New Zealand AML/CFT for Accountants: DIA Requirements

In New Zealand, accountants are supervised for anti-money laundering (AML) by the Department of Internal Affairs (DIA) under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009. DIA treats accountants as part of the "designated non-financial businesses and professions" sector, alongside lawyers, conveyancers, real estate agents and high value dealers. This guide explains what the DIA expects from an accounting firm, which recent changes matter in 2026 and 2027, and how to build a programme that stands up on inspection. It draws on DIA's information for accountants, its FAQ for reporting entities and its published dates. Rules and guidance are updated regularly, so check the DIA site and the current Act before you act. This is general information, not legal advice.

Who is covered?

DIA's guide applies to accountants and to any business carrying out activities within the definition of a designated non-financial business or profession. Whether your firm is a reporting entity depends on the services you provide in the ordinary course of business, and not on the title "accountant". DIA published new "ordinary course of business" guidance in July 2026, which replaces a 2017 version, and it has separate notes on tax transfers, bookkeepers' involvement in financial transactions and registered office or address services. Work through those notes before you decide that part of your practice is outside the Act.

DIA also lists a class exemption for tax transfers, valid until 14 July 2027, which exempts most but not all obligations. If you handle tax payments for clients, read the exemption's conditions rather than assuming it covers everything.

The programme: start with a risk assessment

DIA says that a risk assessment is the first step a business must take before developing an AML/CFT programme. The risk assessment is required by section 58 of the Act, and the programme, required by section 56, must be based on it and set out procedures, policies and controls. In practice a firm should be able to show:

• a written risk assessment covering its clients, services, delivery channels and the countries it deals with;
• a programme that follows from that assessment, with named procedures for customer due diligence, ongoing monitoring and reporting;
• a compliance officer, because section 56(2) says a reporting entity must designate an employee as one. DIA's FAQ says the officer must be an employee who reports to a senior manager, or a senior manager, and only a reporting entity with no employees can appoint an external person; and
• training for staff and records of who attended.

Our firm-wide AML risk assessment guide shows how to structure the first step.

Customer due diligence and identity verification

DIA's guidance covers beneficial ownership, due diligence for companies, trusts and partnerships, and enhanced due diligence. Three dates matter:

• 1 June 2025. Reporting entities must keep a customer risk rating and review it during ongoing due diligence.
• 1 July 2026. A new Identity Verification Code of Practice commences. Existing procedures remain compliant until 30 June 2027.
• 1 July 2027. Certified copies by email become available.

If your onboarding checklist was written before these changes, review it against the new code. For tracing owners through layers and trusts, see our guide to ultimate beneficial ownership for accountants.

Reporting

DIA's FAQ states that there is no value threshold for reporting suspicious activity, and that any activity you consider suspicious must be reported to the Financial Intelligence Unit as a suspicious activity report. It also says a large cash transaction prescribed transaction report must be submitted for any cash transaction of NZ$10,000 or more. The FAQ does not set out a reporting deadline, so use DIA's current guidance on timing.

Audits and annual reports

Regulation 13 requires an independent audit of your risk assessment and programme every three years, though DIA may notify a four-year timeframe or ask for an audit at another time. Annual reports follow a prescribed form under section 60 of the Act. DIA published audit guidance in July 2026, so read it before you appoint an auditor.

What DIA says about the sector

DIA lists its Accounting Sector Risk Assessment 2026 as published on 9 September 2026, with a DIA webinar on it scheduled for 1 October 2026. Read it when you update your own risk assessment, because it is the supervisor's own view of where accounting firms are exposed.

A starter checklist

1. Decide whether each of your services is within the Act, using the July 2026 guidance, and record your reasoning.
2. Complete or refresh the written risk assessment.
3. Check the programme, compliance officer and training records are in place.
4. Update client onboarding for the customer risk rating and the new identity verification code.
5. Diarise your next independent audit and your annual report.

For more guides across jurisdictions, start with our AML and KYC guides hub, and see our CPD courses for training.

Frequently asked questions

Who supervises accountants in New Zealand?

The Department of Internal Affairs, which supervises the designated non-financial businesses and professions sector.

Do I need a compliance officer?

Yes. Section 56(2) requires a reporting entity to designate an employee as compliance officer.

How often is the independent audit?

Every three years under regulation 13, unless DIA notifies a four-year timeframe or requests one at another time.

Is there a minimum amount for reporting suspicious activity?

No. DIA's FAQ says there is no value threshold for reporting suspicious activity.

What changes in 2026 and 2027?

A new Identity Verification Code of Practice starts on 1 July 2026, existing procedures remain compliant until 30 June 2027, and the tax transfers class exemption expires on 14 July 2027.