A newly updated Identity Verification Code of Practice 2026 (IVCOP) has been approved under section 64 of the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (the AML/CFT Act) and has been publicly released.
The IVCOP and supporting Fact Sheet can be found on the AML/CFT joint supervisors' websites (for example, here and here), with the IVCOP largely coming into force on 1 July 2026.
What does the IVCOP do and when does it apply?
The IVCOP sets out suggested best practice for reporting entities when carrying out full name and date of birth verification on individuals who are customers, or who are beneficial owners or persons acting on behalf of a customer.
While following the IVCOP is not mandatory, doing so provides a safe harbour in relation to satisfying relevant customer due diligence requirements under the AML/CFT Act. A reporting entity may opt out of complying with the IVCOP and instead comply by some other equally effective means if it has advised its AML/CFT supervisor that it intends to do so.
What is changing?
- Scope: The IVCOP now extends to high-risk customers, in addition to low- and medium-risk customers
- New verification pathway: The IVCOP introduces a new pathway for verification through an accredited Digital Identity Services Trust Framework (DISTF) service, specifying requirements for in-person and online, or in-person only, verification
- Reduced verification: The IVCOP introduces the ability for a reporting entity to apply reduced verification steps, in accordance with its AML/CFT programme, in respect of a beneficial owner of, or person acting on behalf of, a customer that is (i) a legal person or legal arrangement rated low or medium risk that has two or more beneficial owners or (ii) for which simplified CDD applies
- Changes to certified copies requirements: The updated IVCOP makes several changes to the 'certified copies' pathway (where identity verification is done in reliance on certified copies of identity documents), including extension of the validity period of certified copies from three to 12 months, requirements for photographs on certified copies to be clearly visible and adding officers of the Māori Land Court as trusted referees. From 1 July 2027, new provisions will apply to allow a reporting entity to receive a certified copy in person, by post or other means, provided procedures, policies and controls for enhanced assurance are in place
- Electronic identity verification updates: These include clarifications and modifications as to what services can be used as a single electronic source or an independent and reliable source
- Wire transfers: Where a reporting entity has already verified a person's name and date of birth as part of its CDD obligations, it is not required to repeat that exercise when the same person acts as the originator of a wire transfer, unless there are reasonable grounds to doubt the adequacy or veracity of the identity verification previously conducted.
Our view
The updated IVCOP increases flexibility for reporting entities in conducting identity verification, including widening the IVCOP's application to an increased range of customers, providing additional pathways for identity verification and offering reduced verification options in certain circumstances. To take advantage of this additional flexibility, reporting entities should review their AML/CFT programmes to ensure alignment with the updated IVCOP requirements.
If you would like to discuss these changes or any aspect of your AML/CFT compliance obligations, please get in touch with our financial services regulation team.
This article was prepared by Andrew Suggate (senior associate) and Lily Rose Hosseini (law clerk).
