If you've been told you need to file an AML/CFT annual report with the Department of Internal Affairs (DIA) and you've gone looking for what's actually in the form, you've probably found a 2021 user guide, a regulation reference, and not much else. This is a plain-English walkthrough of Schedule 2A — the prescribed form for DNFBPs (real estate agents, lawyers, conveyancers, accountants and trust and company service providers) — part by part, with the traps DIA itself has flagged.
The window and the channel
The report covers the year from 1 July to 30 June, and must be submitted between 1 July and 31 August of the following year. DIA's own wording is unambiguous: "The Department is unable to grant any extensions."
Filing happens through AML Online (aml.dia.govt.nz) — not Hinekōrako, which is a different DIA portal used for other purposes. Login is via RealMe, and a recent change is worth knowing: a RealMe login with two-factor authentication is now sufficient — a fully verified RealMe identity is no longer required. DIA specifically notes this "enables compliance officers based overseas to use AML Online." New users need DIA to send an activation link, and a compliance officer can delegate access to a team member or an external AML consultant — each delegate needs their own activation link. You can save progress mid-form, and previously submitted reports remain viewable.
The prescribed form is Schedule 2A of the AML/CFT (Requirements and Compliance) Regulations 2011. It has six parts. Note a naming quirk before you start: DIA's own website describes the report as five parts, folding the sector-specific questions and exemption section together differently than the regulation does. Schedule 2A and the official DNFBP User Guide both use six — that's the structure below, and it's the one that matches what you'll actually see in AML Online.
Part 1 — Business contact details and organisation structure
The mechanical section: the period the report covers; your legal name, entity type, registration/incorporation number and trading names; physical and postal addresses; your compliance officer's name, contact email, phone and website; and a sector tick-list (accounting practice, bookkeeping, barrister sole, barrister and solicitor, law firm, incorporated conveyancing firm, conveyancing practitioner, real estate agent, trust and company service provider, or other). If you're a branch or subsidiary of an offshore parent, or have overseas offices or subsidiaries yourself, that's disclosed here too, along with headcount and NZ office locations.
Nothing here is difficult, but get the sector tick-list right — it drives which sector-specific questions appear in Part 4.
Part 2 — Designated business group, risk assessment and programme
This is where the substance starts. If you're a member of a designated business group (DBG), you say so, and either complete this part yourself or name the DBG member completing it on your behalf — in which case you leave the rest of Part 2 blank and move to Part 3. You remain responsible for the information regardless of who submits it.
Then two parallel question sets, one for your risk assessment and one for your AML/CFT programme:
- Does your risk assessment meet the statutory requirements (s.58) — meets all / meets some / meets none? If "meets some," you list every non-compliant subsection by number.
- When was it last internally reviewed? Has it been independently audited, and when? Did the audit find deficiencies, and have you fixed them — "Yes, complete" or "Not yet complete," with an explanation either way?
- Did you introduce a new regulated service, product or channel during the year that your risk assessment doesn't yet cover?
The programme questions mirror this structure (does it meet s.57 in full, some or none of its requirements; audit history; deficiencies and remediation), then add operational detail: do you have procedures to identify and verify a new customer including their beneficial owners, an occasional customer, or an existing customer where you now hold insufficient information after a material change? Do you outsource customer due diligence to third parties? Do you use electronic account-monitoring processes?
Where firms get caught: DIA has said directly that generic, templated answers here are a compliance risk, not just a box-ticking shortcut:
"Your programme should be specific to your business. The use of a template may be a good starting point to develop your programme. However, the Department considers that generic procedures, policies and controls not based on your risk assessment, and/or not tailored to your ML/TF risks, are unlikely to comply with the Act."
There's also a change worth knowing if your risk assessment predates mid-2026: since 19 May 2026, a compliant risk assessment must incorporate relevant risks identified by DIA's own Sector Risk Assessments and the Financial Intelligence Unit's National Risk Assessment. A risk assessment written before that date, however good it was at the time, is now non-compliant on its face if it doesn't reference the current SRA and NRA for your sector.
Part 3 — Products, services and customers
Section A is mandatory for every DNFBP, and it's the part that actually determines whether you're in scope for specific obligations at all. It asks whether you: act as a formation agent of legal persons (with banded counts by entity type); hold nominee director, nominee shareholder or trustee roles; provide registered office or correspondence address services; manage client funds, accounts, securities or other assets (with banded values); carry out real estate agency work to effect a transaction; and engage in or instruct on conveyancing, REAA transactions, transfer of beneficial interest in land, buying or selling a business or legal person, or creating/operating/managing a legal person — with a banded total value for that last group.
Section B is an optional eleven-item list covering financial activities from deposit-taking through to life insurance — most DNFBPs won't need it. Section C asks whether you accept cash and what proportion of your business involves it, and whether you send or receive funds internationally, again with banded values plus your three most common products or services.
The final block asks how many customers you conducted customer due diligence on this year, how many of those were PEPs (or beneficially owned or controlled by one), trusts or personal-asset-holding vehicles, overseas government bodies, and residents versus non-residents. It closes by asking you to rank the methods you use to meet new customers — face-to-face, non-face-to-face, domestic or overseas intermediaries.
Part 4 — Sector-specific questions
Every DNFBP answers whether it incorporates companies or forms trusts outside New Zealand, the most common jurisdictions used, whether it handles receipt and transmission of client money, manages client bank accounts, and whether it provides regulated services to other DNFBPs domestically or overseas.
Real estate agents, conveyancing practitioners, and lawyers doing conveyancing get three additional questions: have you received cash as part of a real estate transaction, how often and how much; do you provide residential property sales or services; do you provide commercial property sales or services, and if both, what's the split.
Part 5 — Ministerial exemption
Two questions, only relevant if they apply to you: have you been granted a ministerial exemption subject to conditions, and if so, describe your compliance with each one.
Part 6 — The declaration, and why it matters more than it looks
This is a single signed statement, but it's the part with a criminal offence sitting behind it:
"I confirm that I have the authority to submit this form on behalf of the reporting entity. I have reviewed the answers and information and I confirm that I am satisfied that, to the best of my knowledge, after undertaking all reasonable inquiries, all answers are true and correct."
DIA attaches a reminder here citing s.103 of the Act — it's an offence to provide information to an AML/CFT supervisor knowing it to be false or misleading in any material respect. This is not a formality. It's the reason to treat every earlier part of the form as something you'd stand behind, not something completed to get the form submitted.
One thing DIA has not published: a documented process for amending a report after it's been submitted. If you can't complete or submit before the 31 August deadline, or need help with the form, DIA's own instruction is to email amlcft@dia.govt.nz before the deadline — not to file something you know is wrong and fix it later.
Glossary
- Schedule 2A — the prescribed annual report form for DNFBPs under the AML/CFT (Requirements and Compliance) Regulations 2011.
- DNFBP — designated non-financial business or profession: real estate agents, lawyers, conveyancers, accountants and trust and company service providers.
- AML Online — DIA's online portal for filing the annual report, at aml.dia.govt.nz.
- RealMe — the government identity verification service used to log in to AML Online.
- DBG (designated business group) — related reporting entities that can share parts of a single AML/CFT programme and report.
- PEP (politically exposed person) — a customer holding, or connected to someone holding, a prominent public position, requiring closer scrutiny.
- SRA / NRA — DIA's Sector Risk Assessments and the Police Financial Intelligence Unit's National Risk Assessment, both of which now must feed directly into a compliant risk assessment.
- s.103 — the AML/CFT Act provision making it an offence to knowingly provide false or misleading information to a supervisor.
FAQ
Is the annual report the same thing as the risk assessment and programme? No. The risk assessment and programme are documents you're required to hold and keep current under ss.57 and 58. The annual report is a separate filing that asks about them — whether they meet the statutory requirements, when they were last reviewed and audited — plus your business and customer data for the year.
Why does DIA's website describe five parts when the regulation has six? The web page describes the AML Online user interface's own labelling; Schedule 2A and the DNFBP User Guide, which are the authoritative source for the form's actual content, use six parts. The substance is identical either way — just be aware of the mismatch so you're not confused mid-form.
Do I need to complete Part 2 if I'm in a designated business group? Only if you're the DBG member responsible for it. If another member completes Part 2 on the group's behalf, you name that member, leave Part 2 blank, and complete everything else — but you're still responsible for the accuracy of what they submitted.
What does "meets all / meets some / meets none" actually check? Whether your risk assessment and programme satisfy the specific statutory subsections (s.58 for the risk assessment, s.57 for the programme). If you tick "meets some," you have to list exactly which subsections you don't yet meet — there's no vague middle answer.
We've never had our risk assessment or programme audited. What do we put? Answer honestly — the form asks directly whether it's been independently audited and when. Independent audit is a separate statutory obligation (every three years, or four if DIA notifies you of a longer period) — being behind on it doesn't stop you from filing the annual report, but it is something DIA will see.
Can my accountant or an outside AML consultant complete this for me? The compliance officer can delegate access to a team member or an external consultant, each of whom needs their own DIA activation link. The declaration in Part 6, though, has to be made by someone with authority to submit on the reporting entity's behalf.
What happens if I get an answer wrong by mistake, not deliberately? The s.103 offence requires knowing the information is false or misleading — an honest mistake caught and disclosed is a different situation to knowingly filing something wrong. Either way, DIA hasn't published an amendment process, so the safer route is getting it right the first time and contacting DIA directly if you discover an error.
Do the sector-specific questions in Part 4 change depending on my sector tick-list in Part 1? Yes — that's exactly why getting the sector tick-list right in Part 1 matters. Real estate agents, conveyancing practitioners and lawyers doing conveyancing get three additional questions in Part 4 that other DNFBPs don't see.
Is the declaration in Part 6 a formality, or does someone actually check it? Treat it as real. It's a personal, signed confirmation that you've made all reasonable inquiries and believe the answers are true and correct, with a named criminal offence attached to knowingly getting it wrong.
Working through Schedule 2A properly means your risk assessment, programme and the report itself all say the same thing — which is exactly what an auditor checks for. Deplexify's NZ AML/CFT service builds all three together, tailored to your sector, not from a generic template.