Can AML Due Diligence Be Outsourced in New Zealand?

In New Zealand, businesses regulated under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act) are required to conduct Customer Due Diligence (CDD) in accordance with applicable legal requirements.

For law firms, lending businesses and other reporting entities, CDD involves more than simply verifying a customer's identity. Depending on the circumstances, it may also include identifying beneficial owners, understanding the nature and purpose of a business relationship, and investigating the customer's Source of Funds (SOF) or Source of Wealth (SOW).

As customer backgrounds and transaction structures become increasingly complex, some businesses are considering outsourcing certain due diligence activities to specialist providers.

But does New Zealand legal system allow AML due diligence to be outsourced? And if so, who remains responsible for meeting the compliance requirements?

What Does New Zealand Law Say About AML Outsourcing?

Under Section 34 (Reliance on Agents) of the AML/CFT Act 2009, a reporting entity may authorise a third party to act as its agent and conduct customer due diligence procedures on its behalf, subject to any applicable legal conditions.

This means that businesses do not necessarily need to carry out every identity verification or document review internally. Instead, they may engage external providers to assist with relevant CDD procedures, provided the arrangement meets the applicable requirements. However, outsourcing the work does not transfer the reporting entity's statutory AML/CFT responsibilities. The reporting entity remains responsible for ensuring that the due diligence performed meets the standards required under the Act.

Section 33 of the Act also provides for reliance on CDD conducted by another reporting entity or an eligible overseas person, subject to specific conditions. This differs from engaging an agent under Section 34. The former involves relying on due diligence conducted by another qualifying organisation, while the latter involves authorising a third party to perform procedures on the reporting entity's behalf. These arrangements have different legal requirements and should not be treated as interchangeable.

Which AML Due Diligence Activities Can Be Outsourced?

Depending on the reporting entity's requirements and AML/CFT compliance programme, outsourced activities may include Identity Verification, Beneficial Ownership Checks, Source of Funds investigations and Source of Wealth reviews.

For example, a third-party provider may assist with verifying customer identification documents, reviewing company ownership structures, or examining bank statements, financial records and supporting documentation to establish the origin of transaction funds. Where necessary, more detailed investigations may involve reviewing business income, investments, property transactions or other information explaining how a customer has accumulated their wealth.

These activities can become particularly time-consuming when dealing with international transactions, complex corporate structures or customers with extensive financial histories.

However, not every customer requires the same level of investigation. Reporting entities must determine the appropriate scope of CDD based on applicable legal requirements, customer risk and their own AML/CFT compliance programme. Where Enhanced Due Diligence (EDD) is required, the reporting entity must ensure that the additional information obtained and verified satisfies the relevant requirements.

What Should Businesses Consider Before Outsourcing CDD?

Although outsourcing can help reduce internal workloads, reporting entities must maintain appropriate oversight of third-party providers. Before entering into an outsourcing arrangement, businesses should clearly define the provider's responsibilities, the procedures to be performed and the expected documentation. They should also consider whether the provider has the necessary expertise and capabilities to carry out the work in accordance with applicable AML/CFT requirements.

Record keeping, information security and internal review procedures are equally important. Customer due diligence often involves sensitive information, including identity documents, bank statements and financial records. Reporting entities should ensure that relevant information can be accessed when required and that records are appropriately maintained in accordance with AML/CFT and privacy obligations. The Act also places restrictions on how information obtained by third parties conducting CDD may be used.

Even where a third-party provider has completed certain verification procedures, the reporting entity must still consider whether the information is sufficient, whether further investigation is necessary, and how the customer's risks should be managed. Outsourcing does not remove the entity's applicable obligations relating to ongoing customer due diligence, monitoring or broader AML/CFT compliance.

Conclusion

New Zealand's AML/CFT framework allows reporting entities to outsource certain customer due diligence activities, provided the arrangements comply with applicable legal requirements.

For law firms, lending businesses and other reporting entities, engaging specialist providers may offer a practical way to manage time-consuming investigations, particularly where customers have complex financial backgrounds or require extensive supporting documentation.

However, businesses should carefully consider the legal framework, the capabilities of their chosen provider, information security and internal oversight arrangements before outsourcing any CDD activities.

Customer due diligence procedures may be outsourced, but the reporting entity's compliance responsibilities remain.

About Trusted AML

Trusted AML specialises in AML compliance solutions across New Zealand and Australia, providing professional compliance services and digital solutions for law firms, financial institutions and other regulated businesses.

Our professional services include Customer Due Diligence (CDD/EDD) outsourcing, identity verification, Source of Funds (SOF) and Source of Wealth (SOW) investigations, AML/CFT compliance consulting, risk assessments and independent AML audits.

Our digital AML platform supports electronic identity verification (e-KYC), facial matching and liveness detection, PEP and sanctions screening, customer record management, due diligence documentation and secure document storage, helping businesses streamline their onboarding and compliance processes.