Crypto License in New Zealand: FSPR Registration, FMA Compliance & DIA AML Supervision

All three tiers include NZ company incorporation and FSPR registration filing. The differences below reflect how much of the AML/CFT programme, banking introduction, and ongoing compliance work we take on for you. Prices are indicative EUR bands and exclude government fees listed in the next table.

All NZD amounts below are statutory figures published by the Companies Office and the FSPR Schedule of Fees and Levies.

Note: PI insurance is recommended best practice for crypto FSPs on the FSPR; it is statutorily required only for licensed Financial Advice Providers under FMA standard conditions.

The FMA is New Zealand’s conduct regulator, established under the Financial Markets Authority Act 2011 and empowered by the Financial Markets Conduct Act 2013 (FMCA). It regulates crypto activity only where a token meets the FMCA definition of a “financial product” (for example, tokens conferring investment-like rights), or where a service falls within the FMCA “financial service” categories. Token offers and ICOs structured as regulated offers trigger disclosure and licensing obligations.

The FSPR is a register, not a licence. It is administered by the Companies Office, a business unit of the Ministry of Business, Innovation and Employment (MBIE), under the Financial Service Providers (Registration and Dispute Resolution) Act 2008. Any person in the business of providing a “financial service” to persons in or from New Zealand must register, including most crypto exchanges, brokers, wallets and custodians. Registration confirms statutory eligibility, identifies the financial services offered, and (for retail-facing providers) links the firm to an approved dispute-resolution scheme. It does not certify competence, capital adequacy or AML compliance; those sit with other agencies.

The DIA is the AML/CFT supervisor for most VASPs under the AML/CFT Act 2009, alongside the FMA and RBNZ for sector-specific reporting entities. From 1 July 2026, under the AML/CFT (Supervisor, Levy, and Other Matters) Amendment Act 2026, the DIA becomes the sole AML/CFT supervisor for all reporting entities. It oversees risk assessments, AML/CFT programmes, the s56(2) Compliance Officer designation, the s59 independent audit cycle and the s60 annual report.

The IRD is New Zealand’s tax authority. It treats cryptocurrency as property rather than currency, so disposals are taxable income, and from 1 April 2026 it implements the OECD Crypto-Asset Reporting Framework (CARF) for Reporting Crypto-Asset Service Providers (RCASPs), with the first annual report due by 30 June 2027.

Every model below attracts FSPR registration and DIA AML/CFT supervision. Some also pull you into FMA conduct and licensing rules under the FMCA where the tokens involved qualify as financial products.

• Crypto exchange: FSPR + AML/CFT. FMA conduct rules also bite if any listed token is a “financial product” (debt, equity, managed-investment product or derivative) under the FMCA, which turns the exchange into a regulated offer venue.
• Crypto broker: FSPR + AML/CFT. Acting as agent or principal for clients buying or selling tokens that are FMCA financial products requires the matching FMA market-services licence.
• Custodial wallet provider: FSPR + AML/CFT for safekeeping or administration of virtual assets. Custody of tokens classified as financial products engages additional FMA custodian conduct obligations and licensee duties.
• Crypto payment processor: FSPR + AML/CFT. Generally outside FMCA scope provided the token used is purely a means of exchange and confers no investment-like rights.
• ICO / IEO issuer: FSPR plus likely a regulated FMCA offer. FMA guidance is that many issued tokens are “financial products” (most often debt or managed-investment products), which means a compliant disclosure document and licensed intermediaries are needed.
• DeFi protocol service: FSPR + AML/CFT where there is a clear NZ-based operator providing a financial service. FMA conduct rules attach if the protocol facilitates dealings in tokens that are financial products.
• Staking pool operator: FSPR + AML/CFT. Pooled-yield arrangements are frequently “managed-investment products” under the FMCA, requiring a manager licence and PDS.
• Crypto-asset investment manager: FSPR plus FMA licensing (MIS manager and/or DIMS provider) and ongoing risk-based financial-resources expectations under licence conditions.

Crypto-assets are analysed under four existing FMCA categories: debt securities, equity securities, managed-investment products and derivatives. The FMA’s cryptocurrencies guidance indicates that many tokens are likely “financial products” where they confer investment-like rights, for example tokenised debt, equity-style claims on a venture, pooled-yield arrangements or contracts whose value tracks an underlying asset. Where a token sits within one of those four boxes, the full FMCA disclosure, licensing and conduct regime applies.

Crypto activity that sits outside FMCA categories (for example pure means-of-exchange tokens or utility tokens with no investment-like rights) is, as the FMA reminds consumers, “not specifically regulated”, so normal financial-product consumer protections do not apply. That does not mean a regulatory vacuum: AML/CFT obligations under the AML/CFT Act 2009, IRD tax rules treating cryptoassets as property, and the Fair Trading Act 1986 fair-dealing rules against misleading conduct still bind every operator. Classifying each token correctly is therefore the first technical step: it decides whether you need an FMA market-services licence on top of the baseline FSPR registration.

The applicant must be a limited company incorporated under the Companies Act 1993. Section 10 requires at least one director who is ordinarily resident in New Zealand, or alternatively ordinarily resident in an “enforcement country” and simultaneously a director of a company registered in that country. Australia is currently the only prescribed enforcement country by Order in Council; no other jurisdiction qualifies. Set the board before incorporation, because retrofitting a qualifying director delays both Companies Office filings and FSPR submission.

FSPR registration requires evidence of a genuine NZ operational presence from which financial services are provided (see the Companies Office guidance). A director’s NZ residential address is permitted where business is genuinely conducted there. Since the 2014 FSP Act amendments, the Registrar can deregister entities lacking a real NZ footprint, and the FMA routinely flags shell registrations.

Under the Financial Service Providers (Registration) Regulations 2020, applicants relying on the “in-business-in-NZ” pathway must serve at least 10 NZ-resident clients and transact at least NZD 10,000 per annual confirmation period. A first-six-months milestone of at least 5 NZ-resident clients and NZD 5,000 applies during initial registration. Services provided to relatives or close associates of the applicant are excluded from these counts. The threshold is pathway-specific: an applicant licensed under another Act (for example, FMA-licensed providers) or already an AML/CFT reporting entity in NZ can register on those alternative bases without meeting the 10/NZD 10,000 test. Pick the right pathway upfront to avoid building an NZ client book you do not need.

Section 56(2) of the AML/CFT Act 2009 requires every reporting entity (which includes crypto/VASP businesses) to designate an AML/CFT Compliance Officer to administer the AML/CFT programme. The Compliance Officer must be an employee who reports to a senior manager, or may themselves be a senior manager. An external appointee is permitted only where the entity has no employees, typically a sole practitioner. For a crypto applicant of any meaningful scale, budget for an in-house hire (or a properly employed contractor) before the AML programme is signed off. The Compliance Officer is also the point of contact for the DIA and signs the annual AML/CFT report.

FSPs that provide services to retail clients must belong to one of four approved schemes: FSCL, IFSO, FDRS (Financial Dispute Resolution Service, operated by FairWay Resolution), or the Banking Ombudsman Scheme (BOS) for banking activities. A proposed FSCL/IFSO merger was announced to take effect from 1 July 2025; completion status remained evolving as of mid-2026, so check the current panel before applying. Wholesale-only providers are exempt from the DRS requirement, so a B2B-only crypto business serving institutional counterparties can skip this step. Professional Indemnity insurance is NOT statutorily mandatory for crypto FSPs. After consultation, the FMA declined to make PI a mandatory standard condition for licensed Financial Advice Providers (FAPs) either. For an FSPR-registered crypto provider, PI is recommended best practice and an AML risk control, not a legal precondition for registration.

New Zealand levies a flat 28% corporate income tax on the worldwide income of resident companies, with no separate rate for crypto businesses. There is no general capital gains tax: profits from buying and selling crypto-assets, and many forms of mining or staking, are generally treated as ordinary income and taxed at the company rate, with IRD assessing each arrangement on its facts.

The statutory hook sits in the Income Tax Act 2007, sections CB 1, CB 3 and CB 4, covering income from a business, profit-making undertakings and personal property acquired for the purpose of disposal. IRD treats cryptoassets as property rather than currency, so disposals are taxable events whenever the asset was acquired with disposal in mind, which IRD presumes for most trading and exchange operators. In 2026 IRD launched an enforcement campaign, writing to individuals known to have traded on crypto exchanges and inviting them to file IR3 returns. Crypto businesses, like all businesses, must keep adequate records for tax purposes and have customer transaction records available for IRD requests. See the IRD corporate tax rates page.

New Zealand’s standard GST rate is 15%. Under amendments enacted by the Taxation (Annual Rates for 2021–22, GST, and Remedial Matters) Act 2022 (with retrospective effect from 1 January 2009), cryptocurrency (excluding NFTs) is carved out of the GST regime under the Goods and Services Tax Act 1985, so the supply of cryptocurrency itself is not a taxable supply for GST purposes. The carve-out covers cryptocurrency only; NFTs and underlying goods or services paid for in crypto remain taxable.

For details, see IRD’s cryptoassets and GST guidance.

Non-resident withholding tax (NRWT) applies when an NZ company pays dividends offshore. The default rate on unimputed dividends is 30%, but this is typically reduced to 5–15% under double-tax treaties: commonly around 5% for substantial corporate shareholdings (typical thresholds of 10% or 25%, depending on the treaty) and around 15% for portfolio holdings, with exact thresholds and rates varying by treaty. Fully imputed dividends can attract an effective 0% rate in some cases, subject to detailed statutory and treaty conditions. The applicable treaty rate is set out in IRD’s NRWT rates for DTA countries.

New Zealand has adopted the OECD Crypto-Asset Reporting Framework (CARF). Reporting Crypto-Asset Service Providers (RCASPs) operating in or from NZ must collect tax-residence and transaction information about each user (and, for entity users, their controlling persons) and report it annually to IRD. The first reporting period runs 1 April 2026 – 31 March 2027, with the first report due 30 June 2027. RCASPs will register via myIR from March 2027. IRD then shares the data with other tax authorities under OECD-aligned exchange agreements. Full implementation detail sits on IRD’s CARF page.

A licensed NZ crypto FSP runs on four parallel annual cycles — AML/CFT reporting to the supervisor, income tax to Inland Revenue, the Companies Office annual return, and FSPR annual confirmation — plus, for Reporting Crypto-Asset Service Providers (RCASPs) from FY 2026/27, an additional annual CARF report to Inland Revenue. The AML/CFT annual report carries the heaviest penalty on the list.

Read the statutory wording in s60 AML/CFT Act 2009 and the IR4 guidance from Inland Revenue.

The AML/CFT independent audit is a structured review of your risk assessment and AML/CFT programme by a qualified, independent auditor. Weak audit findings accelerate DIA enforcement attention. See the DIA’s independent audit guidance for what an auditor will test.

Budget for an external AML/CFT auditor engagement on the 3-year default. A shorter cycle from DIA signals that internal controls or transaction-monitoring quality need strengthening.

Under sections 49–51 of the AML/CFT Act 2009, reporting entities must retain CDD records, identity verification material, transaction records and AML programme documentation for at least 5 years after the relevant transaction or the end of the business relationship, longer if the Commissioner of Police requires it. Build retention rules into your data architecture from day one. The statutory wording is in s49–51 of the Act.

The second forward-looking cost line is the new AML/CFT industry levy. The risk-based levy on reporting entities, including VASPs, funds the single-supervisor regime and starts being collected from 1 July 2027. Levy regulations are being designed during 2026; the Ministry of Justice consultation on levy proposals closed on 10 April 2026. Budget for a new recurring annual cost from FY 2027/28.

The AML/CFT (Supervisor, Levy, and Other Matters) Amendment Act 2026 takes effect on 1 July 2026 and replaces NZ’s three-supervisor model (DIA + FMA + RBNZ) with a single AML/CFT supervisor: the Department of Internal Affairs (DIA). From that date DIA supervises all reporting entities (VASPs, banks, FMA-licensed providers, casinos and DNFBPs). The Act also authorises an industry-funded AML/CFT levy collected from mid-2027 and introduces a more flexible secondary-legislation framework, so future rule changes can land via regulations rather than primary statute. One reporting line replaces three, and DIA’s workload jumps; budget for the levy from FY 2027/28. See the Beehive announcement and the Amendment Act text.

NZ has adopted the OECD Crypto-Asset Reporting Framework. Reporting Crypto-Asset Service Providers (RCASPs) operating in or from NZ must collect tax-residence and transaction information from every user (and, for entity users, the same data for their controlling persons) and report it annually to IRD, which exchanges the data with other tax authorities. The headline dates:

• First reporting period: 1 April 2026 – 31 March 2027
• RCASP registration via myIR: opens March 2027
• First annual report due: 30 June 2027

Onboarding flows, KYC tooling and data-retention policies needed to be CARF-ready before 1 April 2026; the first reporting period is already running. Full detail is on IRD’s CARF overview.

The 1 July 2026 supervisor reform sits on top of an earlier package of phased AML/CFT reforms completed on 1 June 2025. The final stage extended AML/CFT obligations to sectors not previously covered and tightened existing CDD and reporting duties, so any compliance programme drafted before mid-2025 needs a refresh against the current rules. The Ministry of Justice’s consolidated overview sits on the AML/CFT review page.