AI for New Zealand financial services.

Where AI fits in a regulated financial firm

AI earns its place in financial services where staff spend hours reading documents and checking them against rules: onboarding files, policy manuals, product terms, reporting packs and research. It is a poor fit for the decisions regulators care most about, such as whether advice is suitable, whether a customer is treated fairly or whether a transaction is suspicious, unless a named person makes them.

Interest is near universal among larger players. The FMA’s research published on 10 September 2024 surveyed 30 regulated entities and received 13 responses (six deposit takers, three insurers and four advice or asset management firms); all 13 had integrated generative AI or planned to soon. That is a small, self-selected sample, not a sector figure. The stakes are large: financial and insurance services contributed about $16.7 billion to Auckland’s GDP and $3.8 billion to Wellington’s in the March 2024 year (Stats NZ regional GDP tables).

Financial services workflow map

Detailed guides cover client onboarding document checks, internal policy retrieval and management reporting commentary.

What the FMA, the Reserve Bank and other rules expect

No regulator has written AI-specific rules for financial firms. Each has said existing obligations apply, and several have said more.

• FMA. It calls itself technology-neutral and pro-innovation and expects most AI risks to be covered by its existing approach. On 6 August 2026 it opened an exploratory thematic review of AI in financial advice. At its April 2026 workshop with the University of Auckland’s ALTeR centre there was broad consensus that primary responsibility for AI use rests with the advice licensee.
• Reserve Bank and FMA together. In May 2025 the RBNZ said regulated entities must manage AI risks within existing obligations and flagged reliance on a few AI providers as a concentration risk. On 15 October 2026 the two regulators set joint supervisory expectations on cyber risk from frontier AI: boards must know where AI is used, its risks and who is accountable.
• Fair conduct. The Conduct of Financial Institutions regime came into full effect on 31 March 2025. Licensed banks, insurers and non-bank deposit takers must establish, implement and maintain a fair conduct programme, and AI in customer journeys sits inside it.
• AML/CFT. The AML/CFT Act puts the due diligence and record-keeping duties (ss 11 and 50) on the reporting entity itself. An onboarding system can collect and check documents faster; it cannot carry the obligation.

This is general information. Talk to your compliance adviser or lawyer before changing a regulated process, and see our AI governance advisory for setting up the register and controls boards are now expected to oversee.

Systems, data location and concentration risk

Most firms run a core banking, registry or loan system, a CRM such as Salesforce, an advice platform, Microsoft 365 and Power BI. AI should read these through controlled interfaces, and our notes on Salesforce and Power BI cover the patterns.

Data location needs a decision, not an assumption. As at October 2026 no major AI vendor offers guaranteed processing inside New Zealand; Amazon Bedrock’s AU profile keeps Claude processing within Australia and New Zealand. Given the Reserve Bank’s concentration warning, design so you can switch models without rebuilding. Our guide to data residency for AI systems sets out the options.

A first project: internal policy retrieval with citations

Policy retrieval is read-only, touches no customer decision and is easy to test, which makes it the right first project for most firms.

Inputs

The approved policy and procedure library, with version numbers and owners.

Systems

SharePoint or your document store, a retrieval index that respects access rights, and a model chosen by testing.

Steps

Staff ask a question; the system retrieves current clauses, answers with quotations and links, or says the policies do not cover it.

Human review

The compliance owner approves a 50-question test set before launch and reviews a weekly sample.

Outputs

A cited answer, or a referral to compliance.

Measures

Accuracy and citation correctness on the test set, referral rate, and time staff wait for an answer.

Risks

Superseded versions, answers that stray into advice, and questions outside the library.

Illustrative example: a 60-person advice and fund management business fields about 40 policy questions a week, each taking a compliance officer 10 minutes, about 6.7 hours. If the assistant answers 60% with correct citations and refers the rest, compliance time falls by roughly 4 hours a week, around 200 hours a year. Launch only when the system scores at least 48 of 50 on the test set and refuses every out-of-scope question. RAG development is how we build it.

What Lucent shows about cited research

Lucent is a Levy Street venture: an agentic investment research platform for wealth, equity and private-markets teams, covering NZX and ASX, that runs several frontier models together and grounds outputs in citations. The same principle applies to any financial AI system: if a reviewer cannot click from a sentence to its source, the sentence should not be there.

Where AI fails in financial services

Workflows we map in this sector

• Internal policy retrievalStaff ask what the policy says and get the clause, version and effective date, including what applied on a past date.
• Management reporting commentaryBoard and committee pack commentary drafted from computed metrics and business owners' notes, with every figure traced.
• Client onboarding document checksOnboarding packs pre-checked for expiry, certification, name matches and missing owners before an analyst opens them.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.