Customer due diligence and enhanced due diligence in practice

The Anti-Money Laundering and Countering Financing of Terrorism Act 2009 is written as a set of outcomes rather than a list of searches. It tells a reporting entity what it must know and be satisfied of, and leaves the means largely open. That drafting is deliberate, and it is also why so many due diligence files contain a lot of documents and not much evidence.

This maps the outcomes onto the records that actually support them for New Zealand customers.

Standard customer due diligence

Identity, verified independently

The obligation is to obtain identity information and then verify it on reliable and independent sources. Two words carry the weight. Independent means not supplied solely by the customer. Reliable means the source is one a third party would accept.

Documents supplied by the customer start the process; they do not finish it. Corroboration against records the customer does not control is what completes it. The general approach is set out on the identity verification page and in verifying an identity without breaching privacy.

The entity, and who stands behind it

For a company customer the register supplies existence, status, directors and shareholding. Read the annual return history and any previous names while you are there, for the reasons set out in how to search a company and its directors.

The register will frequently stop one layer short. Where shares are held by a trustee company or a holding company, identifying the natural person requires following the structure, which is the subject of beneficial ownership.

Authority to act

Where someone acts on the customer's behalf, both their identity and their authority need to be established. A person who is neither a director nor a shareholder giving instructions is a legitimate arrangement and a documented one, not something to be assumed from familiarity.

Nature and purpose of the relationship

This is the outcome most often reduced to a tick box, and the one that gives every later monitoring alert its meaning. Without a recorded expectation of what the relationship is for, there is no baseline against which anything can be unusual.

Enhanced due diligence

Enhanced due diligence applies where risk is higher, including trusts and certain other vehicles, politically exposed persons, and relationships flagged by the entity's own risk assessment. It adds two things: enquiry into source of wealth or source of funds, and more senior sign off.

Source of funds is the origin of the money in the transaction. Source of wealth is how the customer came to have money at all. The second is the harder question and the one where register based evidence helps: property holdings, company interests and directorships build a picture consistent, or inconsistent, with the account given.

PEP determination sits alongside sanctions and adverse media screening, three checks that are routinely conflated. The distinctions are set out in adverse media, sanctions and PEP screening explained.

What a supervisor looks for

On review, the recurring findings are consistent: verification relying entirely on customer supplied documents, beneficial ownership stopping at a corporate shareholder, a nature and purpose field containing a single generic word, screening performed once at onboarding and never repeated, and no record of why a screening hit was discounted.

Each is a documentation failure rather than a judgement failure. The work was often done and simply not evidenced, which under an audit based regime amounts to the same thing.

Privacy obligations run alongside

AML obligations require collection; the Privacy Act 2020 governs how that collection behaves. Information gathered for due diligence is collected for that purpose and should be used for it, held securely, and retained for the period the AML regime requires rather than indefinitely by default. Recording the purpose with each search keeps the two regimes aligned, as described on the authorised-purpose controls page.

Compliance functions will find the wider workflow on the corporate and compliance page, and the statutory framework on the compliance page. Access is issued to verified professional users through the request access page.