Lead signal
A 25 cent fee that outlived its terms cost a bank $1.73m and a public warning. Sanctions screening logic changed on 3 September, and both prudential and conduct regulators now expect boards to know exactly where AI runs.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Who counts as sanctioned has changed
- Who it affects
- banks screening customers, payments and counterparties against the Russia sanctions register
- What it can disrupt
- customer checks that only match names against the list, and miss someone acting for a sanctioned person
- Why it matters now
- Since 3 September, any dealing designed to get around sanctions is expressly banned, and relatives and associates count only if named on the register. More names were added on 7 August.
A 25 cent fee cost $1.73m
- Who it affects
- banks and deposit takers whose fee engines sit apart from the terms customers read
- What it can disrupt
- fee tables that kept charging after the terms were reworded around them
- Why it matters now
- Public warning issued 21 September. The fee ran from November 2017 to November 2023 before it was caught.
Boards must know where AI runs
- Who it affects
- banks under RBNZ and FMA supervision using AI anywhere in the business
- What it can disrupt
- AI use nobody has inventoried: vendor features, staff tools and code assistants outside the risk register
- Why it matters now
- Expectations already published. Boards and senior managers should know where AI is deployed and who owns the risk.
Indirect collection rules started in May
- Who it affects
- banks receiving customer data from brokers, partners and third-party referrers
- What it can disrupt
- data feeds from third parties that never trigger a notice to the person they describe
- Why it matters now
- Applies to personal information collected since 1 May 2026. Everything collected indirectly since then is already in scope.
Dormant accounts became a breach finding
- Who it affects
- banks with dormant online banking profiles and unactivated digital registrations
- What it can disrupt
- customer platforms with no process to check in on, close or purge accounts nobody uses
- Why it matters now
- Final report released 30 October. The Commissioner generally expects a check-in after 12 months of inactivity.
Fair outcomes can't be outsourced
- Who it affects
- banks and deposit takers distributing credit-related and add-on insurance
- What it can disrupt
- distribution oversight that never sees intermediary sales, cancellations, claims and complaints data
- Why it matters now
- Review published with feedback to participating insurers. The FMA expects the rest of the sector to self-assess against it.
Breach notified six months late
- Who it affects
- banks whose security incidents run through IT, outsourcers or group functions
- What it can disrupt
- incident response that treats cyber and privacy separately, so nobody asks whether to notify
- Why it matters now
- Decision published. The Commissioner expects notification within 72 hours of knowing a breach is notifiable.
Overseas policy, New Zealand problem
- Who it affects
- Australian-owned banks and NZ subsidiaries running group-wide privacy policies
- What it can disrupt
- collection notices and privacy policies inherited from a parent company that cite foreign law
- Why it matters now
- Decision published. The Commissioner signals targeted adverse comment, including to parent companies, when firms do not engage.
Personal emails on work systems count
- Who it affects
- banks handling access requests from current and former staff
- What it can disrupt
- access-request processes that skip personal email held in company mailboxes
- Why it matters now
- Case note published. Personal emails held on work systems can fall inside an access request.
AML supervision now carries a levy
- Who it affects
- banks and deposit takers supervised under AML/CFT law
- What it can disrupt
- budgets, payables and compliance calendars with no line for levy invoices, challenges or class changes
- Why it matters now
- Regulations in force since 8 October. Levies apply from the financial year starting 1 July 2027.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.