The last six months has been a crazy time for the supervisors, and they have been a bearer of bad news to a lot of New Zealand AML/CFT reporting entities.
What this has meant for you
Formal warnings, desk based reviews and onsite visits. New Zealand AML/CFT supervisors have been all go. And out of nowhere right?
Wrong. The reality is, they too are being audited. The Financial Action Task Force (FATF) are coming back to New Zealand within the next few months in order to audit how effectively it is complying with global AML standards and principles. The onus is on the DIA, FMA, and RBNZ to demonstrate that they are taking action. So who’s left in the firing line?
That’s right, reporting entities like you. And we’re noticing that even issues such as the date of your section 59(2) independent audit report are becoming major compliance problems.
The Financial Markets Authority (FMA) issued ten formal warnings to reporting entities in May 2019. Five of these were due to reporting entities failing to have their Risk Assessment and Programme audited every two years, and the other five were due to the reporting entities not having their Risk Assessment audited in a “timely manner” of the two year period. Yikes.
What are the rules about the exact time you must have and complete your audit by? What do you do when there are so few qualified and independent compliance auditors to choose from?
We decided to pose this question to the AML/CFT supervisors themselves and get the answer straight, or at least we hoped. We asked them via email – what exactly is the meaning of “timely manner” for an AML/CFT independent audit?
The FMA came back to us with
“Businesses have two years from the date of their last AML/CFT audit to have their next audit completed. For example, if your first audit report had a date of 29 June 2015, then your next audit report date should be no later than 29 June 2017.”
“The sector supervisors are currently working on updating the triple branded guidance document relating to Audits. This issue will be covered in this updated guidance. At this time, I’m not able to provide any more detail in relation to this, as the review of the guidance is still ongoing.”
The DIA did not get back to us.
What we took from this
Your AML/CFT independent audit report must be completed before the two years is up from your previous audit date. This means, specifically, you must book your audit months in advance and allow around 12 weeks for your audit process. This will include; a desk based review of your AML/CFT documents, an onsite visit and a final independent AML/CFT Audit. We know this is different to what the majority of New Zealand reporting entities are currently doing. And as RBNZ mentioned, there could be a change in this guidance, or hopefully more clarification to come in the near future.
In the meantime we suggest making note of your last independent audit date and making sure your next AML/CFT independent audit is scheduled to be finalised before the two year period is up.
We will update you via our regulatory alert email when the new guidance is released. In the mean time, take a look and save the diagram we have provided below. This will give you an idea of the process and timeframes involved in getting your Independent AML/CFT Audit finalised in time.
Connect with Nina on LinkedIn.