New Zealand's approach to cryptoassets is best described as deliberate minimalism. Rather than write a crypto statute, successive governments have stretched existing law across the sector: the Financial Markets Conduct Act, the AML/CFT Act, the Financial Service Providers Act, the Fair Trading Act and ordinary income tax rules. That produces a system with real obligations and very little of the protection people assume comes with them.
The single most important thing to understand
There is no crypto exchange licence in New Zealand. When a platform advertises itself as "regulated in New Zealand", what that almost always means is that it appears on the Financial Service Providers Register — a registration, not an authorisation. Registration confirms the business has met registration requirements and, where it serves retail clients, belongs to a dispute resolution scheme. It is not a solvency assessment, not an endorsement, and not a guarantee about anything at all.
This is not a criticism of registration; it is a warning about how it is marketed. Check the register — it is genuinely useful, it is free, and an absence from it is a serious red flag. Just do not read more into a listing than is there.
Who does what
| Body | Responsibility |
|---|---|
| Financial Markets Authority (FMA)Official site | Conduct and disclosure when a crypto offer is a regulated financial product; publishes the warning list. |
| Department of Internal Affairs (DIA)Official site | Sole AML/CFT supervisor for reporting entities from 1 July 2026, including virtual asset service providers. |
| Inland Revenue (IRD)Official site | Taxes cryptoassets as property; runs the Crypto-Asset Reporting Framework from 1 April 2026. |
| Financial Service Providers RegisterOfficial site | Public register where every NZ-facing provider must appear before it can lawfully offer services. |
| Commerce CommissionOfficial site | Enforces the Fair Trading Act and the Consumer Guarantees Act against misleading claims. |
| Serious Fraud OfficeOfficial site | Investigates large-scale financial crime, including the collapse of Dasset. |
Anti-money-laundering: the regime with real teeth
The AML/CFT Act is where crypto businesses face genuine, enforceable obligations. A virtual asset service provider — a business that exchanges virtual assets for fiat or for each other, transfers them, keeps them safe for others, or provides financial services relating to them — is a reporting entity. That brings customer due diligence, transaction monitoring, suspicious activity reporting, an annual compliance report and an independent audit.
Supervision consolidated significantly in 2026. Under the Anti-Money Laundering and Countering Financing of Terrorism (Supervisor, Levy, and Other Matters) Amendment Act 2026, the Department of Internal Affairs became the sole AML/CFT supervisor for all reporting entities on 1 July 2026, replacing the previous three-supervisor split. For crypto businesses, which were already mostly DIA-supervised, the practical change is a single consistent point of contact and enforcement.
This is why every legitimate platform asks for your passport. It is not optional, and a venue that lets you move meaningful sums without verification is either operating illegally or is not what it claims to be.
Check these two registers before you deposit
The Financial Service Providers Register tells you whether a provider is registered and which dispute scheme it belongs to. The FMA warnings and alerts list tells you whether the regulator has already flagged it. Both take under a minute and between them they filter out most of what goes wrong.
When crypto becomes a regulated financial product
The Financial Markets Conduct Act catches crypto offers that function like traditional financial products — a token that operates as a debt security, a managed investment scheme, or a derivative. Where that line is crossed, full disclosure, licensing and conduct obligations follow, and the Financial Markets Authority supervises.
Most straightforward cryptoassets fall outside it. A useful illustration arrived in March 2026, when the FMA made a first-of-its-kind determination that Easy Crypto's non-yielding NZDD stablecoin is not a financial product under New Zealand law, effective 11 March 2026. The reasoning matters more than the specific outcome: what determines regulatory treatment is the economic substance of the arrangement, not the label on the token.
Consumer protection and complaints
The Fair Trading Act prohibits misleading and deceptive conduct, and the Consumer Guarantees Act requires services to be provided with reasonable care and skill. Both are enforced by the Commerce Commission and both apply to crypto businesses operating here, which is why exaggerated return claims are legally risky rather than merely distasteful.
For individual disputes, a registered provider serving retail clients must belong to an approved dispute resolution scheme. Financial Services Complaints Ltd and the Insurance and Financial Services Ombudsman merged their operations from 1 July 2025 and together handle the large majority of non-banking financial complaints. The service is free to consumers and can make binding awards well into six figures.
Against an unregistered offshore platform, none of this helps. That asymmetry is the strongest practical argument for using registered providers as your on-ramp and off-ramp even if their fees are marginally higher.
What is not protected
There is no deposit guarantee for cryptoassets. There is no compensation scheme. There is no insurance backstop provided by government. If a platform fails, you are an unsecured creditor and you will discover exactly what that means. Dasset's liquidation established the point painfully: the first liquidator report identified roughly NZ$6.3 million of customer crypto unaccounted for against around NZ$600,000 actually on hand, and the Serious Fraud Office opened an investigation in February 2024.
No amount of regulation currently in force would have prevented that. The only mechanism that protects a New Zealander from platform failure is not keeping assets on the platform. Our exchange failures page walks through each collapse and what it cost.
Where the rules are heading
Three directions are visible. Tax transparency is tightening: the Crypto-Asset Reporting Framework took effect on 1 April 2026 with first reports due mid-2027. Cash controls are being built: rather than banning crypto ATMs, Cabinet opted in July 2026 for regulation-making powers to restrict cash transactions in virtual assets, with thresholds still to be consulted on. And AML supervision has consolidated into a single agency.
What is not visible is any move toward a comprehensive licensing regime of the kind the European Union built with MiCA. For the foreseeable future, New Zealanders assessing a platform will be doing the work themselves. This site exists largely because that is true.
A practical due diligence sequence
- Search the FSPR for the exact legal entity name, not the brand. Note the registration number and dispute scheme.
- Check the FMA warning list for the entity, the brand and any similar names.
- Find the terms of service and identify which country's law governs them. This determines where a dispute goes.
- Locate the withdrawal policy before depositing. Limits, delays and fees should be documented, not discovered.
- Test the exit with a small amount in the first week, while the sum involved is trivial.