New Zealand's Identity Verification Code of Practice 2026: What businesses need to know

From 1 July 2026, a new Identity Verification Code of Practice (IVCOP) comes into effect in New Zealand, replacing the version that has been in place since 2013. If your business is a reporting entity under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), this update is relevant to you.

Here's what the changes mean in practice and how to make sure you're ready.

What is the IVCOP?

The IVCOP sets out best practice for how reporting entities should verify the name and date of birth of their customers, beneficial owners, and persons acting on behalf of customers. Following it isn't legally mandatory, but it provides "safe harbour" - meaning if your verification processes are ever scrutinised, compliance with the code is strong evidence you've met your obligations under the AML/CFT Act.

If you choose not to follow it, you'll need to demonstrate your alternative approach is equally effective and notify your AML/CFT supervisor in writing.

So what's changed?

The 2026 update modernises an increasingly outdated framework. The key changes are:

• The code now applies to high-risk customers, not just low- and medium-risk. This is a meaningful expansion that affects how businesses approach their most scrutinised relationships.

• Digital identity verification is formally recognised for the first time. Verification through an accredited Digital Identity Services Trust Framework (DISTF) provider is now an approved pathway - reflecting how far technology has moved since 2013.

• Electronic verification has been clarified and simplified. The DIA Confirmation Service, verified RealMe identities, embedded e-passport microchips, and equivalent overseas government sources can now be used as a single reliable and independent source, removing the previous requirement to corroborate with a second source in most cases.

• Certified copies have been updated. The certification must now be carried out within the 12 months preceding presentation, Māori Land Court officials have been added as trusted referees, and from 1 July 2027, businesses can explicitly receive certified copies by email or post - with appropriate controls in place.

• Reduced verification steps are now permitted for beneficial owners of low- and medium-risk customers with two or more beneficial owners, provided your AML/CFT programme documents when and how those reduced steps will be applied.

What does this mean for your business?

At a practical level, the 2026 IVCOP gives businesses more options and more flexibility in how they verify identity - but it doesn't reduce the underlying obligation to know who you're dealing with. The extension to high-risk customers brings formal guidance to an area where rigorous verification was already expected in practice.

Businesses should review their current verification processes against the new pathways, update their AML/CFT compliance programmes accordingly, and ensure their teams understand what's changed. Exception handling procedures for customers who genuinely cannot meet standard requirements - should also be documented.

How APLYiD helps

Navigating identity verification requirements is complex and getting it wrong carries real risk. APLYiD provides end-to-end AML compliance and support for New Zealand businesses, built around exactly the kinds of obligations the IVCOP sets out.

Our platform verifies customer identity electronically - checking name, date of birth, and document authenticity in real time, with biometric and liveness technology to bind a person to their claimed identity. This aligns directly with the electronic verification pathway under the new IVCOP.

Beyond verification, APLYiD helps businesses manage ongoing risk. Customer risk ratings, ongoing monitoring, and PEP and sanctions screening are built into the platform, so your compliance doesn't stop at onboarding. Everything is stored in an audit-ready format, meaning if you're ever reviewed by your AML/CFT supervisor, your records are structured, complete, and accessible.

From the first identity check through to long-term customer monitoring, APLYiD supports the full compliance lifecycle - so your team can focus on running your business, not managing paperwork.