Guidance

This information sheet assists market services licensees (excluding benchmark administrators) licensed under Part 6 of the Financial Markets Conduct Act 2013 (FMC Act) to enhance the resilience of their cyber and operational systems. While this information sheet is designed to apply to a broad range of sectors, entities with complex cyber security and operational systems should consider the specific technology requirements and obligations that apply to their sector.

This information sheet sets out our expectations for how licensed financial advice providers (FAPs) can demonstrate compliance with the standard condition for record keeping.

Section 34 of the AML/CFT Act allows a reporting entity to authorise and rely on an agent to conduct CDD procedures on its behalf. An agent is a person that has legal authority to represent another party. If you outsource the above CDD procedures under section 34 to a third-party provider, the provider must be acting as your agent. In these circumstances, you remain responsible for ensuring that the CDD conducted by the third-party provider is undertaken to the level required by the AML/CFT Act. Read the full guidance on this page.

This guidance is to assist reporting entities comply with the public statement issued by FATF on High-Risk Jurisdictions subject to a “Call for Action” and the subsequent Advisory issued by the Ministry of Justice and the New Zealand Police in this regard.

This information sheet explains the FMA’s expectations for financial services firms to prioritise their customer vulnerability practices, focusing on areas we consider immediate priorities, updated Sept 2021.

The Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Supervisors have produced this factsheet to confirm their position is that certain details may be redacted by a customer from their birth certificate if it is used for identity verification purposes when conducting customer due diligence.

AML/CFT amended identity verification code of practice 2013 provides a suggested best practice for all reporting entities conducting name and date of birth identity verification on customers (that are natural persons). Complying with a code of practice is not mandatory, although it constitutes a safe harbour. If a reporting entity fully complies with the code it is deemed to be compliant with the relevant parts of the Act. If a reporting entity opts out of the code, it must inform its supervisor and must adopt practices that are equally effective, otherwise, it risks non-compliance.