AI for AML/CFT and Risk Management

Imagine it’s late July, and your practice is swamped with end-of-year tax returns, IRD deadlines, and client queries about provisional tax. You’re using Xero to process a client’s GST return when you notice an unusual transaction: a large, unexplained credit to a foreign account. You flag it for further review, but the client is a small business owner with no prior history of such activity. How do you document this in compliance with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT Act)? How do you balance speed with due diligence?

This is where AI can be a practical tool-not to replace your judgment, but to help you save time on routine tasks and spot potential red flags faster. Let’s explore how.

All company names and scenarios used in this course are fictitious and created for illustration and training purposes only. Any resemblance to real businesses or organisations is coincidental.

1. Customer Due Diligence (CDD) Documentation

The AML/CFT Act requires reasonable steps to verify client identities and assess risks. For small practices, this can be time-consuming, especially when dealing with clients like sole traders, trusts, or foreign entities.

AI tools can assist by:

• Automating data collection: Extracting information from ID documents, company registrations (Companies Office), or bank statements.
• Generating CDD narratives: Creating templates for client profiles, including risk ratings and verification methods.
• Flagging inconsistencies: Highlighting discrepancies in client data (e.g., mismatched addresses, unusual transaction patterns).

However, AI is not a substitute for human judgment. You must still verify information manually and document decisions.

2. Risk Assessment Templates

The AML/CFT Act requires practices to assess risks based on factors like client type, transaction volume, and geographic location. AI can help create custom risk assessment templates by:

• Analysing historical data to identify high-risk patterns (e.g., clients with frequent cash transactions).
• Suggesting risk categories (e.g., “low,” “medium,” “high”) based on predefined criteria.

For example, AI could flag a client operating in a high-risk industry (e.g., cryptocurrency) and recommend enhanced due diligence.

3. Suspicious Activity Red Flags

The Income Tax Act 2007 and AML/CFT Act require reporting of suspicious activities to the Financial Intelligence Unit (FIU), NZ Police. AI can help identify red flags like:

• Sudden spikes in transaction volume.
• Unusual business structures (e.g., shell companies).
• Clients refusing to provide documentation.

AI tools can also generate Suspicious Activity Reports (SARs) in a standard format, saving time for tax agents and compliance officers.

4. Privacy Act 2020 Compliance

When using AI tools to process client data (e.g., for CDD or risk assessments), you must comply with the Privacy Act 2020, which governs how personal information is collected, stored, and used. Key considerations:

• Limit data input: Avoid uploading sensitive information like client passwords, private communications, or unredacted ID documents.
• Secure storage: Ensure AI tools use encryption and comply with the Tax Administration Act 1994 for data handling.
• Client consent: Inform clients if AI is used for their files and obtain consent where required.

Example Prompts for Immediate Use

You can copy and paste these prompts into Microsoft Copilot to generate CDD narratives, risk assessments, or SARs.

Prompt 1: CDD Narrative
“I need a sample CDD narrative for a client who is a sole trader with a low-risk profile. Include verification steps, risk rating, and references to the AML/CFT Act.”

Prompt 2: Risk Assessment Template
“Create a risk assessment template for a client operating a travel agency. Factors to consider: transaction frequency, client location, and industry-specific risks. Use NZ legislation references.”

Prompt 3: Suspicious Activity Report
”Generate a Suspicious Activity Report (SAR) for a client with frequent cash deposits exceeding $10,000. Include relevant sections for the FIU and cite the AML/CFT Act 2009.”

Common Pitfalls and Misconceptions

1. Over-reliance on AI for legal compliance

   • AI can suggest actions, but you must verify that its outputs comply with the AML/CFT Act and Privacy Act 2020. For example, AI might flag a transaction as suspicious, but you need to confirm whether it meets the AML/CFT Act 2009 criteria for reporting to the Financial Intelligence Unit.

2. Mishandling sensitive data

   • Uploading unredacted client documents (e.g., passports, bank statements) to AI tools could breach the Privacy Act 2020. Always redact sensitive information before using AI.

3. Ignoring human judgment

   • AI tools may not understand the nuances of client relationships. For instance, a client with a high-risk profile might have a legitimate reason for unusual transactions (e.g., inheritance). Always combine AI insights with your professional judgment.

Try This: Use AI to Generate a CDD Narrative

Today’s exercise: Use a free AI tool (e.g., Microsoft Copilot) to create a CDD narrative for a fictional client.

1. Open an AI tool and paste this prompt:

   “Generate a Customer Due Diligence (CDD) narrative for a client who is a New Zealand-based limited company. Include: client background, verification steps, risk rating, and references to the AML/CFT Act 2009.”

2. Review the output. Check if it:

   • Mentions verification methods (e.g., checking the Companies Office register).
   • Includes a risk rating (e.g., “low” or “medium”).
   • Cites relevant legislation.

3. Adjust the narrative to match your practice’s policies and ensure it complies with the Privacy Act 2020.

Key Takeaway

AI can streamline AML/CFT compliance by automating CDD documentation, generating risk assessments, and flagging suspicious activity. However, always verify AI outputs against NZ legislation and use discretion when handling client data. By combining AI tools with your professional judgment, you can save time, reduce errors, and maintain compliance with the AML/CFT Act 2009 and Privacy Act 2020. Start small-try one prompt today and see how it fits into your workflow.