AML/CFT risks have changed. What should Bookkeepers be watching for?

You know that client who makes you stop and think?

Maybe their business structure seems unnecessarily complicated.

There are companies, trusts and different owners involved, but nobody can quite give you a straight answer about who owns what.

Perhaps money is moving in ways that don’t seem to match the business you thought you were dealing with.

Or you’re being asked to help set something up, restructure something or process a transaction that makes you think:

“Hang on. Why are we doing this?”

That instinct matters.

The Department of Internal Affairs (DIA) has released its Accounting Sector Risk Assessment 2026, providing an updated look at money laundering, terrorism financing and proliferation financing risks facing the accounting sector.

And while the formal call to review the assessment is aimed at accounting practices that are reporting entities under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, there are useful lessons in it for the wider bookkeeping profession too.

Why AML/CFT matters for Bookkeepers

One of the reasons this is worth talking about is simple: Bookkeepers are close to the transactions.

You’re often working inside a client’s accounts regularly. You see invoices, payments, payroll, bank feeds, new entities and changes in the way a business operates.

That doesn’t mean it’s your job to investigate your clients.

But it does put Bookkeepers in a position where something unusual may become visible.

The DIA’s new assessment looks at risks connected with services including company and trust structures, complex ownership arrangements, business establishment and restructuring, and other financial transactions. It also reinforces the importance of customer due diligence, ongoing monitoring and suspicious activity reporting for reporting entities.

Even where those formal requirements don’t apply to your bookkeeping practice, understanding why certain activities can carry additional risk is useful professional knowledge.

What might make you stop and ask another question?

This isn’t about turning every Bookkeeper into a detective.

It’s about recognising when something doesn’t quite add up.

For example, you might encounter an ownership structure that seems unusually complicated for the business involved. You might be asked to process transactions without a clear commercial explanation. A client might suddenly change how money is being received, paid or moved between entities. Or you may find yourself being drawn into establishing or restructuring companies or trusts without fully understanding why.

None of those things automatically means something improper is happening.

There may be a completely legitimate explanation.

The important part is not ignoring something simply because it sits outside the normal bookkeeping process you’re used to seeing.

Ask questions appropriate to the work you’re doing. Make sure you understand what you’re being asked to process. Keep appropriate records. And if something moves beyond your knowledge, responsibilities or professional scope, recognise when it’s time to refer or escalate it.

Sometimes one of the most useful professional skills a Bookkeeper can have is knowing when not to simply click “OK”.

It’s about understanding your own risk

Another important message from DIA is that AML/CFT risk isn’t one-size-fits-all.

For reporting entities, the Sector Risk Assessment is intended to sit alongside their own risk assessment. DIA says individual firms will have different risk profiles and should consider their customers, services and delivery channels when deciding what controls are appropriate.

That risk-based thinking is useful more broadly too.

Think about the work that passes across your desk.

Do you mostly provide straightforward bookkeeping and payroll services to small local businesses? Or are you working with groups of companies, trusts and complex ownership arrangements?

Are you regularly involved in establishing businesses or changing structures?

Do you handle transactions where you don’t understand the commercial reason behind them?

Are clients asking you to do things that are starting to move beyond bookkeeping and into areas where another professional should be involved?

The answers will look different for every bookkeeping practice.

The lesson for Bookkeepers: understand what you’re looking at

The release of the Accounting Sector Risk Assessment 2026 doesn’t mean every Bookkeeper needs to become an AML/CFT expert.

Nor does it mean every Bookkeeper is suddenly subject to the same AML/CFT obligations as a reporting entity.

But it is another reminder that good bookkeeping isn’t simply about getting transactions into the right boxes.

It’s about understanding the business behind the numbers.

The more you understand about the risks that can sit behind certain structures, transactions and client requests, the better equipped you are to recognise when something deserves another question.

And if your bookkeeping practice is a reporting entity under the AML/CFT Act, DIA’s message is much more direct: review the new Sector Risk Assessment and consider how its findings apply to your own business, customers, services and delivery channels.

Want to dig a little deeper?

DIA has advised NZQBA that it will be holding a webinar to talk through the key findings of the Accounting Sector Risk Assessment and what they mean for the sector. At the time of publishing, webinar details have not yet been released. NZQBA will share these with our community when they become available.

In the meantime, the full Accounting Sector Risk Assessment 2026 is worth a read, particularly if your practice provides services or works with clients where some of the identified risks may be relevant.