Self-custodial wallet / non-custodial software in New Zealand
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in New Zealand without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- AML/CFT Act 2009 obligations apply if the wallet publisher is deemed a 'reporting entity' — but a pure non-custodial software publisher that never holds, controls, or accesses private keys or user funds likely falls outside the AML/CFT Act's scope for reporting entities, provided no exchange, transfer, safekeeping, or transmission of virtual assets is conducted.
- If the publisher engages in any ancillary service that could be seen as 'money or value transfer' (e.g., built-in swapping via third-party APIs integrated into the wallet), it may trigger reporting-entity status under the AML/CFT Act and require registration with the Department of Internal Affairs (DIA).
- If AML obligations attach: must conduct a risk assessment, establish an AML/CFT programme, perform customer due diligence (CDD) including identity verification (full name, date of birth, address), beneficial ownership identification (25% threshold), ongoing transaction monitoring, sanctions screening, and suspicious activity reporting to the NZ Police FIU. No tipping off.
Key Restrictions
- The publisher must not hold, control, or access user private keys or funds — otherwise it would become a custodial VASP and be subject to mandatory DIA registration as a reporting entity.
- If the wallet software incorporates built-in exchange/swap services (e.g., DEX aggregator integration), the publisher may be deemed to be 'facilitating exchange' and trigger reporting-entity obligations under the AML/CFT Act.
- No specific consumer-protection or disclosure rules were identified in the provided facts that apply to pure software publishers (as distinct from financial service providers). However, general fair-trading obligations under the Fair Trading Act 1986 apply to all businesses including software publishers.
- If the publisher provides financial advice (e.g., investment recommendations within the wallet), FSP registration and FMA licensing may be triggered.
Key Risks
- Regulatory ambiguity: The DIA has not published definitive guidance on whether a pure non-custodial software publisher (with no custody, no exchange facilitation, no transmission) qualifies as a reporting entity — the line is untested in NZ enforcement.
- Enforcement precedent shows DIA and FMA are active in penalising crypto businesses for AML/CFT and FSP registration failures (Coinstash NZD $2.3M, Dasset penalty, James Allan USD$500k), creating a risk that an overly broad interpretation by regulators could catch wallet publishers.
- Even without formal classification as a reporting entity, the publisher may face pressure from payment providers, app stores, or banking partners to demonstrate AML compliance equivalent to a reporting entity.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Department of Internal Affairs (DIA): The primary supervisor for most VASPs under the AML/CFT Act 2009. This includes businesses involved in exchanging, transferring, holding, or safekeeping virtual assets.
AML/CFT Registration (DIA): Most crypto businesses, including exchanges, custody providers, and payment processors dealing with VAs, are categorised as "reporting entities" under the AML/CFT Act. This requires them to register with the DIA as a reporting entity and comply with comprehensive AML/CFT obligations. This is not a "license" in the traditional sense of permitting operation, but a mandatory registration for AML/CFT compliance.
Businesses that offer safekeeping services for virtual assets on behalf of customers (i.e., holding private keys or managing custodial wallets) are considered "reporting entities" under the AML/CFT Act.
Businesses that exchange virtual assets for fiat currency, other virtual assets, or facilitate such exchanges are deemed "reporting entities" under the AML/CFT Act. This includes operating a trading platform.
Businesses that transmit money or value using virtual assets, or facilitate payments in VAs, are typically classified as "money or value transfer services" under the AML/CFT Act and must register with the DIA.
Anti-Money Laundering and Countering Financing of Terrorism Act 2009: https://www.legislation.govt.nz/act/public/2009/0035/latest/DLM2140700.html
Entity Targeted: Dasset Limited (now in liquidation). Violation Type: Significant breaches of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), including failures in customer due diligence, risk assessments, record-keeping, and the overall compliance programme. Penalty Amount: NZD $1 million. Outcome: Dasset admitted to the breaches and agreed to pay the penalty. The company subsequently went into liquidation in October 2023, though the DIA noted the penalty was not the direct cause.
Violation Type: Significant breaches of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act), including failures in customer due diligence, risk assessments, suspicious transaction reporting, and compliance programme. Penalty Amount: NZD $2.3 million. Outcome: Coinstash admitted to the breaches and agreed to pay the penalty. The DIA noted this was the largest financial penalty issued under the AML/CFT Act for a single infringement notice.
Entity Targeted: James Malcolm Allan (individual). Violation Type: Operating an unregistered financial service provider, making misleading representations about financial products (including crypto-assets), and breaches of the Fair Trading Act 1986 and the Financial Service Providers (Registration and Dispute Resolution) Act 2008. Allan had been promoting investments via social media, purporting to offer high returns from trading shares and crypto-assets. Penalty Amount: Permanent ban from providing financial services and from acting as a director or manager of any financial service provider. A pecuniary penalty of NZD $50,000 was also ordered. Outcome: The FMA successfully obtained orders from the High Court against Allan, resulting in the ban and penalty. This was a significant action against an individual promoting crypto-related investments without proper registration or disclosure.
Financial Markets Authority (FMA): Regulates financial markets, financial service providers (FSPs), and financial products. If a VA business offers services that fall under existing financial product definitions (e.g., derivatives, managed investment schemes, investment advice related to VAs), the FMA's licensing and oversight may be triggered.
Potential Secondary Requirement: FSP Registration/Licensing (FMA)
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A pure non-custodial wallet software publisher that never holds private keys or user funds likely does not trigger VASP classification or AML obligations under NZ law, but incorporating any exchange, transfer, or transmission functionality could bring it within the DIA's reporting-entity regime, and the boundary is not clearly defined in regulation or enforcement precedent.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?