Customer Risk Rating in New Zealand: AML/CFT Requirements and Compliance

Verifying a customer's identity is an essential part of Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) compliance. However, identity verification alone does not establish the level of risk associated with a customer. Different business activities, ownership structures, sources of funds and transaction patterns can present significantly different risks. Customer Risk Rating helps reporting entities assess these risks and apply appropriate Customer Due Diligence (CDD) and ongoing monitoring measures.

Customer Risk Rating Requirements in New Zealand

Since 1 June 2025, Regulation 12AC of the Anti-Money Laundering and Countering Financing of Terrorism (Requirements and Compliance) Regulations 2011 has required reporting entities to risk-rate new customers when conducting CDD in the applicable circumstances. Businesses must maintain relevant records and review risk ratings as appropriate during ongoing CDD and account monitoring. The Department of Internal Affairs (DIA) also provides guidance on developing suitable risk-rating methodologies. There is no single prescribed system, but the approach should align with the business's AML/CFT Risk Assessment and Programme.

What Factors Should Businesses Consider?

Customer risk ratings should consider multiple factors, including business activities, beneficial ownership, products and services, geographic exposure, transaction patterns and delivery channels. Politically Exposed Person (PEP) exposure, cash-intensive activities, complex ownership arrangements and unusual international transactions may indicate additional risks. A single risk factor does not automatically determine a customer's overall rating. Businesses should assess the combined effect of relevant factors and document their conclusions.

How Should Customer Risk Be Classified?

Businesses commonly classify customers as Low Risk, Medium Risk or High Risk, using assessment checklists, scoring matrices or digital risk-rating systems. The methodology should be consistent, documented and proportionate to the business's risk exposure. Importantly, customer risk ratings and CDD categories are different. A low-risk rating does not automatically qualify a customer for simplified CDD, while certain circumstances require Enhanced Customer Due Diligence (EDD) regardless of the assigned risk rating.

Ongoing Reviews and Record Keeping

Customer risk can change due to new business activities, changes in beneficial ownership, unusual transactions or exposure to higher-risk jurisdictions. Reporting entities must review and update customer risk ratings as appropriate through ongoing CDD and account monitoring. There is no universal annual review requirement for every customer; review arrangements should reflect the business's risks and internal procedures. Businesses must also retain relevant risk-rating records, including review and update dates, and should document the reasons supporting their decisions. Applicable records generally need to be retained for at least five years after the business relationship ends or the relevant occasional transaction or activity is completed.

How Trusted AML Can Help

Trusted AML assists New Zealand businesses with developing customer risk-rating frameworks, establishing assessment criteria and integrating risk-based procedures into their AML/CFT compliance programmes.

Our AML Customer Management System supports customer risk rating, identity verification, PEP and sanctions screening, and customer record management. The system also provides document recognition (OCR), facial matching and liveness detection, allowing businesses to manage verification results, review screening records and download relevant reports through a centralised platform.

In addition to technology solutions, Trusted AML provides CDD and EDD outsourcing, Source of Funds and Source of Wealth reviews, AML/CFT Risk Assessments, Programme development, independent audits, compliance remediation and staff training. Our services help businesses improve their compliance processes while maintaining a practical, risk-based approach to customer due diligence.