Which bodies regulate the provision of fintech products and services?
There are a number of regulators, depending on the type of products and services being offered. The Financial Markets Authority (FMA) is the securities regulator, which supervises offers of financial products in New Zealand and is responsible for licensing the provision of certain financial services and the enforcement of certain prudential and fair dealing standards. The Reserve Bank is responsible for the supervision and prudential regulation of banks, non-bank deposit takers and insurers as well as generally maintaining the robustness of New Zealand’s financial system. Other regulators include the Department of Internal Affairs (anti-money laundering) and the Commerce Commission.
Which activities trigger a licensing requirement in your jurisdiction?
Under the Financial Markets Conduct Act 2013 (FMCA) and subsidiary regulations, if you provide to retail investors any financial advice, crowdfunding services, robo-advice, discretionary investment management services or peer-to-peer (P2P) lending services, or if you operate a managed investment scheme for, issue derivatives (such as contract for differences and forex futures) to or take deposits from retail investors, you will need to be licensed by the FMA. Further, any person who carries on ‘insurance business’ in New Zealand must be licensed by the Reserve Bank. The term ‘retail’ generally refers to members of the public. Services provided to ‘wholesale’ investors (of which there are many categories but is the New Zealand equivalent of ‘accredited’ or ‘sophisticated’ investors in other jurisdictions) conversely do not require licensing.
In relation to advising on investments, the FMCA’s new financial advice regime came fully into force with effect from 17 March 2023. All financial advice providers (FAPs) must hold or operate under a full licence from the FMA if they wish to provide regulated financial advice to retail clients. FAPs can either be an individual or other business entity such as a company. The three classes of FAP licences are Class 1 (sole adviser businesses), Class 2 (businesses that engage more than one adviser) and Class 3 (large organisations that engage ‘nominated representatives’ among their staff). A nominated representative is an individual engaged by a licensed FAP to give regulated financial advice (which advice must be limited in nature and scope) on their behalf and who does not need their own licence. FAPs, advisers and nominated representatives face a number of compliance obligations under the regime, including adherence to the Code of professional conduct for financial advice services.
Last, there is a separate requirement for any business that provides ‘financial services’ (whether in New Zealand or from New Zealand to other countries) as required by the Financial Service Providers (Registration and Dispute Resolution) Act 2008 (FSP(RDR)A) to be registered on the Financial Services Provider Register (FSPR).
Is consumer lending regulated in your jurisdiction?
Consumer lending is regulated primarily under the Credit Contracts and Consumer Finance Act 2003 (CCCFA), which applies to a range of transactions where money is loaned for personal use such as consumer credit contracts, consumer leases and buy-back transactions. Among other things, the CCCFA and its subsidiary regulations provide general rules for credit contracts and require those to whom the CCCFA applies to adhere to certain ‘lender responsibility principles’, including by:
- acting responsibly when advertising credit or finance as well as before and after providing consumer credit or finance and taking a relevant guarantee; and
- complying with specific lender responsibilities such as disclosing certain information to borrowers.
The separate Responsible Lending Code elaborates on these principles and provides guidance both on how to comply with them as well as on the information lenders should provide to borrowers before and during the loan term.
The Ministry of Business and Innovation (MBIE) conducted a lengthy review into New Zealand’s consumer credit sector and brought in extensive changes to the CCCFA and the Responsible Lending Code in December 2021. The intent was to ease consumer access to credit while maintaining a strong level of consumer protection. Under the new regulations, lenders were required to make certain types of inquiries before agreeing to lend money to a borrower, or before agreeing to provide further credit under an existing loan, including as to the suitability of the credit product for that consumer and to assess the borrower’s income and expenses to be satisfied that the repayments are not likely to cause substantial hardship to the borrower. These changes were initially somewhat controversial, as they were interpreted as requiring lenders to trawl through applicants’ bank statements and make possibly invasive enquiries into their lifestyle choices. However, many of these changes were softened by further changes to the CCCFA and the Responsible Lending Code in July 2022 and, most recently, May 2023.
One very popular (until recently) form of consumer finance in New Zealand, buy now, pay later (BNPL), is not as of writing regulated under the CCCFA. However, the MBIE has clearly stated its intention to regulate the BNPL sector and invited submissions on an exposure draft of regulations, entitled the Credit Contracts and Consumer Finance (Buy Now Pay Later) Amendment Regulations 2022, which submissions closed on 10 March 2023. Under these new regulations (which are expected to come into force in 2023), most of the requirements of the CCCFA will apply to BNPL as a ‘consumer credit contract’ just like credit cards or personal loans. However, smaller amounts of BNPL credit below a dollar threshold (tentatively set at NZ$600) will be exempt from the CCCFA requirement to assess affordability.
Secondary market loan trading
Are there restrictions on trading loans in the secondary market in your jurisdiction?
There are no specific restrictions on trading loans, other than in relation to P2P lending. Traders of lending books would need to ensure they contractually have the right to assign the loans and would need to comply with applicable data privacy obligations. P2P lending markets must be licensed providers of a P2P lending service.
Collective investment schemes
Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.
Such schemes, in which money from a number of investors is pooled together and those investors are reliant on the investment expertise of the scheme manager, are regulated chiefly as ‘managed investment schemes’. The FMCA’s definition of these schemes is broad enough to capture most open- and closed-ended collective investment schemes and those involving participatory securities. Fintech companies providing P2P lending or crowdfunding platforms would not be regulated as a managed investment scheme, but instead would be regulated under the relevant licensing regimes for those platforms.
Alternative investment funds
Are managers of alternative investment funds regulated?
Yes, managed investment scheme managers are required both to register on the FSPR as a provider of financial services and (where they will make a regulated offer to retail investors) to be licensed by the FMA. Managers need to meet and maintain certain minimum standards (including fitness and propriety of directors and senior managers) and have obligations relating to financial reporting, fair dealing and anti-money laundering.
Peer-to-peer and marketplace lending
Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.
P2P lending is regulated by the FMA as a financial market service under the FMCA and anyone who wishes to operate such a market must be licensed as a provider of P2P lending services. Borrowers who use a licensed service are exempted from the requirement to issue a product disclosure statement (which they would otherwise be required to do, as it would be seen as the issue of a debt security to the public). Licensed P2P platforms, in addition to meeting certain minimum standards and conditions for their licence, have a number of ongoing obligations, such as notification of certain events to the FMA (as well as providing an annual regulatory return), and obligations relating to financial reporting, fair dealing and anti-money laundering.
Describe any specific regulation of crowdfunding in your jurisdiction.
The FMCA regulates equity-based crowdfunding (where companies raise money from retail investors through the issue of shares) as a financial market service. Reward-based crowdfunding is not covered, nor is any fundraising for charitable or philanthropic purposes (as long as donors do not receive shares). Under the FMCA, companies may raise up to NZ$2 million in any 12-month period on a licensed crowdfunding service provider’s platform with minimal regulatory hurdles (such as not having to issue a product disclosure statement). Licensed crowdfunding platforms, in addition to meeting certain minimum standards and conditions for their licence, have a number of ongoing obligations, such as notification of certain events to the FMA (as well as providing an annual regulatory return), and obligations relating to financial reporting, fair dealing and anti-money laundering.
Describe any specific regulation of invoice trading in your jurisdiction.
There is no specific regulation of invoice trading, but it will likely constitute a financial service under the FSP(RDR)A (being a creditor under a credit contract) and require the invoice trader to register on the FSPR as a financial services provider under that Act.
Are payment services regulated in your jurisdiction?
There currently is no specific regulation of payment services along the lines of Directive (EU) 2015/2366 (revised Payment Services Directive) (PSD2), but such services will constitute financial services under the FSP(RDR)A (as it is issuing and managing a means of payment) and require the payment services provider to register on the FSPR as a financial services provider under that Act.
Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?
Not yet, as the government has so far preferred to allow the industry to take the lead. The implementation of open banking is being spearheaded by Payments NZ (a company formed by a number of retail banks with the support of the Reserve Bank), which launched its API Centre in May 2019. This is a suite of industry-standardised application programming interfaces (APIs) for payment-related services, which is designed to manage a move to greater openness in banking and payments and to create an API-enabled ecosystem in New Zealand. Payments NZ is responsible for the governance of the API Centre but has delegated it to an API Council comprised of banks, non-bank third parties and independent members. The API Council gets recommendations from a business group and a technical group, and also has an independent sub-committee to handle sensitive issues.
Also relevant to the implementation of open banking is the Consumer Data Right (CDR), which would allow data portability. New Zealand’s Minister of Commerce and Consumer Affairs released a cabinet paper in late 2022 making recommendations on the implementation of a legislative framework for a sector-by-sector rollout of a new CDR. The legislation would introduce basic obligations for those operating within the designated sectors and allow consumers to require data holders (such as banks, utilities and healthcare providers) to securely share their data with trusted third parties. The New Zealand banking sector will be the first to implement a CDR, the details of which will be contained in an exposure draft of a data-sharing bill, which is expected to be released for industry feedback before the end of 2023. The cabinet paper suggests that the bill will provide, among other things, for tiered accreditation of data recipients and that penalties for breach of the CDR will be ranked according to their severity, with criminal penalties applying to deliberate or reckless behaviour.
Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?
Fintech companies that carry on ‘insurance business’ in New Zealand are subject to the supervision of the Reserve Bank and must be licensed. Whether or not this applies to an insurtech entity will depend on its business activities – under section 8(1) of the Insurance (Prudential Supervision) Act 2010 (IPSA)) it will be held to be carrying on insurance business if it acts as an insurer either within or outside of New Zealand or is otherwise liable as an insurer under a contract of insurance to a New Zealand policyholder. Regulation takes the form of a risk-based supervisory regime established under IPSA, requiring the licensee to meet certain criteria relating to governance, the fitness and propriety of their officers and managers, capital adequacy and liquidity.
Are there any restrictions on providing credit references or credit information services in your jurisdiction?
Credit reporting has implications under the Privacy Act 2020 (Privacy Act), New Zealand’s principal data privacy legislation. In December 2020, after public consultation, the Office of the Privacy Commissioner (OPC) overhauled the Credit Reporting Privacy Code, ostensibly to align the code with the Privacy Act that was being revised at the same time. The code applies specific privacy rules to credit reporters who sell personal credit information. The intent behind this Code is broadly to grant individuals enhanced rights in relation to the use of their personal credit information by these credit reporting agencies. These rights include, among others, imposing time limits on keeping and reporting information, limiting the use of that information to defined circumstances (and in any event requiring consent in most situations), entitling individuals to a free credit score (if the credit reporter has a practice of releasing such scores to subscribers), requiring access to credit information within 10 working days and giving reporters the right to charge for expedited access requests (namely, within three working days), entitling individuals to apply to suppress credit information if they think they have been a victim of fraud and entitling individuals to dispute inaccurate information. Individuals can also complain to the OPC if they think the code has been breached.