Lead signal
Climate reporting relief now hangs on the incoming government, while KiwiSaver balances above $40,000 bring closer scrutiny of fraud, fees and liquidity. Fee logic that drifts from the documents is the same exposure that cost a bank $1.73m.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
Bigger balances, closer scrutiny
- Who it affects
- KiwiSaver providers, scheme managers and their administrators
- What it can disrupt
- fraud detection, complaints handling and fee disclosure that cannot show outcomes as balances grow
- Why it matters now
- Annual report published with average balances above $40,000. Private assets and liquidity remain under scrutiny.
Climate reporting relief, for now
- Who it affects
- managed investment scheme managers and smaller listed issuers in the climate regime
- What it can disrupt
- reporting plans that assume the exemption became law, when it has not
- Why it matters now
- No-action relief covers reporting periods starting up to 1 February 2027. Later periods depend on the incoming government.
Who counts as sanctioned has changed
- Who it affects
- fund managers and platforms onboarding investors and screening holdings and counterparties
- What it can disrupt
- customer checks that only match names against the list, and miss someone acting for a sanctioned person
- Why it matters now
- Since 3 September, any dealing designed to get around sanctions is expressly banned, and relatives and associates count only if named on the register. More names were added on 7 August.
Indirect collection rules started in May
- Who it affects
- fund managers and platforms receiving investor data from advisers, employers and other platforms
- What it can disrupt
- data feeds from third parties that never trigger a notice to the person they describe
- Why it matters now
- Applies to personal information collected since 1 May 2026. Everything collected indirectly since then is already in scope.
A 25 cent fee cost $1.73m
- Who it affects
- fund managers and platforms whose fee and unit-price calculations must match the offer documents
- What it can disrupt
- fee tables that kept charging after the terms were reworded around them
- Why it matters now
- Public warning issued 21 September. The fee ran from November 2017 to November 2023 before it was caught.
Dormant accounts became a breach finding
- Who it affects
- fund managers and platforms holding closed and inactive investor accounts
- What it can disrupt
- customer platforms with no process to check in on, close or purge accounts nobody uses
- Why it matters now
- Final report released 30 October. The Commissioner generally expects a check-in after 12 months of inactivity.
Boards must know where AI runs
- Who it affects
- fund managers and KiwiSaver providers using AI in operations or member service
- What it can disrupt
- AI use nobody has inventoried: vendor features, staff tools and code assistants outside the risk register
- Why it matters now
- Expectations already published. Boards and senior managers should know where AI is deployed and who owns the risk.
Breach notified six months late
- Who it affects
- fund managers whose administrators or IT providers handle security incidents
- What it can disrupt
- incident response that treats cyber and privacy separately, so nobody asks whether to notify
- Why it matters now
- Decision published. The Commissioner expects notification within 72 hours of knowing a breach is notifiable.
Overseas policy, New Zealand problem
- Who it affects
- fund managers and platforms using group or offshore privacy documents
- What it can disrupt
- collection notices and privacy policies inherited from a parent company that cite foreign law
- Why it matters now
- Decision published. The Commissioner signals targeted adverse comment, including to parent companies, when firms do not engage.
Personal emails on work systems count
- Who it affects
- fund managers handling access requests from current and former staff
- What it can disrupt
- access-request processes that skip personal email held in company mailboxes
- Why it matters now
- Case note published. Personal emails held on work systems can fall inside an access request.
AML supervision now carries a levy
- Who it affects
- fund managers and platforms that are AML/CFT reporting entities
- What it can disrupt
- budgets, payables and compliance calendars with no line for levy invoices, challenges or class changes
- Why it matters now
- Regulations in force since 8 October. Levies apply from the financial year starting 1 July 2027.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.