Deplexify
← Back to blog
Compliance25 September 2026·9 min read

The AML/CFT independent audit in New Zealand — when it falls due, who can do it, and what the auditor checks

A reporting entity supervised by DIA must have its risk assessment and AML/CFT programme independently audited every three years (four if DIA says so), or sooner if DIA asks. This explains what the section 59 audit covers, who is allowed to carry it out, what DIA's guideline expects from the report, and what to do once the findings land on your desk.

A reporting entity supervised by the Department of Internal Affairs must have its risk assessment and AML/CFT programme independently audited every three years, or every four years if DIA has told you that timeframe applies to your firm. That cycle has been in place since 2021. DIA can also require an audit sooner than the default, at any time, under section 59(2) of the AML/CFT Act. The audit is not a paperwork check — it tests whether your documents meet the Act's minimum requirements and whether your programme actually works day to day, not just on the page.

This matters most for the small accounting practice, law firm or real estate agency that set up its AML/CFT programme once, filed it, and has not looked at it since. The audit is the point where that gap gets found, either by your auditor or, later and more expensively, by DIA.

What section 59 requires

Section 59 of the AML/CFT Act creates two separate duties, and it is worth keeping them apart. Under section 59(1), you must review your risk assessment and AML/CFT programme on an ongoing basis, to keep them up to date, identify any deficiencies in how well they are working, and make the changes needed. That review is a standing obligation, not a once-off event.

Under section 59(2), you must also have that risk assessment and programme independently audited on a fixed cycle. This is the statutory obligation this article covers. Failing to review your risk assessment and programme under section 59, or failing to carry out a risk assessment under section 58 in the first place, is defined in the Act as a civil liability act — the audit and review duties sit inside the Act's civil liability regime, not off to the side as an administrative formality.

A separate provision, section 59A, applies to high-value dealers: their AML/CFT compliance is audited when the supervisor asks, rather than on the fixed cycle that applies to everyone else under section 59. If you are an accountant, lawyer, conveyancer or real estate agent reading this, section 59 is the one that applies to you.

How often the audit falls due

Requirement Detail
Default cycle Every three years
Extended cycle Every four years, only if DIA has notified you that timeframe applies
Earlier audit DIA can request one at any time under section 59(2)
Who confirms your cycle DIA — it notifies you if your audit is required more or less often than the three-year default

Three years is the default, not a guarantee. DIA has been clear that it will tell a reporting entity directly if its own audit timeframe is different from the default, so check what DIA has told your firm rather than assuming the general rule applies unchanged.

One change worth knowing about: from 1 July 2026, the Act's audit-cycle provisions were amended so that the timeframe is set by rules made under section 156B of the Act, replacing the previous mechanism under the AML/CFT (Requirements and Compliance) Regulations 2011. The instrument that sets the cycle has changed, so check DIA's current rules for your firm's cycle rather than relying on older guidance that still points to the 2011 Regulations.

What the audit covers

The audit looks at both halves of your compliance documentation.

Your risk assessment is audited against the requirements of section 58(3) of the Act — whether it identifies the risks your business actually faces, sets out how you will keep the assessment current, and lets you determine your level of risk. An auditor will also usually check that it covers each of the risk categories listed in section 58: the nature, size and complexity of your business; your products and services; your delivery methods; your customer types; the countries you deal with; and the institutions you use.

Your AML/CFT programme is checked against the minimum requirements in section 57 of the Act. The audit assesses whether the programme is functioning in practice as intended — whether your policies, procedures and controls are actually based on your risk assessment, and whether they were adequately designed and operated effectively throughout the audit period, not just at the moment the file was created.

Auditors can carry out either a reasonable assurance audit, which involves more testing and more depth, or a limited assurance audit, which costs less and gives a lower level of assurance. Choosing between them is a decision for your firm, weighed against your risk profile and what your supervisor expects to see.

The National Risk Assessment 2024

Since 19 May 2026, a reporting entity's risk assessment must incorporate the National Risk Assessment 2024, and your auditor will check that it has been. This closes a gap DIA flagged directly: its 2023 thematic review of 60 law firms, accounting practices and real estate agents found that risk assessments were too often generic, uncustomised templates that had not been adapted to the specific firm. A risk assessment that references the National Risk Assessment in name only, without applying it to your actual client base, delivery channels and geography, will not pass.

Who can act as your auditor

The audit must be carried out by an independent person, appointed by your firm, who is appropriately qualified to do the job. Independence has a specific meaning here: the person must not have been involved in building or maintaining your AML/CFT programme, and must not have carried out your risk assessment. An auditor who wrote your risk assessment cannot then audit it.

Beyond that, the qualification bar is lower than people often assume. The auditor does not need to be a chartered accountant, and does not need to be qualified to carry out financial audits. There is no regulating body for AML/CFT audit in New Zealand, and DIA does not hold or publish a list of approved or recommended auditors. Some auditors hold a CAMS or CAMS-Audit certification, but that is not a legal requirement.

What that means in practice: deciding who is independent and appropriately qualified is a business decision your firm has to make and be able to justify. DIA may ask you for evidence of how you assessed your auditor's independence and qualifications, so keep a note of why you chose them.

What DIA's audit guideline expects

An AML/CFT audit does not have to meet the auditing and assurance standards set by the External Reporting Board — it is a different kind of engagement from a financial statement audit, and does not need to look like one. What DIA does expect is that your independent audit advises on three things: whether you meet the minimum requirements for your risk assessment and programme, whether your programme was adequate and effective throughout the period covered, and whether any changes are required.

A sound audit report typically lands on one of two ratings where something is wrong: Partially Compliant, meaning some requirements have been met but further steps are needed, or Non-Compliant, meaning a requirement has not been met and immediate action is required. Areas where you are simply compliant are generally not called out in detail — the report is built to surface gaps, not to congratulate you.

DIA's own 2023 thematic review of independent audits across law firms, accounting practices and real estate agents found recurring weaknesses worth checking your own firm against directly: policies for verifying new customers' identities that did not align with the Identity Verification Code of Practice, weaknesses in politically exposed person (PEP) check procedures, and risk assessments that lacked analysis specific to the reporting entity. DIA also found that in some cases, firms had taken limited or no steps to fix the issues their own auditor had already identified — which matters, because DIA's expectation is that non-compliance or partial compliance found in an audit report must be considered and addressed, not filed away.

What to do with the findings

Once you have the audit report, the work is not finished — it has started. A sensible process looks like this:

  • Communicate the findings to your senior management team, not just the compliance officer.
  • Check the report for factual errors and put your comments on the findings on record before it is finalised.
  • Fix non-compliant areas promptly. The auditor's suggested method for fixing something may be one option among several, but the need to fix the underlying problem is not optional.
  • Your firm's annual AML/CFT report to DIA must take into account the results and implications of the section 59(2) audit — the audit feeds directly into what you report, not a separate exercise that sits beside it.
  • Keep records relating to your risk assessment, programme and audit for at least five years after they stop being used on a regular basis, and be ready to provide a copy of any audit to your supervisor on request.

A desk-based or on-site review carried out by DIA itself does not substitute for your independent audit obligation. If DIA has reviewed your firm, that is not the audit section 59 requires — you still need to commission one independently.

Getting this right also has a payoff beyond avoiding a bad rating. The Financial Markets Authority has said that a good-standard audit report influences its monitoring behaviour, and can reduce the need for direct engagement with a reporting entity under its risk-based approach to supervision. A thorough, honest audit — and evidence that you acted on it — is one of the clearest signals you can send your supervisor that your compliance programme is real.

Frequently Asked Questions

How often is an AML/CFT audit required in New Zealand? Every three years by default, or every four years if DIA has notified your firm that the extended timeframe applies. DIA can also request an audit sooner, at any time.

Who can be my AML/CFT auditor? Anyone independent and appropriately qualified, provided they were not involved in building your programme or carrying out your risk assessment. They do not need to be a chartered accountant or a financial auditor, and DIA does not maintain a list of approved auditors — choosing and justifying your auditor is your firm's decision.

Does the auditor need an AML/CFT qualification? No. There is no regulating body for AML/CFT audit in New Zealand. Some auditors hold a CAMS or CAMS-Audit certificate, but it is not a legal requirement.

What happens after the audit? You take the findings to senior management, correct any factual errors on record, fix anything rated partially compliant or non-compliant, feed the results into your next annual report to DIA, and keep the report on file for at least five years.

Can a DIA review replace my independent audit? No. A desk-based or on-site review by DIA is not a substitute for the independent audit your firm is required to commission.

Deplexify's AML/CFT service for accountants, law firms and real estate agencies offers a free annual report tool, the NZ$249 Report Pack, and the NZ$595 Compliance Pack, which writes your section 58 risk assessment and section 57 programme for you. If we have written your documents, we cannot also audit them — that would break the independence requirement above — so we point firms in that position to auditors who can do the job properly.

Sources

Want this done for you?
One call to scope out what we can take on straight away.
Book a call →