Eli Hylands of Christchurch crypto exchange Flow Crypto NZ on what the current AML/CFT rules cost a very small business, which of them stop crime, and why one undefined word in the Omnibus Bill matters

By Eli Hylands* 

Whoever forms the next government inherits an unfinished job. The AML/CFT (Omnibus) Amendment Bill was introduced in the last weeks of the previous Parliament, and it lapses unless the incoming government picks it up. 

The Bill was described by its minister Nicole McKee as the most substantial reform of the anti-money laundering law since it passed in 2009. Its promise is regulation based on actual risk rather than box-ticking. 

I have a narrow but recent view of why that matters. I run Flow Crypto NZ, a crypto exchange in Christchurch that opened in September. I am also its AML compliance officer, I wrote its software, and I review every customer application myself. 

This is not an argument against the regime. Crypto is a high-risk sector, scammers and launderers use it, and a broker that cannot show who its customers are should not be in business. My argument is that the current rules ask the same of a start-up as they do of a bank, and that the Bill could make this better or worse depending on details nobody has written yet. 

Almost a year before the first customer 

Before we could serve one customer we had to register on the Financial Service Providers Register, join an approved dispute resolution scheme, write a risk assessment and an AML/CFT programme, and come under Department of Internal Affairs supervision. The formal steps were quick once we were ready. We incorporated in March, registered and joined the dispute scheme in July, completed onboarding with the DIA in August and opened in September. The work behind them took almost a year.

Most of that time did not go on forms. A risk assessment has to set out every way a business like ours could be used to launder money or finance terrorism. The programme then has to say, in writing, how we verify customers, when we ask for more, how we monitor transactions, what we report, how we keep records and how we train people.

Then all of it has to be built into the product. A written policy that says we screen every transaction is worthless unless the software does it. 

The list of obligations is the same whether you have 50 customers or five million. What changes is the cost per customer. A bank spreads it across a compliance department. A start-up spreads it across its founder. 

There is also a sequencing problem. Banks, reasonably, want to see a finished programme before they will open an account for a crypto business. So nothing can be tested with real customers, or earn a dollar, until everything is done. 

Where the money goes 

Two months after opening, compliance is still our biggest expense. Three things drive it. 

Fixed fees. Registration, levies and dispute resolution scheme membership all fall due before a business has any revenue. They are a small line for an established firm and a large one for a firm with no customers.

Identity verification. Every customer has to be matched to a government-issued identity document and shown to be a real, present person. The quotes we received for essentially that same check differed by a staggering amount. Many providers do not publish prices, so a founder learns the market one sales call at a time.

Time. The largest cost is not on any invoice. Every hour a founder spends on compliance is an hour not spent on the product or on customers. This matters beyond one company. Compliance cost is a barrier to entry, and the higher it is, the fewer local providers there are. Inland Revenue has estimated that about 80% of New Zealanders' crypto activity goes through offshore exchanges. Those are platforms our regulators cannot supervise, and they do not answer to a New Zealand dispute scheme. 

What works, and what mostly adds cost 

Some of what the law requires clearly works. Verifying who a customer is works. Asking where money came from when a purchase does not fit the person works. Watching transactions and having a human look at anything odd works. 

In our first two months those checks have done their job. We have declined applications where the person applying did not appear to be the person in control of the account. That is what a scam in progress often looks like, and the moment before payment is the last chance to stop it.

Other requirements mostly produce paper. Low-risk facts have to be verified to the same depth for every customer. A person buying a small amount from a bank account in their own verified name starts from the same baseline as someone moving a large sum. Much of the documentation exists to satisfy an audit rather than to stop a crime. 

The reform programme has already fixed some of this. Earlier changes removed mandatory address verification. The Omnibus Bill goes further and would let a business apply simplified checks where it has reasonable grounds to assess the risk as low. 

That is the right direction, with one warning. The Bill also raises penalties and adds an infringement regime. Lawyers at Simpson Grierson have asked whether the reforms lift the burden or shift it into case-by-case judgement that smaller entities may struggle to operationalise. 

A bank can pay for a legal opinion on what low risk means. A small firm cannot, and will keep doing full checks on everyone rather than risk a fine. The flexibility will only reach small businesses if the DIA publishes worked examples they can rely on. 

There is a second catch for crypto. The sector starts from a high-risk rating, so the relief may be smaller for us than for other businesses unless the guidance says when a crypto customer can be treated as low risk.

The cash question 

The part of the Bill aimed most directly at crypto is a new limit on buying or selling it with cash. 

In 2025 Cabinet agreed in principle to ban crypto ATMs. In July this year it dropped the ban in favour of a power to restrict cash transactions for virtual assets by regulation. The Bill would make it an offence to knowingly or recklessly buy or sell virtual assets with cash above a threshold. The threshold is not in the Bill. The Ministry of Justice plans to consult on it in early 2027. 

I support a limit on cash. Cash is anonymous, and a machine that turns it into crypto in minutes suits both launderers and the scammers who coach victims to a kiosk. Australia's regulator, AUSTRAC, found that people over 50 accounted for almost 72% of crypto ATM transactions by value. It now caps cash deposits and withdrawals at those machines at A$5,000. 

A limit also works where identity checks cannot. In most scams the victim is a real person sending their own money, so they pass every check. Controls at the point of payment are the ones that can stop the money leaving. 

We do not accept cash at all. Every payment comes by bank transfer from an account in the customer's verified name.

My concern is scope. Ministers have talked about cash throughout. But the threshold, what counts as a series of related transactions, and which assets are treated as high risk are all left to regulations that do not exist yet. Some published summaries of the Bill describe the offence simply as buying or selling virtual assets above a threshold. 

The difference matters. A bank transfer is already identified, traceable and screened twice, once by the bank and once by the broker. A limit that reached bank-funded purchases would add nothing to the fight against cash laundering. It would send larger buyers to offshore platforms, where New Zealand's protections do not follow them.

What the next government should do 

1. Pick up the Bill. The risk-based changes are worth having, and letting it lapse would leave small firms on the old settings for years. 

2. Say "physical cash" in the law. The cash limit should apply to notes and coins, and the Act should say so plainly rather than leave it to regulations. 

3. Publish small-business guidance before the law starts. The Bill would take effect one year after Royal assent. Worked examples of low-risk customers need to exist before then, not after. 

4. Look at the fixed costs. Fees and levies that fall due before a firm has a customer should scale with its size. 

None of this weakens the regime. It points the effort at the places crime happens, and it makes it possible for a New Zealand business to do the job properly and still exist. 

*Eli Hylands is the founder and AML compliance officer of Flow Crypto NZ, a New Zealand-owned crypto broker based in Christchurch. Flow Crypto is registered on the Financial Service Providers Register, is a member of the FDRS dispute resolution scheme and is supervised by the Department of Internal Affairs for AML/CFT purposes. This article is general information, not financial or legal advice.