Summary

• DIA has published an updated Sector Risk Assessment for accounting practices, replacing earlier sector guidance
• Trust and company services and managing client funds via trust accounts are rated medium-high risk, above the rest of the services offered in the sector
• DIA is flagging sector-wide gaps such as inconsistent monitoring and record keeping, weak enhanced due diligence procedures, and low suspicious activity reporting
• A client you know personally isn’t automatically lower risk, and insider threat is called out specifically
• Firm-level factors (size, client types, delivery channels, countries, institutions) matter alongside the services you offer
• Reporting entities are required to have regard to the SRA when updating their own risk assessment

DIA (Department of Internal Affairs) has published an updated SRA (Sector Risk Assessment) for accounting practices. It replaces the earlier sector guidance and lays out, in detail, how criminals can misuse accounting services to launder money or fund terrorism.

If you’re a reporting entity, the AML/CFT Act requires you to have regard to it when you conduct or update your own risk assessment. Here’s what’s in it, and what it means in practice.

Why accountants show up in this document at all

DIA calls accounting practices ‘gatekeepers’. The services that make accountants useful to clients (setting up structures, managing trust funds, overseeing finances) are the same services criminals look for when they need to move or hide money. That’s the opportunity DIA is describing.

There are 1,444 known accounting practices currently registered as reporting entities in New Zealand. That covers everything from sole practitioners to large firms, so the level of actual risk varies a lot depending on what your practice does and who you work with.

 

The services DIA is treating as highest risk

The SRA names specific services and expects firms offering them to assess that risk directly:

• Trust and company services
• Trust accounts
• Insolvency practice
• Managing client funds, accounts, securities, or other assets

Trust and company services stand out here. They’re rated medium-high for both terrorism financing and proliferation financing, higher than other services provided in the sector. If this is part of what you offer, it requires specific attention in your risk assessment rather than folding it in in with everything else.

 

 

What DIA says the sector is getting wrong

The document doesn’t stop at naming risky services. It calls out specific patterns DIA is seeing across the sector:

• Firms with a risk assessment and compliance programme in place aren’t always following it, particularly around monitoring, examining, and keeping written records for high-risk clients or transactions
• Enhanced due diligence isn’t consistently applied when the risk level calls for it
• Reporting of suspicious activity from accountants has been low, and DIA reads that as under-reporting rather than a genuinely quiet sector

Not every firm has an issue here. But DIA is actively looking for these gaps, and a risk assessment on paper that doesn’t match what your firm does day to day is exactly the kind of thing that gets picked up.

 

Behavioural red flags worth knowing

The SRA also sets out client behaviours to watch for, separate from which services you provide. A few examples:

• A client who avoids face-to-face meetings, pushes for unusual speed on a transaction, offers fees well above what the work justifies, or can’t give a clear commercial reason for what they’re asking you to do.
• Another one to note: a client asking whether something would need to be reported to authorities.

These are factors to consider, particularly when related to a higher-risk service. That is the point to pause and look closer.

 

Don’t assume you know someone

DIA says plainly that a client you know personally, or someone referred by a friend or trusted associate, isn’t automatically lower risk.

There’s also a note on insider threat: staff or associates who understand your AML/CFT programme well enough to work around it, whether deliberately or not. Check whether your risk assessment identifies this and if your programme addresses any identified risks.

 

It’s not just about the services you offer

Beyond the service ratings, firms must assess risk across five areas about their own business operations when building a risk assessment: nature, size and complexity, the types of clients they deal with, how services are delivered, which countries are involved, and which institutions they deal with.

For example, a large practice with decentralised offices and layered internal structures carries more risk than a small one with a tight governance framework. Similarly, a firm dealing mostly face to face with local clients carries less risk than one that takes on clients remotely with no in-person contact at all.

Where to start

DIA’s own guidance boils the process down to a few steps:

1. Read the risks that apply to your services, especially if you offer trust and company services, facilitate client transactions via your trust account, or manage client funds, accounts, securities or other assets.
2. Check those risks against your client base and how you deliver your services.
3. Update your risk assessment and compliance programme based on what you find, rather than just noting the SRA exists.
4. Revisit periodically rather than a one-and-done update. Risk changes over time, and so does guidance.

The reading part is usually the easy bit. Turning it into a risk assessment and programme that holds up under review is where most firms get stuck, especially if nothing’s been touched since before this SRA came out, or if you’re not entirely sure your day-to-day processes match what’s written down.

If you want to talk through what this means for your specific services and client base, our AML consultants are happy to have that conversation.

Talk to our consultants

 

---

Shane Cox, Senior Consultant, CAMS, MSc

Shane is a Certified Anti-Money Laundering Specialist (CAMS) with extensive experience in compliance, risk management and financial technology. He has worked across the payments and finance sectors in roles that have developed his expertise in the practical implementation of AML/CFT obligations.

Shane holds a Master of Science degree in Strategic Management and Innovation. He undertakes audits as well as the development and enhancement of compliance documentation, with a focus on pragmatic solutions that balance regulatory requirements with business needs.