New Zealand

Department of Internal Affairs (DIA): The primary supervisor for most VASPs under the AML/CFT Act 2009. This includes businesses involved in exchanging, transferring, holding, or safekeeping virtual assets.

Financial Markets Authority (FMA): Regulates financial markets, financial service providers (FSPs), and financial products. If a VA business offers services that fall under existing financial product definitions (e.g., derivatives, managed investment schemes, investment advice related to VAs), the FMA's licensing and oversight may be triggered.

Reserve Bank of New Zealand (RBNZ): Regulates banks, non-bank deposit takers (NBDTs), and insurers. Less direct oversight for pure crypto businesses unless they also engage in traditional banking or deposit-taking activities.

New Zealand Companies Office: Administers company registration.

AML/CFT Registration (DIA): Most crypto businesses, including exchanges, custody providers, and payment processors dealing with VAs, are categorised as "reporting entities" under the AML/CFT Act. This requires them to register with the DIA as a reporting entity and comply with comprehensive AML/CFT obligations. This is not a "license" in the traditional sense of permitting operation, but a mandatory registration for AML/CFT compliance.

Financial Service Provider (FSP) Licensing (FMA): If a VASP provides services that meet the definition of a "financial service" under the Financial Service Providers (Registration and Dispute Resolution) Act 2008 (FSP Act) – for example, giving financial advice, operating a managed investment scheme involving VAs, or dealing in financial products like VA derivatives – then they will need to license with the FMA. This involves more stringent requirements than just AML/CFT registration.

Primary Requirement: AML/CFT Reporting Entity Registration (DIA)

Businesses that exchange virtual assets for fiat currency, other virtual assets, or facilitate such exchanges are deemed "reporting entities" under the AML/CFT Act. This includes operating a trading platform.

DIA's guidance on who is a reporting entity: https://www.dia.govt.nz/AML-CFT-Reporting-Entities-Overview-Who-is-a-reporting-entity (specifically, look at DNFBPs and money or value transfer services).

Potential Secondary Requirement: FSP Registration/Licensing (FMA)

If the exchange offers derivatives (e.g., futures, options on VAs), manages client funds in a structured investment product, or provides regulated financial advice, then FSP registration and potentially an FMA license (e.g., a Market Services Licence or a Financial Advice Provider (FAP) Licence) would be required.

Financial Service Providers (Registration and Dispute Resolution) Act 2008: https://www.legislation.govt.nz/act/public/2008/0097/latest/DLM1514704.html

FMA guidance on FSP registration: https://www.fma.govt.nz/financial-service-providers/

Businesses that offer safekeeping services for virtual assets on behalf of customers (i.e., holding private keys or managing custodial wallets) are considered "reporting entities" under the AML/CFT Act.

Regulatory Reference: As above, AML/CFT Act 2009 and DIA guidance.

If the custody service is part of a broader investment scheme (e.g., a managed investment scheme where the provider also makes investment decisions or offers investment products), then FMA licensing would be necessary. Merely providing technical custody without any active management or investment component is less likely to trigger FMA licensing, but full AML/CFT compliance remains critical.

Regulatory Reference: As above, FSP Act 2008 and FMA guidance on managed investment schemes.

Businesses that transmit money or value using virtual assets, or facilitate payments in VAs, are typically classified as "money or value transfer services" under the AML/CFT Act and must register with the DIA.

Potential Secondary Requirement: Non-Bank Deposit Taker (NBDT) Registration (RBNZ) / FSP Licensing (FMA)

If the payment processor also accepts deposits of fiat currency from the public or issues e-money that is redeemable for fiat, they might fall under the RBNZ's NBDT regime. This is less common for pure crypto payment processors but important to consider if they bridge significantly with traditional fiat payment systems. Similarly, if they offer payment-related financial products, FMA oversight might be triggered.

Reserve Bank of New Zealand guidance on NBDTs: https://www.rbnz.govt.nz/regulation-and-supervision/nbdts

There are no specific minimum capital requirements under the AML/CFT Act for VASPs solely registered as reporting entities.

However, if an FMA license is triggered (e.g., Financial Advice Provider, Market Services Licence), then specific capital and solvency requirements will apply, often based on the nature and scale of the financial services provided. For example, FAPs must demonstrate adequate financial resources.

RBNZ NBDT licensing has significant capital requirements.

Mandatory and comprehensive for all reporting entities under the AML/CFT Act. This includes:

Risk Assessment: Developing a comprehensive risk assessment for money laundering and terrorism financing.

AML/CFT Programme: Establishing and maintaining an AML/CFT programme to detect, deter, and mitigate these risks.

Customer Due Diligence (CDD): Verifying identity for all customers, including beneficial owners. This ranges from standard CDD to enhanced CDD for high-risk customers or transactions.

Ongoing Monitoring: Continuously monitoring customer transactions and relationships.

Record Keeping: Maintaining records for 5 years.

Suspicious Activity Reports (SARs): Reporting suspicious activities to the Financial Intelligence Unit (FIU) of the NZ Police.

Appointing an AML/CFT Compliance Officer: An individual responsible for the AML/CFT programme.

Independent Audit: An independent audit of the AML/CFT programme must be conducted every two years.

DIA's AML/CFT guidance material: https://www.dia.govt.nz/AML-CFT-Reporting-Entities-Overview-Guidance

Required for AML/CFT reporting entities. A VASP must have a physical presence in New Zealand or be incorporated in New Zealand.

The AML/CFT Compliance Officer must be an individual residing in New Zealand.

For companies incorporated in NZ, at least one director must reside in New Zealand or Australia.

Company Registration: Register your business with the New Zealand Companies Office.

Develop AML/CFT Programme & Risk Assessment: Before applying for AML/CFT registration, you must have your comprehensive risk assessment and AML/CFT programme in place.

AML/CFT Reporting Entity Registration (DIA):

Submit your application to the DIA. This includes providing details of your business, ownership, and confirming you have a compliant risk assessment and AML/CFT programme.

URL: DIA's "How to register as a reporting entity": https://www.dia.govt.nz/AML-CFT-Reporting-Entities-Overview-How-to-register

FSP Registration (FMA, if applicable):

If your services meet the definition of a financial service, register as an FSP on the FSPR (Financial Service Providers Register).

If your FSP registration requires a specific license (e.g., FAP license, Market Services License), you will need to apply to the FMA through their online portal. This involves a detailed application, demonstrating capability, financial soundness, and compliance with specific regulatory requirements.

URL: FMA licensing information: https://www.fma.govt.nz/financial-service-providers/fap-licensing/ (for FAPs, similar processes for other licenses)

Ongoing Compliance: Maintain robust internal controls, comply with all reporting obligations, conduct regular independent audits (for AML/CFT), and stay updated with regulatory changes.

Managed Investment Products (MIPs): This is the most common classification for ICOs/tokens that resemble an investment contract. A product is an MIP if:

It involves contributions from people (investors) pooling their money.

The money is used to acquire, hold, or manage property (e.g., a project's assets, other cryptocurrencies).

The property is managed by a third party (the token issuer or project team) on behalf of the contributors.

The contributors derive a benefit from the management of that property (e.g., profits, returns, appreciation in value).

Connection to Howey: This definition strongly aligns with the "investment of money in a common enterprise with a reasonable expectation of profits to be derived from the entrepreneurial or managerial efforts of others" aspect of the Howey test. The key is the expectation of passive returns from the efforts of others.

Debt Securities: A token could be a debt security if it represents a debt owed by the issuer to the token holder, promising to repay a sum of money or yield a return (e.g., a bond-like token).

Equity Securities: Less common for typical crypto tokens unless it clearly represents an ownership interest in a company or venture, granting rights similar to shares (e.g., voting rights, share of profits/dividends).

Derivatives: A token could be a derivative if its value is derived from an underlying asset, index, or rate (e.g., futures contracts, options, swaps represented by tokens).

Other Financial Products: Less commonly, tokens might fall under other categories like Future Interests or Payment Instruments, though these are typically not classified as "securities" in the traditional sense but still fall under FMA oversight for other reasons (e.g., anti-money laundering).

Investment Tokens (Security Tokens): These are tokens explicitly designed to provide an investment return. Examples include:

Tokens that promise a share of future profits or revenue from a project.

Tokens that grant ownership stakes in a company or asset.

Tokens that function like a loan, promising interest payments or principal repayment.

Tokens that provide holders with a passive income stream derived from the management efforts of others.

Tokens that represent fractional ownership in real-world assets (e.g., real estate, art) where the value is managed by a third party.

Utility Tokens (with an investment motive): While a true utility token, whose sole purpose is to provide access to a product or service, is generally not considered a security, many tokens marketed as "utility" tokens at their initial offering stage are often found to have an investment motive. If investors purchase the token primarily with the expectation that its value will increase due to the issuer's efforts and they can later sell it for a profit, it's likely to be treated as a security, especially a Managed Investment Product. The FMA looks at the initial marketing and investor expectations.

Stablecoins (potentially): Depending on their structure, stablecoins can be classified in various ways. If they are managed by a third party with a view to generating returns for holders, or involve pooling of assets, they might be considered Managed Investment Products. If they offer a return or are debt-backed, they might be debt securities. The FMA is increasingly looking at stablecoins from a wider financial regulation perspective, not just securities law, due to their potential impact on financial stability and payment systems.

Offer Disclosure (Product Disclosure Statement - PDS):

Issuers must prepare and register a comprehensive Product Disclosure Statement (PDS) with the FMA. The PDS must contain all material information that a prudent investor would reasonably require to make an informed investment decision.

This includes details about the token, the project, risks, financial information, and the rights and obligations of token holders.

The PDS is a demanding document to produce and keep updated.

Governance Requirements (for Managed Investment Products):

If the token is an MIP, the issuer must appoint a licensed manager for the scheme.

The scheme itself must comply with strict governance rules regarding managing assets, reporting, and investor rights.

Fair Dealing: Issuers must comply with fair dealing provisions, prohibiting misleading or deceptive conduct.

Continuous Disclosure: For publicly offered securities, ongoing disclosure of material information may be required.

Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT): Token issuers might be considered "reporting entities" under the AML/CFT Act 2009, requiring them to implement robust AML/CFT programmes, conduct customer due diligence, report suspicious transactions, and maintain records.

Small Offers: Offers to a limited number of investors (e.g., generally up to 20 retail investors in any 12-month period for a total of up to NZD $2 million, subject to specific conditions under Schedule 1, Clause 19 of the FMCA).

Wholesale Investors: Offers made exclusively to "wholesale investors" (e.g., institutional investors, high net worth individuals, or large entities meeting specific financial thresholds under Schedule 1, Clause 3 of the FMCA). These investors are presumed to be sophisticated enough to not require a PDS.

Excluded Offers: Certain specific types of offers (e.g., offers to employees, certain overseas offers) are exempt.

Market Operation: Any platform facilitating the trading of these tokens to the public in New Zealand may be considered a financial product market. Operating such a market requires a license from the FMA under the FMCA. This is a high bar, typically met by traditional stock exchanges.

Financial Service Provider (FSP) Registration: Businesses facilitating secondary trading (e.g., crypto exchanges) must generally be registered as a Financial Service Provider (FSP) under the Financial Service Providers (Registration and Dispute Resolution) Act 2008.

AML/CFT Compliance: Crucially, any business facilitating the exchange, transfer, or holding of convertible virtual assets (including most cryptocurrencies) for customers in New Zealand is deemed a "reporting entity" under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act). This requires them to implement comprehensive AML/CFT programmes, conduct customer due diligence, monitor transactions, and report suspicious activities to the Financial Intelligence Unit (FIU) of the NZ Police. This applies regardless of whether the token is classified as a security.

Fair Dealing and Market Conduct: FMCA's fair dealing provisions (prohibiting misleading or deceptive conduct) and market manipulation rules would apply to trading activities involving security tokens.

AML/CFT Breaches: The FMA (and the Department of Internal Affairs, which regulates many crypto FSPs for AML/CFT) has taken enforcement action against crypto service providers for failing to comply with AML/CFT obligations. For instance, the Department of Internal Affairs has issued formal warnings, imposed fines, and even sought civil penalties against crypto exchanges for inadequate AML/CFT systems. These actions underscore the regulator's expectation of robust compliance from anyone dealing in crypto.

Warnings and Public Statements: The FMA frequently issues public warnings about the risks of investing in speculative crypto-assets and reminds consumers and businesses of their legal obligations. They have issued specific warnings regarding "ICO" type offerings and unregistered financial service providers operating in the crypto space.

Unregistered Financial Service Providers: The FMA has investigated and taken action against entities providing financial services (including some crypto-related services) in NZ without being registered as an FSP. While not always directly related to an "unregistered security offering," it highlights the FMA's broad oversight.

Guidance and Education: A significant part of the FMA's "enforcement" in the crypto space has been through proactive guidance and education, making it clear that existing laws apply. This proactive stance aims to ensure compliance before breaches occur.

Financial Markets Conduct Act 2013 (FMCA):

FMA Guidance for businesses involved in Initial Coin Offerings (ICOs):

Financial Service Providers (Registration and Dispute Resolution) Act 2008:

Anti-Money Laundering and Countering Financing of Terrorism Act 2009: https://www.legislation.govt.nz/act/public/2009/0035/latest/DLM2140700.html

Financial Service Provider (FSP) Registration:

If the crypto-asset being held constitutes a "financial product" (e.g., a security, managed investment product, or a derivative) as defined under the Financial Markets Conduct Act 2013 (FMC Act), then providing custody services for it would likely require FSP registration and compliance with the FMC Act's requirements for custodians of those specific financial products.

If the service involves other regulated financial services (e.g., acting as a trustee or offering managed investment services that include crypto), FSP registration is required.

Financial Service Providers (Registration and Dispute Resolution) Act 2008: https://www.legislation.govt.nz/act/public/2008/0088/latest/DLM1419400.html

FMA Guidance on the Application of Financial Markets Law to Crypto-assets (Dec 2021): (You'll need to search the FMA website for the most recent version, typically under "Guidance notes" or "Publications"). The key takeaway is how a crypto-asset maps to existing financial product definitions. Example search result: https://www.fma.govt.nz/news-and-resources/media-releases/fma-releases-new-guidance-on-crypto-assets/ (This links to a media release about the guidance, the full guidance document is usually linked within or discoverable via FMA site search).

Custodial wallet providers and crypto-asset exchanges are explicitly designated as "reporting entities" under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act). This requires them to register with the Department of Internal Affairs (DIA) and comply with AML/CFT obligations, including customer due diligence, suspicious transaction reporting, and maintaining a robust AML/CFT programme.

DIA Guidance for Cryptoasset Reporting Entities: https://www.dia.govt.nz/AML-CFT-Reporting-Entities-Cryptoasset-Reporting-Entities

FMC Act Custodians (if applicable): If a crypto-asset service falls under the definition of a "managed investment scheme" (MIS) or other regulated financial product under the FMC Act, then the custodian requirements of that Act would apply. These requirements mandate strict segregation of client assets from the custodian's own assets, independent oversight, and clear trust arrangements.

Best Practice: Even where not explicitly mandated by law (e.g., for pure cryptocurrencies not deemed financial products), the FMA strongly advocates for robust client asset protection and segregation as a best practice for any entity holding assets on behalf of others. Failure to do so exposes clients to significant risks in case of insolvency or fraud.

Financial Markets Conduct Act 2013 (Part 4, relating to Managed Investment Schemes and custodians): https://www.legislation.govt.nz/act/public/2013/0069/latest/DLM2996906.html

FMA Guidance on Crypto-assets: Reiterates the importance of good governance and client asset protection principles.

No specific crypto custody insurance/bonding mandate.

FMC Act (if applicable): For entities regulated under the FMC Act (e.g., licensed MIS managers or custodians), there are general requirements for having adequate professional indemnity insurance and robust internal controls, but not a specific "bonding" requirement for crypto assets.

FSP Dispute Resolution Schemes: All registered FSPs must belong to an approved external dispute resolution scheme, which provides a mechanism for consumers to resolve disputes with the financial service provider. This is a form of consumer protection but not insurance for assets.

FMA Guidance on Crypto-assets: Encourages providers to consider their insurance coverage as part of robust risk management.

No specific cold storage mandate.

FMA Guidance / Best Practice: The FMA's guidance emphasizes the importance of robust cybersecurity, internal controls, and risk management for any entity holding digital assets. This implicitly includes the appropriate use of hot and cold storage solutions, multi-signature wallets, hardware security modules (HSMs), and secure key management practices to mitigate the risks of theft, loss, or unauthorised access. These are generally considered industry best practices rather than legal mandates.

FMA Guidance on Crypto-assets: Discusses operational risks and the need for robust security.

No specific "qualified custodian" definition for crypto-assets.

FMC Act Custodians: The closest equivalent in traditional finance is a "custodian" for a managed investment scheme (MIS) under the FMC Act. These custodians have specific duties, including independence from the manager of the MIS, oversight functions, and stringent regulatory requirements. Whether a crypto custody service would need to meet this standard depends on whether the underlying crypto-asset is deemed part of an MIS or another regulated financial product.

The FMA's guidance explores the functions of a traditional custodian under the FMC Act and how they might apply to crypto custody, particularly if the crypto-asset itself is considered a financial product.

Financial Markets Conduct Act 2013 (Part 4, Subpart 5 - Duties of custodians of MIS): https://www.legislation.govt.nz/act/public/2013/0069/latest/DLM2996906.html

Government Work Programme on Digital Assets: The New Zealand government, through various agencies including the Ministry of Business, Innovation and Employment (MBIE), Treasury, the Reserve Bank of New Zealand (RBNZ), and the FMA, is actively monitoring and considering policy responses to digital assets and the evolving financial landscape. This includes discussions around the future of money, central bank digital currencies (CBDCs), and potential prudential supervision frameworks for novel financial instruments and services.

RBNZ's Future of Money Programme: The RBNZ has been consulting on the future of money, including issues related to digital currencies and stablecoins. While not directly focused on custody, any changes to the definition of money or prudential regulation could indirectly impact how custody of digital assets is regulated.

Reference: RBNZ Future of Money Programme: https://www.rbnz.govt.nz/future-of-money

FMA's Ongoing Monitoring: The FMA regularly updates its guidance and may issue new warnings or take enforcement action as the market evolves. They maintain a watching brief on international developments.

Regulator: Department of Internal Affairs (DIA)

Violation Type: Significant breaches of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), including failures in customer due diligence, risk assessments, suspicious transaction reporting, and compliance programme.

Penalty Amount: NZD $2.3 million

Date: Infringement notice issued March 2024; public announcement May 2024.

Outcome: Coinstash admitted to the breaches and agreed to pay the penalty. The DIA noted this was the largest financial penalty issued under the AML/CFT Act for a single infringement notice.

Entity Targeted: Dasset Limited (now in liquidation)

Date: Infringement notice issued July 2023; public announcement August 2023.

Outcome: Dasset admitted to the breaches and agreed to pay the penalty. The company subsequently went into liquidation in October 2023, though the DIA noted the penalty was not the direct cause.

Regulator: Financial Markets Authority (FMA)

Entity Targeted: James Malcolm Allan (individual)

Violation Type: Operating an unregistered financial service provider, making misleading representations about financial products (including crypto-assets), and breaches of the Fair Trading Act 1986 and the Financial Service Providers (Registration and Dispute Resolution) Act 2008. Allan had been promoting investments via social media, purporting to offer high returns from trading shares and crypto-assets.

Penalty Amount: Permanent ban from providing financial services and from acting as a director or manager of any financial service provider. A pecuniary penalty of NZD $50,000 was also ordered.

Date: Decision issued and announced November 2022.

Outcome: The FMA successfully obtained orders from the High Court against Allan, resulting in the ban and penalty. This was a significant action against an individual promoting crypto-related investments without proper registration or disclosure.

The Financial Markets Authority (FMA) would regulate such stablecoins, requiring compliance with disclosure obligations, fair dealing provisions, and potentially issuer licensing.

Reference: Financial Markets Conduct Act 2013

New Zealand does not have a dedicated e-money or payment token legal framework distinct from general banking regulation.

The RBNZ's ongoing "Future of Money" work is actively exploring whether new legislation is needed for a specific "digital cash" framework (which could encompass well-backed stablecoins meeting certain criteria) or other forms of private digital money.

Currently, for a stablecoin to be considered "money" in a regulatory sense, it would likely need to fall under the Reserve Bank of New Zealand Act 2021 if it constitutes a systemic payment system or if its issuer were to become a licensed bank (which is a very high bar).

The RBNZ differentiates between commercial bank money, central bank money (potential CBDC), and "private digital money" (which includes stablecoins). They are considering regulating "private digital money" if it becomes systemic.

Reference: RBNZ - The Future of Money – A phased approach to a CBDC in New Zealand

Regardless of their classification under financial markets or banking law, entities dealing with stablecoins (e.g., exchanges, custodians) are generally considered Virtual Asset Service Providers (VASPs) and fall under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act).

This requires them to implement AML/CFT programmes, conduct customer due diligence, report suspicious transactions, and be supervised by the Department of Internal Affairs (DIA).

Reference: Anti-Money Laundering and Countering Financing of Terrorism Act 2009

No specific stablecoin reserve requirements exist under current New Zealand law, as there is no dedicated stablecoin regulation.

However, if a stablecoin were classified as a financial product under the FMC Act, the issuer would be subject to disclosure obligations regarding its backing assets, their custody, and auditing. This would ensure transparency for investors but does not impose a specific reserve ratio or type.

The RBNZ's "Future of Money" discussions strongly advocate for robust reserve requirements for any form of regulated private digital money. They emphasise 1:1 backing with high-quality, liquid assets, ring-fenced or held in trust, and subject to regular independent audits to ensure stability and liquidity. This indicates a likely direction for future regulation.

Reference: RBNZ - The Future of Money - Key policy considerations for stablecoins and other private digital money

No specific stablecoin issuer license currently exists.

However, licensing requirements depend on how the stablecoin is classified:

Banking License: If a stablecoin issuer were to engage in activities akin to deposit-taking and lending, they would likely require a registered bank license under the Reserve Bank of New Zealand Act 2021, which is an extremely stringent requirement.

AML/CFT Reporting Entity: All entities providing services related to virtual assets, including stablecoins, must register as a reporting entity with the DIA for AML/CFT compliance.

The RBNZ is considering a new licensing regime for "digital cash" issuers (which could include certain stablecoins) as part of its future framework, which would likely include specific prudential requirements.

No specific statutory redemption rights for stablecoins currently exist. Redemption rights are generally governed by the stablecoin's terms and conditions set by the issuer.

If classified as a financial product, general consumer protection laws and contract law would apply, potentially allowing recourse for breach of contract or misleading conduct (e.g., under the Fair Trading Act 1986).

The RBNZ's "Future of Money" work strongly advocates for guaranteed 1:1 redemption on demand for any regulated private digital money or "digital cash" to ensure public trust and stability. This would likely be a core component of any future dedicated stablecoin regulation.

No specific rules or regulations for algorithmic stablecoins.

The RBNZ and FMA are generally highly cautious regarding algorithmic stablecoins due to their inherent volatility and susceptibility to "bank runs," as demonstrated by past failures (e.g., Terra/LUNA).

It is highly unlikely that an algorithmic stablecoin would be considered suitable for any "digital cash" or "e-money" framework the RBNZ might develop, as they inherently lack the stable backing mechanisms central to the RBNZ's vision for reliable digital money.

Such stablecoins would likely face intense scrutiny and would almost certainly be classified as high-risk financial products (possibly derivatives or managed investment schemes) under the FMC Act, triggering significant disclosure and conduct obligations, or even prohibitions if deemed too risky for retail investors.

New Zealand does not currently have a Central Bank Digital Currency (CBDC). However, the RBNZ is actively researching and consulting on the potential introduction of a "digital cash" (a retail CBDC for New Zealand).

Complementary vs. Competitive: The RBNZ sees a potential digital cash as complementing, rather than replacing, private forms of money, including stablecoins. A CBDC would offer a risk-free, central bank-backed option alongside private innovations.

Regulatory Benchmark: The RBNZ's exploration of a digital cash provides a framework for evaluating and potentially regulating private stablecoins. The principles of stability, interoperability, consumer protection, privacy, and financial integrity being developed for a CBDC would likely heavily influence any future stablecoin regulatory framework.

Future of Payments: The RBNZ views both a potential CBDC and well-regulated private stablecoins as part of a broader evolution of New Zealand's payment landscape, aiming to enhance resilience, innovation, and competition.

Directly Binding: UN sanctions are directly implemented into New Zealand law via the United Nations Act 1946 and the Terrorism Suppression Act 2002.

Obligation for VASPs: VASPs are legally required to comply with all UN sanctions. This includes:

Asset Freezes: Immediately freezing the assets of individuals or entities designated under UN sanctions. This explicitly includes virtual assets.

Prohibition on Funding: Not making funds or economic resources available, directly or indirectly, to designated individuals or entities.

Reporting: Reporting any frozen assets or suspicious transactions involving sanctioned parties to the New Zealand Financial Intelligence Unit (FIU) and other relevant authorities (e.g., Police, Department of Internal Affairs - DIA).

Designated Entities & Individuals: The Ministry of Foreign Affairs and Trade (MFAT) publishes the official list of individuals and entities designated under UN sanctions that apply in New Zealand.

Designated Terrorist Entities (under Terrorism Suppression Act 2002): https://www.police.govt.nz/advice/warnings-and-safety/terrorist-organisations-and-designated-individuals

Not Directly Binding in NZ Law: OFAC sanctions are US federal law and are not directly legally binding on New Zealand entities unless those entities also have a nexus to the US (e.g., US citizens/residents, transactions in USD, using US financial systems, having a US parent company or subsidiary).

Practical Implications for VASPs: Despite not being directly legally binding in NZ, compliance with OFAC sanctions is highly advisable for VASPs due to:

Extra-territorial Reach: OFAC has significant extra-territorial reach. Transactions involving US persons, US-origin technology, or USD can fall under OFAC's jurisdiction, regardless of where the VASP is based.

Correspondent Banking: Many global banks (including those that might facilitate fiat on/off-ramps for VASPs) process USD transactions and are themselves subject to OFAC. They will often de-risk or terminate relationships with VASPs that do not screen against OFAC lists.

Reputational Risk: Associating with sanctioned entities, even indirectly, carries significant reputational risk.

Interoperability: Global crypto exchanges and services often operate across jurisdictions, making it practical to screen against global lists.

OFAC Sanctions List (SDN List): https://home.treasury.gov/policy-issues/financial-sanctions/sanctions-programs-and-country-information

Not Directly Binding in NZ Law: Similar to OFAC, EU sanctions are not directly legally binding on New Zealand entities unless there is a specific nexus to the EU (e.g., EU citizens/residents, transactions involving EUR, having an EU parent company or subsidiary).

Practical Implications for VASPs: For similar reasons as OFAC, New Zealand VASPs dealing with EU customers or interacting with EU financial systems are strongly advised to screen against EU sanctions lists to mitigate risks.

New Zealand Consolidated Sanctions Lists (from MFAT): These combine UN and autonomous sanctions.

Designated Terrorist Entities (from NZ Police, under Terrorism Suppression Act 2002):

Autonomous Sanctions (e.g., against Russia): Managed by MFAT and publicly available.

New Zealand Autonomous Sanctions against Russia: https://www.mfat.govt.nz/en/peace-security-and-extractive-industries/sanctions/new-zealand-autonomous-sanctions-against-russia/

Violation Type: Significant breaches of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), including failures in customer due diligence, risk assessments, suspicious transaction reporting, and compliance programme. Penalty Amount: NZD $2.3 million. Outcome: Coinstash admitted to the breaches and agreed to pay the penalty. The DIA noted this was the largest financial penalty issued under the AML/CFT Act for a single infringement notice.

Entity Targeted: Dasset Limited (now in liquidation). Violation Type: Significant breaches of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), including failures in customer due diligence, risk assessments, record-keeping, and the overall compliance programme. Penalty Amount: NZD $1 million. Outcome: Dasset admitted to the breaches and agreed to pay the penalty. The company subsequently went into liquidation in October 2023, though the DIA noted the penalty was not the direct cause.

Entity Targeted: James Malcolm Allan (individual). Violation Type: Operating an unregistered financial service provider, making misleading representations about financial products (including crypto-assets), and breaches of the Fair Trading Act 1986 and the Financial Service Providers (Registration and Dispute Resolution) Act 2008. Allan had been promoting investments via social media, purporting to offer high returns from trading shares and crypto-assets. Penalty Amount: Permanent ban from providing financial services and from acting as a director or manager of any financial service provider. A pecuniary penalty of NZD $50,000 was also ordered. Outcome: The FMA successfully obtained orders from the High Court against Allan, resulting in the ban and penalty. This was a significant action against an individual promoting crypto-related investments without proper registration or disclosure.

Outcome: Coinstash admitted to the breaches and agreed to pay the penalty. The DIA noted this was the largest financial penalty issued under the AML/CFT Act for a single infringement notice.

Outcome: Dasset admitted to the breaches and agreed to pay the penalty. The company subsequently went into liquidation in October 2023, though the DIA noted the penalty was not the direct cause.

Outcome: The FMA successfully obtained orders from the High Court against Allan, resulting in the ban and penalty. This was a significant action against an individual promoting crypto-related investments without proper registration or disclosure.