About the application form
We will send you the application form after your introductory meeting. The form is an interactive PDF that asks for:
- business details, including information on your activities, ownership and governance
- information on your prudential supervisory status in your home jurisdiction
- information on your anti-money laundering supervisory status and compliance, and financial crime controls
- operational information, including your operational risk management framework and/or policies and procedures, incident management procedures and a Business Continuity Plan (BCP) or Disaster Recovery Plan (DRP)
- information on any notifiable cyber security incidents or events.
Supporting information
You’ll need to submit the following with your completed application form.
Independent legal attestation
What you need to demonstrate
- Your status under the relevant law and regulatory requirements of your home jurisdiction, equivalent to a reporting entity under the New Zealand Anti-Money Laundering and Countering Financing of Terrorism Act 2009 (AML/CFT).
- That the law and regulatory requirements of your home jurisdiction achieve the purposes of the AML/CFT.
- That your compliance history demonstrates your compliance, risk management, and overall prudence in countering financial crime under the relevant law and regulatory requirements of your home jurisdiction.
What you need to demonstrate
- That the law and regulatory requirements of your home jurisdiction achieve the purposes of the New Zealand Banking (Prudential Supervision) Act 1989, the Non-bank Deposit Takers Act 2013, the Financial Market Infrastructures Act 2021, and the Deposit Takers Act 2023 (New Zealand prudential legislations).
- That the nature and extent of prudential supervision that apply to your entity achieve the equivalent level of prudential supervision under the New Zealand prudential legislations.
- Your licensing status under the law and regulatory requirements in your home jurisdiction, and your compliance with these requirements.
What you need to demonstrate
- The enforceability of the ESAS rules in your home jurisdiction.
- That there is no impediment to your ability to meet your obligations under the ESAS rules.
RBNZ cyber capability survey
Download the survey template (XLSX, 153 KB)
While this survey references regulated entities, we use it to assess the cyber capabilities of both regulated and unregulated entities in relation to using ESAS and it must be completed as part of your application process.
See our guidance on cyber resilience (PDF, 650 KB)
Swift Customer Security Programme (CSP) annual attestation
If you’re already a member of Swift, you will be asked to submit a copy of your Swift Customer Security Programme (CSP) annual attestation, a security attestation required of all Swift users showing compliance levels with Swift controls.
Prerequisites
Prerequisites such as participation in a clearing system operated by Payments NZ or Swift connectivity (if you’re not already a Swift member) may apply, depending on your current situation and how you intend to use ESAS.
We will discuss this with you during your introductory meeting, to help you work out what you need and next steps.