How to stay ahead of New Zealand AML changes

New Zealand’s AML/CFT framework is evolving. From July 1, 2026, two major updates take effect: the shift to the Department of Internal Affairs (DIA) as the sole supervisor, and the rollout of a new Identity Verification Code of Practice (IVCOP).  

The goal is clear, simplify oversight while modernizing how businesses verify identity and manage risk. 

For regulated entities, this isn’t just regulatory change. It’s a reset on how compliance gets done. 

What’s changing in practice 

• Greater flexibility in how identity can be verified
  The updated IVCOP supports a wider range of approved verification methods and electronic data sources, reflecting modern identity practices, while still allowing businesses to rely on existing approaches already in use. 
  
  
• Four defined verification pathways to choose from
  Identity can now be verified through face-to-face checks, electronic identity verification, certified document copies or accredited digital identity services, giving clearer options for meeting compliance requirements. 
  
  
• Expanded support for digital verification methods
  The guidance includes updated electronic verification options such as ePassport chip validation and trusted government or data sources, helping reduce reliance on manual document checks – especially international identities. 
  
  
• Continued emphasis on a risk-based approach across all customer types
  The IVCOP maintains a risk-based framework and now explicitly applies to high-risk customers, requiring appropriate controls to be applied regardless of the verification method used. 
  
  
• Continuity with existing verification practices
  Businesses can continue using the documents and electronic sources accepted under the 2013 code (with limited exceptions), meaning existing onboarding processes remain largely valid. 

A shift toward digital identity 

One of the most important changes is the formal acceptance of modern identity verification methods. 

The new framework supports digital identity solutions and NFC chip screening paired with biometrics or bank account verification.   

This is a significant step forward. It gives businesses the ability to move beyond manual checks and fragmented processes—and instead build connected, scalable identity workflows. 

What this means for businesses 

The move to a single supervisor and updated verification standards brings greater clarity, but also higher expectations. 

Organizations will need to: 

• Ensure verification methods align with IVCOP standards
• Maintain a risk-based approach for all customers
• Demonstrate consistency and auditability across all identity checks
• Transition toward digital-first onboarding and monitoring

In short: simpler rules, but stronger scrutiny. 

Turning compliance into an advantage 

The July 1 changes are more than a compliance update—they’re an opportunity to modernize. 

By adopting digital identity and automated verification workflows, businesses can: 

• Reduce friction in onboarding
• Improve accuracy and reduce manual errors
• Strengthen fraud prevention
• Scale operations without increasing compliance overhead 

The organizations that act early will be better positioned—not just to meet requirements, but to outperform in a regulated market.