AML for legal firms: the rules and the risk

KYC and AML for legal firms: Staying compliant without slowing down business

AML compliance is already a reality for NZ legal firms, and regulatory expectations continue to rise. With tough enforcement action across the legal sector, firms must ensure their Anti Money Laundering (AML) programmes and Know Your Customer (KYC) checks are robust, consistent, and embedded into everyday workflows.

For many practices, this means striking a careful balance, meeting regulatory obligations without creating friction for clients or slowing down fee earners. Getting it right protects your firm’s compliance position and reputation.

What is KYC and AML?

Anti-Money Laundering (AML) refers to the broader framework of laws, regulations and monitoring systems which are designed to detect and prevent money laundering, financial terrorism and other financial crimes.

Know Your Customer (KYC) is the process of identifying and verifying a clients identity before you provide them with any services. Often this process involves checking ID documents, confirming addresses and screening clients against PEP, sanctions and adverse-media lists. APLYiD can have this step covered in under 90 seconds, with guided digital biometrics that automatically run secure checks.

What are the NZ AML/CTF requirements?

In a nutshell, NZ Anti Money Laundering requirements can be broken down into five major components:

1. Develop and maintain a robust AML/CTF program tailored to your business, and make sure your staff stick to it.
2. Conduct initial and ongoing customer due diligence. This should be done before providing services and includes risk assessments, especially for politically exposed persons (PEPs) and other high risk individuals.
3. Report certain transactions and suspicious activities.
   1. If you know or suspect money laundering or terrorist financing, you must submit a Suspicious Activity Report (SAR) to the New Zealand Police Financial Intelligence Unit (FIU) as soon as practicable, but no later than 5 working days (for law firms) after forming the suspicion.
   2. Prescribed Transaction Reports (PTRs) must also be submitted in certain circumstances, including:

• Cash transactions of NZ$10,000 or more (or the foreign currency equivalent)
• International wire transfers of NZ$1,000 or more

4. Make and store records safely and securely, for at least five years. At a minimum you should keep records for:

1. Transactions
2. Client identification procedures
3. Your AML/CTF program.

5. Report on, audit and update your programme.

1. Supervisors such as the Department of Internal Affairs (DIA), Financial Markets Authority (FMA), and Reserve Bank of New Zealand (RBNZ) can and do audit reporting entities. Conducting regular internal reviews and independent audits helps ensure your programme remains compliant.
2. You may also be required to submit a compliance report when requested by your supervisor. It’s a good idea to ensure your programmes and processes are well documented to make this easy.
3. Law Firms (supervised by the DIA), must also complete an annual report of their risk assessment and AML/CFT programme, that covers the reporting period from 1 July – 30 June. This is required to be submitted via the AML Online portal. https://aml.dia.govt.nz (https://aml.dia.govt.nz/)

For more guidance on what your obligations are and how to cut out the guesswork, you can download our AML guide here.

What are the consequences?

Not meeting your AML obligations can have some pretty serious consequences, damaging your business’ reputation, slowing down operations and, in extreme cases, ending in civil penalties and enforcement actions.

Some of the actions New Zealand supervisors can take if reporting entities are not complying with Anti Money Laundering regulations include:

• Enforcement Actions:
  • Civil penalties can be imposed through the courts, with fines of up to NZ$200,000 for individuals and up to NZ$2 million for corporate entities.
  • Enforceable undertakings or compliance agreements may be required, setting out how you will remediate breaches and improve your AML controls.
  • Formal warnings, and in more serious cases, censures, can be issued for breaches of the Money Laundering Regulations relating to customer due diligence, risk assessments, reporting suspicious activity, registration or supervision, and record keeping.
  • Remedial directions can be issued and instruct you in writing to take specific action to comply with certain parts of the AML/CTF Act.
  • Appoint external auditors to review your AML/CTF programmes and processes, or run AML/CTF risk assessments.
  • Refuse, cancel or suspend registration of remittance service providers and digital currency exchange providers.
  • In serious cases, matters may be referred for criminal investigation, which can result in prosecution, fines, or imprisonment for individuals.

What does this mean for my practice?

For most NZ legal firms this means rethinking your everyday workflows, which could slow things down. Manual KYC checks create friction for your clients at the worst moment, and storing things yourself can lead to file mismanagement or inconsistencies between staff.

Some key things to watch out for are:

• Chasing IDs: Endless back-and-forth with clients for the right documents can stall things and frustrate staff.
• Client drop-off: If onboarding feels clunky or intrusive, clients might abandon the process, which could mean a loss of billable work for your firm.
• Rework: Incorrect or incomplete checks force teams to redo verification steps, wasting time and increasing compliance risk. Not to mention it can come across unprofessional or unorganised if you need to chase a client for additional documents.
• Staff inconsistency: Different folders, filing systems and processes between staff could lead to errors and compliance breaches, plus it could make audits a painfully slow process.

AML might be sounding like a nightmare, but it doesn’t have to be. Putting in the right tools - like APLYiD - can streamline your internal processes and create a fast and polished experience for your clients.

How can APLYiD help?

Firms that embrace technology‑enabled compliance will not only meet NZ’s AML/CTF requirements but also strengthen client trust, reduce operational risk, and future‑proof their practice. APLYiD takes all the guesswork out of AML so you can onboard clients, monitor risk and store records all from one, secure platform.

• Onboard: Request the right documents every time with guided document collection
• Verify: Verify and easily re-verify clients using the relevant biometric AML and KYC - with results back in less than 90 seconds.
• Manage: View and manage all AML activities and risks consistently - for every client - in one place.
• Monitor + Relax: Set risk levels, automate review alerts and set up ongoing monitoring.

No unnecessary complexity. No admin overload. No training needed. Just simple AML without the headaches. Whether you're running a solo firm or managing a small team, APLYiD makes compliance easy so you can focus on what you do best.