Reporting Crypto-Asset Service Providers must carry out due diligence to determine if a crypto-asset user is a reportable user.
Users you must report information on
You must report information on crypto-asset users who are tax resident in a reportable jurisdiction.
Crypto-asset users are individuals, controlling persons and entities that are customers of Reporting Crypto‑Asset Service Providers (RCASPs) for the purpose of carrying out relevant transactions. Where someone acts on behalf of another, it is the individual, controlling persons or entity behind the transaction that is treated as the crypto-asset user.
You do not have to report information about active entities or excluded persons.
The OECD guidance explains all the terms we use.
Crypto-Asset Reporting Framework (oecd.org)
Get self-certifications from all users
You must get a self-certification from all users. The information provided must include identifying information and tax residency details. This must be signed or otherwise positively affirmed.
Timeframes for due diligence actions
You must complete due diligence actions for new users at sign-up — before any transactions take place.
For pre-existing users with an account on 31 March 2026, you must get their self-certification by 31 March 2027.
Keeping records
You must keep records showing the steps you have taken to collect the information and the information you relied on to carry out your due diligence requirements. We may charge penalties if you do not keep these records.
Keep the records in New Zealand and in English or te reo Māori. The only exception is if we have approved their storage outside New Zealand or in a different language. You must keep this information for at least 7 years following the end of the reportable period.