Lead signal
Screening and privacy obligations moved under lenders this window: sanctions rules changed on 3 September, and the privacy regulator now treats dormant accounts and slow breach notification as findings. A bank's $1.73m fee refund shows what a quiet configuration gap costs.
Regulatory changes on the radar
Show radar
Regulatory radar overview
Select a numbered signal to read its detail. Size and colour show severity.
Zoom and drag to explore. The radar stays open until you hide it.
AML supervision now carries a levy
- Who it affects
- non-bank lenders, finance companies and payment providers that report under AML/CFT law
- What it can disrupt
- budgets, payables and compliance calendars with no line for levy invoices, challenges or class changes
- Why it matters now
- Regulations in force since 8 October. Levies apply from the financial year starting 1 July 2027.
Who counts as sanctioned has changed
- Who it affects
- lenders and finance companies onboarding borrowers, guarantors and business customers
- What it can disrupt
- customer checks that only match names against the list, and miss someone acting for a sanctioned person
- Why it matters now
- Since 3 September, any dealing designed to get around sanctions is expressly banned, and relatives and associates count only if named on the register. More names were added on 7 August.
Indirect collection rules started in May
- Who it affects
- lenders receiving applicant data from brokers, dealers, bureaus and comparison sites
- What it can disrupt
- data feeds from third parties that never trigger a notice to the person they describe
- Why it matters now
- Applies to personal information collected since 1 May 2026. Everything collected indirectly since then is already in scope.
A 25 cent fee cost $1.73m
- Who it affects
- lenders and finance companies charging account, establishment or default fees from configured tables
- What it can disrupt
- fee tables that kept charging after the terms were reworded around them
- Why it matters now
- Public warning issued 21 September. The fee ran from November 2017 to November 2023 before it was caught.
Dormant accounts became a breach finding
- Who it affects
- lenders with customer portals, closed loans and old applications still on file
- What it can disrupt
- customer platforms with no process to check in on, close or purge accounts nobody uses
- Why it matters now
- Final report released 30 October. The Commissioner generally expects a check-in after 12 months of inactivity.
Boards must know where AI runs
- Who it affects
- deposit takers and FMA-licensed lenders using AI in credit, collections or customer service
- What it can disrupt
- AI use nobody has inventoried: vendor features, staff tools and code assistants outside the risk register
- Why it matters now
- Expectations already published. Boards and senior managers should know where AI is deployed and who owns the risk.
Fair outcomes can't be outsourced
- Who it affects
- finance companies and vehicle lenders selling add-on insurance alongside the loan
- What it can disrupt
- distribution oversight that never sees intermediary sales, cancellations, claims and complaints data
- Why it matters now
- Review published with feedback to participating insurers. The FMA expects the rest of the sector to self-assess against it.
Breach notified six months late
- Who it affects
- lenders whose IT or managed service provider handles security incidents
- What it can disrupt
- incident response that treats cyber and privacy separately, so nobody asks whether to notify
- Why it matters now
- Decision published. The Commissioner expects notification within 72 hours of knowing a breach is notifiable.
Overseas policy, New Zealand problem
- Who it affects
- lenders with overseas owners or offshore-built application journeys
- What it can disrupt
- collection notices and privacy policies inherited from a parent company that cite foreign law
- Why it matters now
- Decision published. The Commissioner signals targeted adverse comment, including to parent companies, when firms do not engage.
Personal emails on work systems count
- Who it affects
- lenders handling access requests from current and former staff
- What it can disrupt
- access-request processes that skip personal email held in company mailboxes
- Why it matters now
- Case note published. Personal emails held on work systems can fall inside an access request.
Compiled with care from public sources; errors and omissions excepted. Always check the linked source before acting. Regulatory Radar is general information, not legal or compliance advice.