Real estate Know Your Population project highlights importance of starting with risk assessment
15 October 2026
The Department of Internal Affairs (DIA) has completed a Know Your Population project focused on the real estate sector.
The project examined businesses operating within the real estate sector that hold a valid real estate licence but were not registered with DIA as reporting entities and, consequently, were not registered on the New Zealand Police Financial Intelligence Unit’s (FIU) goAML platform.
The project has provided useful insights into how newly identified reporting entities are approaching their AML/CFT obligations, including the importance of starting with a risk assessment and using it as the foundation for developing an effective AML/CFT programme.
The project also identified 64 entities that are now part of DIA’s AML/CFT supervised population, strengthening the Department’s understanding of the real estate sector and ensuring businesses that are captured by the AML/CFT Act are appropriately brought within the regulatory framework.
Understanding and engaging with the real estate population
DIA undertook the project by comparing information on the Real Estate Authority (REA) public register with its own records of supervised entities.
The REA public register contained 930 entities. Of these, 211 were not recorded as being supervised by DIA. Fifty-five had a status of “Suspended” on the REA register and were therefore excluded from the project. The remaining 156 entities, which had a status of either “Active” or “Active - Pending Renewal”, formed the project population.
DIA then contacted these businesses to establish whether they were undertaking activities captured by the AML/CFT Act and, where applicable, to understand the extent to which they had progressed with their AML/CFT obligations.
On 16 March 2026, DIA issued notices under section 132(2)(a) of the AML/CFT Act to all 156 businesses. The notices required each business to provide information about its activities so DIA could determine whether it met the definition of a reporting entity under the Act.
Where businesses did not respond, DIA followed up by telephone and email. Thirty businesses did not respond to the initial notice. On 25 May 2026, DIA issued a second notice under section 132(2)(a) to those 30 businesses, requiring the same information.
This approach provided businesses with opportunities to respond and understand what information was required, while enabling DIA to use its statutory powers where information remained outstanding.
The project is part of DIA’s broader work to maintain an accurate understanding of its supervised population and ensure businesses that are required to comply with the AML/CFT Act are appropriately identified and engaged.
What DIA found
The responses provided a useful picture of how newly identified reporting entities are approaching AML/CFT compliance.
One of the clearest findings was the high proportion of entities that had appointed an AML/CFT Compliance Officer. This was the case for 86 per cent of entities assessed.
This suggests businesses are generally responding to visible and easily actioned regulatory requirements, particularly requirements that are clearly identified through onboarding or guidance material.
However, risk assessments and AML/CFT programmes were less consistently in place.
Importantly, the project found that these two requirements tended to be absent together rather than independently.
This is significant because an AML/CFT programme should be informed by the findings of an entity’s risk assessment. Understanding the risks a business faces provides the foundation for determining the policies, procedures and controls it needs to manage those risks.
The findings suggest a sequencing effect in compliance maturity. Entities that had begun substantive AML/CFT work by completing a risk assessment were generally more likely to have progressed to developing and implementing an AML/CFT programme.
Conversely, entities that had not started a risk assessment were generally unlikely to have progressed to subsequent AML/CFT requirements.
This points to a potential “threshold effect” in compliance maturity: businesses appear to either have engaged with the AML/CFT framework sufficiently to complete a risk assessment and develop an AML/CFT programme or have undertaken only initial steps such as appointing a Compliance Officer.
A risk-based approach to AML/CFT compliance
The findings reinforce the importance of risk assessment as the starting point for an effective AML/CFT compliance framework.
A risk assessment helps a business understand the money laundering and terrorism financing risks it faces and provides the basis for deciding how those risks should be managed.
The project data suggests that once businesses begin this substantive compliance work, they are generally more likely to progress through the subsequent elements of their AML/CFT framework. This means the key issue identified through the project is not necessarily isolated instances of non-compliance, but the need to support businesses that are at an early stage of engaging with the AML/CFT framework.
For newly identified reporting entities, clear information and practical support can help businesses move from initial awareness of their obligations to developing a risk-based AML/CFT framework.
“Knowing who is within the AML/CFT regulatory population is fundamental to effective supervision. This project has helped us strengthen our understanding of the real estate sector, while also providing useful insight into how businesses approach their AML/CFT obligations,” says DIA Deputy Director Kerri Fergusson.
“One of the key lessons is the importance of getting started with understanding your risks. A risk assessment provides the foundation for an effective AML/CFT programme and helps businesses focus their resources on the risks that matter most.”
What happens next?
The project has identified opportunities to strengthen how DIA understands and engages with reporting entities, both in real estate and across other supervised sectors.
These include strengthening information-sharing and engagement with industry and professional bodies, establishing a more systematic approach to periodically scanning supervised sectors, providing targeted information to businesses about their AML/CFT obligations, and improving the consistency and quality of data held about reporting entities.
The lessons from the project will help inform DIA’s ongoing approach to understanding its supervised population and identifying businesses that may be within the AML/CFT regulatory perimeter.
Resources for the real estate sector
Real estate businesses that are subject to the AML/CFT Act can use Real Estate Agent Sector Risk Assessment 2026 (PDF, 1MB) to help understand the key money laundering risks facing the sector.
Businesses can also access AML/CFT guidance and information about registration and other obligations on the DIA website: Information for Real Estate Agents
