Review of the AML/CFT Act

The two most common databases to verify name and date of birth are NZTA and DIA. These API verification services are inappropriately expensive, and should be freely available for accredited parties.

This change would remove a significant direct cost from AML compliance. It would align with the incoming consumer data right regulations, which recognise that consumers should have simple digital access to data that organisations hold about them. And it would make our economy more competitive by reducing switching costs.

Address verification has proven to be difficult for both reporting entities and consumers. The main reason is that, unlike using databases such as NZTA and DIA to verify name and date of birth, there is no high quality address database with broad coverage in New Zealand. This leads to customer dropoff and disproportionate resources being allocated to manually verifying addresses.

After a customer’s name and date of birth have been verified from an independent and reliable source, address verification does not materially increase the confidence of correctly verifying that customer’s identity. In addition, typical methods of manual address verification, such as bank statements or utility invoices, are very simple to forge. So a criminal with any level of sophistication will easily navigate the address verification requirement. 

Address verification has not proven to be materially useful from an enforcement perspective. So it does not deliver material value for either identity verification nor enforcement.

Akahu provides address verification services, so we benefit from the status quo. However the costs of address verification far outweigh any benefits, and it should be removed as a legislative requirement.

A practical way to control ML/TF risk is for a reporting entity to restrict the entry and exit point of funds from each customer. For example a reporting entity (“KiwiSaverCo”) could choose to only accept funds from a New Zealand bank account that is verified as being in the name of the customer.

In this type of scenario, both the bank and KiwiSaverCo carry out the customer due diligence process. But if KiwiSaverCo’s products present no greater risk of ML/TF than the customer’s bank account, then KiwiSaverCo is duplicating the customer due diligence process for no extra gain. The result is unnecessary costs, and lower rates of switching by customers.

There should be flexibility in the regulation to avoid this type of unnecessary duplication. This could be achieved through:

• Better reliance framework: We support the progress already underway with the digital identity trust framework, and see that as a good mechanism to both enable reliance and reduce privacy risks. 
• Better class exemptions: We support the use of class exemptions when appropriate.
• Better ability to utilise simplified customer due diligence: We suggest that the simplified due diligence provisions are reviewed to consider whether they can be more practically applied for low risk customers and transactions.