The AML/CFT Supervisors, led by the Department of Internal Affairs (DIA) published a discussion paper inviting submissions on an updated code of practice to replace the Identity Verification Code of Practice (IVCOP) issued under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (the Act).

The DIA has been directed by the Minister of Internal Affairs to prepare an updated IVCOP. The IVCOP review and update is part of a wider review of the AML/CFT regime being undertaken by the Government.

The Supervisors have identified proposals to update code of practice to replace the IVCOP in the discussion paper, which includes several questions that the Supervisors want feedback on to inform that update and help to shape policy proposals for the Government to consider.  

Submissions close on 19 January 2026. The discussion paper is available here and further resources for making submissions are available here.

Who needs to read it? Why?

All reporting entities which rely on the safe harbour conferred by the IVCOP should read the discussion paper and consider providing feedback.  

It is important that the policy proposals for a new updated code of practice given to the Government are adequately informed by reporting entities’ practical experience with the IVCOP and that they are workable.  

Reporting entities that rely on the IVCOP should also use the consultation to bring to the Supervisors’ attention any other issues relating to the IVCOP that are not discussed in the discussion paper.  

What changes to the IVCOP are the supervisors proposing

The discussion paper contains proposed options for potential amendments to the IVCOP to achieve the following objectives:

• Better provide for known new digital ways of verifying identity;

• Future proof the IVCOP to provide for unknown novel and new identity verification practices;

• Reduce regulatory burden for reporting entities subject to the Act; and

• Ensure New Zealand well placed to tackle organised crime and protect New Zealand’s international reputation as a trusted place to do business.

The consultation document is set out across nine proposals, which are summarised below.

IVCOP’s structure and verification pathways retained

The paper recommends keeping the IVCOP’s three current verification pathways, being original documents, certified copies, and electronic sources, and introducing a fourth pathway using an accredited Digital Identity Services Trust Framework (DISTF) provider (refer below). 

Documentary identity verification streamlined

• Part 1 of the IVCOP applies only for in-person name and birthdate verification using identity documents;

• The verifier must visually match the photograph to the presenter; and

• Signature requirements for overseas passports, bank documents, and NZ birth certificates are dropped; Kiwi Access and 18+ cards accepted as secondary ID.

Certified copy requirements clarified

• Certified copies allowed only when face-to-face original verification is not possible and the photograph on the copy must be clear;

• Entities must note why in-person verification was not possible and get the original “wet-ink” certified copy, or an electronic version meeting Contract and Commercial Law Act 2017 signature rules;

• Trusted referees only confirm the copy matches the original, not that it represents the customer’s identity, if delayed verification is used; and

• Overseas referees must be equivalent to NZ ones, and certification validity extended to six months.

Electronic identity more prescriptive

• Government-maintained databases (like DIA Confirmation Service and NZTA Driver Licence Verification Service) specified as reliable electronic sources;

• If the primary prescribed source provides sufficient information assurance, no need for a second corroborating electronic source; and

• E-passport chips in NZ and overseas passports accepted as reliable sources if validated by the issuing state’s public key.

New verification pathway using accredited DISTF provider

• Verification of name and birthdate (in-person or online) permitted via accredited DISTF provider if it offers level 3 “information” and “binding” assurance; and

• For in-person only, verification from an accredited digital identity credential or service only required to provide level 2 information and binding assurance if supported by a primary non-photographic identity document currently noted in the IVCOP.

IVCOP expanded to apply to high-risk customers 

IVCOP to apply to high-risk customers who are natural persons in the same way it applies to low or medium risk customers.

IVCOP clarified to apply only to originators of wire transfers that are new customers

Name and birthdate verification of a wire transfer originator not required if the reporting entity has already done so (as part of conducting CDD on the person as a ‘customer’), unless reasonable grounds to doubt the adequacy or veracity of the identity verification previously conducted.

‘Exception handling’ requirement expanded

• Exception handling procedures to cover all the IVCOP parts for any customer’s name/birthdate verification (not just Part 1 documentary);

• Reporting entities must consider legitimate reasons customers did not meet requirements and may waive the IVCOP requirements; and

• The IVCOP may include rules for cases when name/birthdate cannot be verified for other reasons, requiring equivalent or stronger verification based on risk level.

Risk-based verification of beneficial owner or persons acting on customer’s behalf

The discussion paper suggests three options for risk-based identity verification for beneficial owners/persons acting for a customer:

• Remove these requirements from the IVCOP;

• Apply the IVCOP requirements for high-risk customers only; and

• Full IVCOP requirements for high risk, but reduced requirements for lower risk customers.

Our view

This is a welcome update to the IVCOP. The proposals strike a sensible balance between modernising identity verification practices and maintaining robust safeguards against money laundering and terrorism financing. 

However, we think that allowing certified copies to be an available verification option only when a customer cannot physically attend the verification is too onerous. Rather it should be an option where is not “reasonably practicable” for the customer to physically attend, so that reporting entities that provide their products or services only through online means can continue to accept certified copies.

The inclusion of the Digital Identity Services Trust Framework as a fourth verification pathway should enable reporting entities to adopt more efficient digital identity solutions whilst maintaining strong assurance levels. The clarification of electronic identity verification requirements and the streamlining of certified copy processes should provide certainty and reduce compliance costs. The proposed extension of the IVCOP to high-risk customers will provide reporting entities with greater certainty about their obligations.

The most significant area for feedback is likely to be the proposals around beneficial owners and persons acting on behalf of customers. Reporting entities should carefully consider which of the four options best balances regulatory burden reduction with maintaining appropriate safeguards.

What next?

Reporting entities should review the proposals carefully and consider providing submissions, particularly on areas that affect their business models and customer onboarding processes. The Supervisors are holding webinars in December 2025 and January 2026 which will provide reporting entities with the opportunity to ask questions about the proposals.

The closing date for feedback is 19 January 2026. The Supervisors anticipate that a revised IVCOP will be published in April 2026.

If you have any questions in relation to the proposed changes to the IVCOP or are considering how these changes may affect your business and what submissions you should make, please contact one of our experts.

This article was co-authored by Olivia Maher, a Solicitor in our Financial Services team.