New Zealand's financial sector answers to two regulators with different remits over the same institutions. The Reserve Bank supervises prudential soundness; the Financial Markets Authority supervises conduct. An Auckland bank or insurer holds obligations to both, arriving separately, assessed separately, and frequently tracked by different teams who do not compare notes.

Layered on that is the conduct licensing regime, which requires licensed financial institutions to establish and maintain fair conduct programmes. That is a compliance management obligation in everything but name, and organisations that already run a structured obligations register found it considerably less disruptive than those that did not.

Nathan ISO Consulting implements compliance management systems under ISO 37301:2021 for Auckland organisations across financial services, health and care providers, education, government supply and the not-for-profit sector.

Why ISO 37301 matters for Auckland organisations

The dual-regulator structure is the first reason. Prudential and conduct obligations overlap in places and diverge in others, and an organisation without a consolidated view cannot say with confidence whether something falls to one, the other or both. That ambiguity is where obligations get missed.

The fair conduct regime is the second, and it changed the nature of the question. A fair conduct programme requires effective policies, processes, systems and controls, and it must be maintained rather than merely established. Demonstrating maintenance means demonstrating monitoring, review and change control, which is precisely what a compliance management system provides.

Anti-money laundering supplies a third layer with an unusual structure. New Zealand divides supervision of reporting entities between three supervisors depending on sector, which means an Auckland business can hold obligations under the same Act as its competitor while dealing with a different supervisor entirely. Knowing which applies to you is not always obvious and getting it wrong shapes everything downstream.

The regimes an Auckland register has to carry

Regime	Examples relevant to Auckland	What it generates
Prudential supervision	Reserve Bank oversight of registered banks, licensed insurers and deposit takers	Prudential standards, outsourcing requirements, reporting and disclosure obligations
Conduct regulation	Financial Markets Authority oversight of market participants and licensed institutions	Licence conditions, fair conduct programme obligations, disclosure and advice standards
Anti-money laundering	Reporting entity obligations under the AML/CFT regime, supervised by one of three supervisors by sector	Risk assessment, compliance programme, customer due diligence, reporting and audit
Consumer and competition law	Commerce Commission oversight of fair trading, credit contracts and competition	Conduct obligations, disclosure duties and substantiation requirements
Privacy regulation	Office of the Privacy Commissioner under the Privacy Act and applicable codes	Information handling duties and breach notification obligations
Workplace regulation	WorkSafe New Zealand under HSWA, and employment standards obligations	Duties, notification requirements and record keeping
Sector licensing and quality	Health and disability standards, education regulation, care provider requirements	Standards, audit regimes and notification duties on independent cycles
Entity and governance obligations	Companies Act, charities regulation, and the incorporated societies regime requiring re-registration	Constitutional, reporting and officer duty obligations

Auckland business districts and regions

Auckland location	Business activity	Compliance driver
Auckland CBD and Britomart	Banks, insurers, fund managers, financial advice providers	Dual prudential and conduct supervision, fair conduct programmes
Shortland Street and legal precinct	Law firms, accounting practices, trustee companies	Professional obligations and AML/CFT reporting entity duties
Newmarket and Parnell	Financial advice, wealth management, professional services	Licensing conditions and advice standards
Takapuna and the North Shore	Insurance operations, financial services back office	Outsourcing obligations flowing from regulated clients
Health and care providers	Hospitals, aged residential care, disability services	Health and disability standards, audit regimes, notification duties
Education providers	Tertiary institutions, private training establishments, schools	Regulatory obligations, funding conditions and student protection requirements
Government supply	Agencies and contracted service providers	Procurement obligations, privacy duties and contractual compliance terms
Not-for-profit and membership sector	Societies, charities, clubs and associations	Re-registration obligations, charities reporting and officer duties
Property and lending	Non-bank lenders, property finance, real estate services	Credit contracts obligations, AML/CFT duties and conduct requirements

Fair conduct programmes and why they resemble a compliance system

The conduct licensing regime requires licensed financial institutions to establish and maintain an effective fair conduct programme: policies, processes, systems and controls designed to ensure the institution complies with its fair conduct principle obligations.

Read that against ISO 37301 and the overlap is substantial. Both require identifying what you must comply with, allocating responsibility, designing controls, monitoring whether they work, and reviewing and improving the arrangement over time. The difference is that the standard provides a tested structure and an external assessment, while the regulatory obligation provides the requirement without prescribing the form.

Institutions that built a fair conduct programme on top of an existing compliance management structure found the exercise considerably lighter. Those that built one in isolation now maintain two overlapping frameworks describing the same controls, which is a recurring and avoidable cost.

Working with us in Auckland

Design and build

Scoping establishes which entities, licences, supervisors and activities are in, and which regulator attaches to each. The register is built from your own licences, group structure, contracts and applicable codes rather than a sector template, because templates rarely handle the dual-regulator structure correctly. Compliance risk assessment follows, producing a priority order the board will accept, then control mapping and the governance, reporting and monitoring arrangements.

Reaching the certificate

Compliance management is a smaller certification market than quality or security and the New Zealand assessor pool is smaller again, so scheduling starts early. We identify assessors with genuine regulated sector experience, settle terms, and complete readiness through internal audit and a documented review. Both stages attended.

Life after the audit

Obligations registers decay quietly as instruments are amended, licence conditions varied and guidance reissued, none of it announced internally. Maintenance is ours, alongside the audit cycle and surveillance preparation, so what the register says matches the current position rather than the position at handover.

What gets delivered

Obligation register. Each requirement carrying its source instrument, the supervisor it answers to, the activity it governs, a named owner and the control with evidence.
Regulator mapping. Which obligations sit with which supervisor, and where prudential and conduct requirements overlap or diverge.
Fair conduct programme alignment. Where applicable, the programme structured so it draws on the same register and controls rather than duplicating them.
Compliance risk assessment. Obligations rated for likelihood and consequence of failure, producing a monitoring priority that withstands board scrutiny.
Breach and notification framework. Identification, threshold assessment, escalation and reporting to the right supervisor, with reasoning recorded either way.
Monitoring plan and board reporting. Testing scope, frequency and method agreed at committee level, with coverage and open items clearly visible.

Where Auckland ISO 37301 projects go wrong

Prudential and conduct obligations tracked by separate teams with no consolidated view, so overlaps and gaps both go unnoticed.
A fair conduct programme built in isolation, creating a second framework describing the same controls as the compliance system.
AML/CFT obligations scoped without first confirming which supervisor applies, which shapes everything downstream.
Every obligation owned by the compliance function, which reads to a regulator as delegated rather than accepted accountability.
Monitoring performed when capacity allows rather than to a plan with defined scope and frequency.
Entity and governance obligations overlooked, particularly where re-registration or constitutional requirements have changed.

Who certifies you, and where we fit

We implement. An accredited body certifies.

Nathan ISO Consulting builds and implements management systems. We do not issue certificates, and no legitimate consultancy does. Your certificate comes from an independent certification body accredited by JAS-ANZ, the accreditation authority established jointly by the New Zealand and Australian governments. Accredited bodies operate under impartiality rules that prohibit them from certifying a system they helped build, which is precisely why the two roles are separate. Our job is to get you audit-ready, help you select the right accredited body, and stand alongside you through assessment.

Choosing the accredited body, agreeing what it costs and fixing when it happens are tasks we absorb, weighed against your scope, your sector and the audit style that suits how you work. We sit through Stage 1 and Stage 2 with your team, and clearing whatever is raised falls to us rather than landing on your desk afterwards. One check worth making yourself: confirm on the JAS-ANZ register that the body holds accreditation for your scope. Unaccredited certificates are cheap and fast, and procurement teams decline them often enough to justify the minute it takes.

FAQ'S

No. We are an implementation consultancy. Certificates are issued by independent certification bodies accredited by JAS-ANZ. Accreditation rules prevent a body from certifying a system it helped build, so the consulting and certification roles must stay separate.

A JAS-ANZ accredited certification body of your choosing. We shortlist accredited bodies against your scope and sector, manage the quote process, and attend both audit stages with you. The certificate and the audit decision rest entirely with them.

Check the JAS-ANZ register and confirm the body is accredited for the specific standard and scope you need. Unaccredited certificates are widely available, inexpensive and routinely rejected by procurement teams, which means paying twice and starting over.

No consultancy honestly can, because the decision belongs to an independent auditor. What we can do is run your internal audit the way an external auditor would, close findings before assessment, and attend both stages so issues get resolved in the room.

Licensed financial institutions must establish and maintain effective policies, processes, systems and controls designed to ensure compliance with fair conduct obligations. It closely resembles a compliance management system, which is why building both on one structure avoids duplication.

The Reserve Bank supervises prudential soundness while the Financial Markets Authority supervises conduct. Obligations arrive separately and are assessed separately, so organisations without a consolidated register struggle to say which requirement belongs where.

New Zealand allocates supervision of reporting entities across three supervisors depending on sector. Which one applies to you shapes your programme, your reporting relationship and your audit expectations, so confirming it is the first step rather than a detail.

The earlier document offered guidance with no certification pathway. The current standard converted those concepts into auditable requirements. Work done to the guidance retains value, though the structure needs rebuilding before certification is possible.

No condition is discharged by a certificate. What changes is the ability to demonstrate compliance immediately when asked, which usually determines whether a supervisory review closes promptly or expands.

Whoever performs the activity it governs, with the compliance function maintaining the register and providing oversight. A register where one function owns everything signals to a regulator that the business has not accepted responsibility.

If you are an incorporated society, existing societies were required to re-register under the 2022 Act, with the deadline in April 2026. Confirm your status with the Companies Office, as failing to re-register has consequences for the entity itself.

The standard requires a compliance function with defined authority and direct access to the governing body, without mandating a title or headcount. Smaller Auckland organisations often combine it with legal or risk where independence is genuine.

Five to eight months typically. Register construction sets the pace, and organisations answering to multiple supervisors sit at the upper end. Compressing that phase produces something that fails at the first supervisory enquiry.

Readily. The clause architecture matches security, continuity and quality standards, so governance, audit and review are built once. Regulated Auckland organisations commonly run several certificates from a single system.

Send us your licences

Your licences, your supervisor relationships and the compliance schedules from major contracts size the register more accurately than any scoping workshop could.