New Zealand Moves to Phased Online Casino Gambling Regime

14 October 2026

The Department of Internal Affairs (DIA) in New Zealand has begun a phased rollout of regulations for online casino gambling, as the Online Gambling Act 2022 comes into effect. Licensed operators face stringent compliance demands, including mandatory know-your-customer checks, payment controls, anti-money laundering measures, and data privacy obligations.

Not fully operational until 2023, the still-developing regime presents a transition period for operators. Key operational details, such as the final regulations implementing restrictions on payment types, had not crystallized by DIA’s last update this June.

What DIA has published so far

New Zealand passed the Online Gambling Act 2022 into law, beginning a staggered process to license and regulate the country’s online casinos. The DIA published guidance for providers, specifying license requirements; and released Minimum Standards for Online Gambling, which defines compliance requirements.

The Standards focus on payment-processing security, requiring that payment service providers meet PCI DSS standards. The security requirements govern not just credit card transactions, but any payment card data, including e-wallet transaction IDs.

A license application must contain a business plan that includes strategies for advertising and marketing, consumer protection, harm prevention and minimisation, and compliance.

KYC and customer screening requirements

Visitor verification starts before they can be cleared to play.

Transaction due-diligence is mandatory: all transactions at or above NZD 5,000 require identification. Operators must screen all proposed customers at registration and as prospects seek to establish a relationship, checking names and identifiers like phone numbers against blacklists of politically-exposed persons or those appearing in sanctions lists. Screening continues over the duration of the customer relationship.

Verification must occur before a player can deposit and play, a layer of protection that helps prevent fraud and money laundering.

Payment and reporting controls

Operators are still awaiting final confirmation on some reporting requirements. As of DIA’s last guidance, operators must track transactions but do not yet have absolute metrics for reporting fund movements.

In its recent update, the DIA indicated that technical clarifications would follow once the regulations were confirmed. That timeline remains pending. Further, the Act suggests potential restrictions on payment types but does not define them yet.

Operators must file Suspicious Activity Reports (SARs) to the NZ Police Financial Intelligence Unit without unreasonable delay when they suspect money laundering or other serious offenses.

AML/CFT and data retention

Filing a SAR is part of a suite of compliance obligations that includes proof of commitment to an AML/CFT program. In brief, operators must:

• Establish an AML/CFT program covering customer due diligence, monitoring, suspicious-activity reporting, record-keeping, and training.
• Retain customer records for at least five years.
• Keep detailed training records.
• Maintain SAR-filing evidence.

Privacy and licensing expectations

The DIA guidance includes compliance with New Zealand’s Privacy Act 2020, which restricts extensive customer profiling.

The DIA will not grant a license without proof that the applicant is fit to hold it and can meet all requirements. Operators must demonstrate robust systems for privacy protection and financial crime prevention, not merely declare compliance.

Penalties for violations

The Act includes strict legal ramifications for breaches, which can trigger formal warnings, enforceable undertakings, or financial penalties. Notably, participants who knowingly engage minors (under 18 years of age) in gambling can be fined NZ$250,000 for individuals; NZ$2 million for corporations.