New Zealand: technology regulation at a glance

Framework: No bespoke crypto law; existing regimes apply — Financial Markets Conduct Act 2013 (FMA), AML/CFT Act 2009 (DIA supervision of VASPs on the FSPR), and Income Tax Act (IRD). CARF reporting takes effect 1 April 2026, and the FMA is developing a fintech sandbox and 'on-ramp' restricted licence.

Crypto is legal in New Zealand and regulated through a patchwork of existing financial-services, AML/CFT and tax laws rather than a dedicated crypto framework. The FMA regulates crypto that qualifies as a 'financial product' under the FMC Act, the DIA supervises VASPs for AML/CFT, and IRD taxes crypto as property/ordinary income; the regime is evolving with the March 2026 NZDD stablecoin designation, CARF reporting from 1 April 2026, and pending AML/CFT reforms.

Framework: No AI-specific legislation. Governance rests on a non-binding national strategy (MBIE's 'New Zealand's Strategy for Artificial Intelligence: Investing with Confidence', July 2025), voluntary guidance built on the OECD AI Principles, and existing technology-neutral laws (notably the Privacy Act 2020 and consumer/competition law).

New Zealand has deliberately chosen NOT to enact comprehensive or AI-specific legislation, instead adopting a 'light-touch, proportionate and risk-based' approach. AI is governed through a voluntary national strategy, OECD-aligned principles, and sector guidance (privacy, public service), with existing technology-neutral statutes applied to AI as needed. The emphasis is on accelerating responsible AI adoption rather than imposing new prescriptive rules.

Framework: Privacy Act 2020 (as amended by the Privacy Amendment Act 2025), administered by the Office of the Privacy Commissioner (Te Mana Mātāpono Matatapu).

New Zealand has a comprehensive, principles-based personal-data protection regime governed by the Privacy Act 2020, which took effect on 1 December 2020 (replacing the 1993 Act) and applies to public and private sector 'agencies'. It is built around Information Privacy Principles (IPPs) and overseen by the independent Office of the Privacy Commissioner, which can investigate complaints, issue compliance notices and make binding access directions. New Zealand holds EU GDPR adequacy status, confirmed as maintained in January 2024.

Framework: No dedicated payments/e-money licence. Payment & fintech firms fall under general financial-services law, the Financial Markets Conduct Act 2013 and Non-bank Deposit Takers Act 2013 (FMA conduct + Reserve Bank of New Zealand prudential 'twin peaks'), the AML/CFT Act, the Credit Contracts and Consumer Finance Act (BNPL), and the Customer and Product Data Act 2025 (open banking accreditation via MBIE).

New Zealand does not operate a specific payment-institution or e-money licensing regime; instead, payment and fintech providers are regulated by activity under existing financial-services laws, with the FMA (conduct) and the Reserve Bank (prudential) sharing oversight. However, several targeted regimes are now in force, a legislated consumer data right / open-banking accreditation scheme (Customer and Product Data Act 2025, live from December 2025) and BNPL brought under the CCCFA from September 2024, while a domestic real-time payments rail is still only being scoped.

Framework: Immigration New Zealand (Immigration Act 2009 / Immigration Instructions), visitor visa and NZeTA conditions, updated 27 January 2025

New Zealand has no dedicated digital-nomad visa, but since 27 January 2025 all visitor visas and NZeTA entries explicitly permit remote work for overseas employers or clients, effectively enabling digital nomads to work legally while visiting. Standard visitor stays are capped at 9 months in an 18-month period, so it is a short-to-medium-stay pathway rather than a residency route. Separately, a high-threshold residency-by-investment program (Active Investor Plus Visa) offers a route to residence for wealthy relocators.

Framework: Harmful Digital Communications Act 2015 (Netsafe as Approved Agency; District Court remedies) plus Films, Videos, and Publications Classification Act 1993 (Chief Censor / DIA take-down powers); no comprehensive online-platform safety statute, with proposals pending.

New Zealand regulates online content through a patchwork of targeted laws rather than a single comprehensive online-safety/platform regime. The Harmful Digital Communications Act 2015 provides civil and criminal remedies for individual harm via Netsafe and the District Court, while the Films, Videos, and Publications Classification Act 1993 lets the Chief Censor classify content and DIA issue take-down notices for 'objectionable' material. As of mid-2026 there is no DSA/OSA-style platform-liability or general age-verification law in force: a proposed under-16 social media bill and a parliamentary inquiry's recommendations exist but are paused or non-binding.

Framework: No single comprehensive cybersecurity statute. Obligations are sector-specific: the Privacy Act 2020 (breach notification, Office of the Privacy Commissioner), Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) reporting rules for regulated financial entities, NCSC/GCSB minimum standards for public-sector agencies, and a proposed mandatory critical-infrastructure regime (consultation closed April 2026).

New Zealand has no overarching NIS2-style cybersecurity law in force; obligations are spread across sector-specific instruments. Mandatory breach notification exists under the Privacy Act 2020 (serious-harm threshold), the RBNZ/FMA impose cyber-incident reporting on banks, insurers and other regulated financial entities, and the NCSC sets minimum standards for government agencies. A proposed mandatory regime for critical infrastructure, including 24-hour/72-hour incident reporting to the NCSC, was consulted on in early 2026 but is not yet enacted.

Framework: Companies Act 1993, administered by the New Zealand Companies Office (Ministry of Business, Innovation and Employment); foreign investment in sensitive land/significant business assets screened under the Overseas Investment Act 2005 (Land Information New Zealand / Treasury).

New Zealand is consistently one of the easiest countries in the world to start a business: incorporation is done online through the Companies Office, usually completed within one working day, with no minimum capital requirement and 100% foreign ownership permitted. The main constraint for foreigners is the mandatory resident director rule, and large foreign investments may trigger separate screening under the Overseas Investment Act.