Know your customers, know your commitments: NZ mandates AML risk-rating for new customers

Starting 1 June 2025, all NZ reporting entities must assess, record and monitor the risk level of new clients.

These requirements show just how vital it is to know your customer from the get-go. By gathering the right info early, your firm can address potential issues at the start of the client relationship. What’s more, you can continue to feel confident of your compliance and ensure you’re not performing operational overkill on “low-risk” clients, while confidently applying additional measures when you identify a higher-risk client.

Here’s everything you need to know, plus APLYiD’s all-in-one no-nonsense solution.

Regulation 12AC:

In a move towards a more structured approach, this new regulation introduces mandatory risk-rating for new customers (including someone conducting an occasional transaction or activity as part of customer due diligence CDD requirements).

This change should make it easier for you to protect your business and reputation, thanks to a clear, consistent and objective approach – that stands up to external review standards – to identifying, monitoring and mitigating risks.

Under these new rules:

You now need to assign risk scores to new clients involved in AML. The Department of Internal Affairs (DIA) suggests your risk assessment may contain the following factors:

• customer’s occupation or business
• customer’s structure
• product or service risk
• involvement with new or developing tech that may favour anonymity
• nature and purpose of the business relationship
• method of delivery
• country risk
• red flag indicators

You’ll need to:

• use secure documented methods for risk assessment
• explain the reasoning behind each client’s risk rating
• regularly review these ratings as part of your ongoing customer due diligence (CDD) and account monitoring.
• update clients’ risk ratings where necessary.

Know your stuff. You can read more here:

The Department of Internal Affairs (DIA) has issued updated guidance to support you in developing a risk-rating framework for new clients, as required under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (the Act). You can view that here.

How do you strike the balance between solid compliance and quick, client-friendly service?

The good news is APLYiD can do all this for you – with the ability to risk-rate during onboarding and to update during ongoing CDD and account monitoring – keeping you compliant without the hassle.

With our no-nonsense approach we have a total focus on removing the friction, pain and effort associated with AML.

We’re here to help, so if you’re unsure about your specific requirements under these changes, please reach out for a chat.