enrolment2 Complete a risk assessment before writing your AML/CFT programme The risk assessment comes first; the programme is built to manage what it finds.
DIA's guidance for accountants is explicit that a risk assessment is the first step a practice must take, before developing its AML/CFT programme, identifying and assessing the money laundering and terrorism financing risks the practice reasonably expects to face. Build the programme to manage and mitigate what the risk assessment actually finds, rather than adapting a generic template.
- Complete a documented risk assessment before drafting the AML/CFT programme
- Base the programme's controls on what the risk assessment identifies
- Keep both documents current as your practice and client base change
Done when: A documented risk assessment exists and the AML/CFT programme is built to address its findings
DIA: AML/CFT information for accountants3 Run customer due diligence, record keeping, and suspicious activity reporting as ongoing disciplines These three obligations don't stop once a client is onboarded.
Customer due diligence, record keeping, and suspicious activity reporting continue throughout a client relationship, not only at onboarding. DIA's guidance confirms any activity you consider suspicious, assessed against the criteria in section 39A of the AML/CFT Act, must be reported to the Financial Intelligence Unit as a suspicious activity report, with no minimum value threshold for reporting.
- Keep reviewing existing client relationships, not only new ones
- Keep required records for the applicable retention period for each record type
- Report suspicious activity under section 39A criteria, whatever the transaction value
Done when: CDD review, record keeping, and suspicious activity reporting are running as ongoing practice disciplines, not one-off onboarding tasks
See setting a record retention scheduleDesignated services
Funds handling
Managing client funds or operating a trust account
Where your practice holds, manages, or controls client funds, or operates a trust account on a client's behalf, check that service specifically against DIA's guidance for accountants rather than assuming it sits outside the AML/CFT Act's scope.
Corporate and trust services
Assisting with company or trust formation
Assisting a client to form a company or trust, or acting in a related governance, trustee, or nominee capacity, is a further service worth checking individually against DIA's guidance for accountants.
Transactions
Assisting with financial or property transactions
Assisting a client to plan or execute a financial or property transaction is another service type to check specifically, since the nature of the assistance, not the job title of the person providing it, determines whether the AML/CFT Act applies.