Summary

• The Omnibus Amendment Bill is before Parliament and is likely to become law in late 2027 or early 2028.
• Customer due diligence (CDD) becomes more risk-based, with wider use of simplified CDD and no automatic Enhanced customer due diligence (ECDD) for lower-risk trusts.
• Sanctions compliance and counter-proliferation financing join the core framework, bringing new risk assessment and reporting duties.
• Designated business groups are replaced by mandatory and voluntary reporting groups.
• Penalties rise sharply, up to $5 million for corporate entities, and enforcement powers expand.
• Expect to update your risk assessment and compliance programme before the Bill takes effect.

The Anti-Money Laundering and Countering Financing of Terrorism (Omnibus) Amendment Bill has been introduced to Parliament. It should progress once Parliament resumes after the election and is likely to become law in late 2027 or early 2028.

The Bill brings welcome regulatory relief and flexibility for reporting entities, balanced by expanded supervisory powers and higher penalties for non-compliance.

Here is a breakdown of the key (proposed) changes, what they mean for your business, and what you will need to do as the Bill gets closer to enactment.

 

Customer due diligence (CDD): More flexibility, greater accountability

The Bill introduces a more pragmatic (risk-based) approach to customer due diligence. Many reporting entities will welcome that enhanced customer due diligence (ECDD) will no longer automatically be required for trusts in lower-risk circumstances.

Reporting entities will have broader scope to apply simplified CDD where a customer is assessed as low risk, as well as to a broader range of corporate customers. Identity verification requirements under simplified CDD will be tweaked to better reflect the (low) risk.

Identity verification as part of ECDD will become risk-based rather than prescriptive. To prevent tipping-off, reporting entities will not be required to conduct ECDD if doing so would alert a customer that a suspicious activity report (SAR) is being filed.

While this will streamline customer onboarding, flexibility cuts both ways. Where a lesser form of CDD or reduced identity verification is being applied, the supervisor will expect up-to-date risk assessments, robust application of controls, and good record-keeping.

 

New duties in relation to counter-proliferation financing and sanctions compliance

The Bill formally introduces sanctions compliance and counter-proliferation financing into the core regulatory framework. Reporting entities will be required to assess targeted financial sanctions (TFS) and proliferation financing (PF) risks in their risk assessments and AML/CFT compliance programmes. New reporting obligations in relation to sanctions-related activity will come into being.

These new compliance areas represent a significant expansion of the core regulatory framework, comparable to the addition of countering financing of terrorism (CFT) following the September 11, 2001 terrorist attacks. Both are technically complex and we would expect detailed and timely guidance from the supervisor on how to implement them.

 

Out with DBGs, in with mandatory and voluntary reporting groups

The existing designated business group (DBG) framework is being overhauled to align with Financial Action Task Force (FATF) standards and the Australian regime. Related corporate groups operating in New Zealand (or supervised overseas jurisdictions) will be required to form reporting groups, appoint a lead entity, and implement group-wide compliance programmes and risk assessments.

Entities that do not meet mandatory criteria will be able to form voluntary groups to share compliance functions and to achieve operational efficiencies.

Designated business groups in New Zealand exist primarily in the real estate sector. We see opportunities for voluntary reporting groups to help drive operational efficiencies and reduced compliance costs.

 

Independent audits become independent evaluations

The Bill replaces the statutory term “audit” with independent evaluation to better capture the nature of the review.

 

Restrictions on cash, crypto, and remittances

New prohibitions will apply to cash purchases of virtual assets (such as through crypto ATMs) and to cash involved in international wire transfers above prescribed thresholds. Regulations specifying these financial thresholds should be consulted on in 2027.

 

Higher penalties and expanded enforcement powers

The regulatory hammer is getting heavier. To deter non-compliance and to align with comparable domestic and international regimes, the Bill:

• increases civil pecuniary penalties for reporting entities by roughly fivefold – up to $5 million for corporate entities (or 3 times the commercial gain, or 10% of annual turnover where the gain is not readily ascertainable), and $500,000 for individuals
• doubles maximum imprisonment terms for some offences
• introduces infringements offences (‘AML/CFT tickets’), issued by the supervisor for minor non-compliance
• lengthens the prosecution window from 3 to 5 years; and
• strengthens the Commissioner of Police’s powers, including by enabling temporary freezing orders and expanding information request powers.

 

What should reporting entities do once the Bill is passed?

Once the Bill is passed into law, you will need to update your risk assessment and compliance programme (perhaps extensively), review operational processes (such as customer onboarding), and provide additional training to staff. You may also be required to form a reporting group, or may wish to consider forming one voluntarily.

For now, it’s worth keeping an eye on the Bill’s progress so you’re ready to act when it becomes law.

Have questions about how the Omnibus Bill will impact your business model or compliance programme? Get in touch with our team today to discuss your transition strategy.

 

—————-

Serge Sablyak, Senior Consultant, Former Director of AML/CFT at DIA

Serge Sablyak is the former Director, AML/CFT at the Department of Internal Affairs. He joined AML Solutions as a Senior Consultant in 2026. Serge brings more than 25 years of experience in policy, regulatory and compliance leadership roles, including in intelligence and security and the Justice Sector.

He was educated in the former Yugoslavia, the United Kingdom and at Victoria University of Wellington. He lives with his family in Wellington.