A Christchurch crypto broker needed almost a year of anti-money-laundering work before it could open, and its founder now argues that the AML/CFT Omnibus Amendment Bill should fix what he ran into. Interest.co.nz published the account on November 13, 2026, under the headline “It took almost a year of anti-money laundering work to open a small crypto broker. Here is what the Omnibus Bill should fix.”

The business is Flow Crypto NZ, and the person telling the story is Eli Hylands. His account covers three things: what the current AML/CFT rules cost a very small business, which of those rules actually prevent crime, and “one undefined word” in the Omnibus Bill. That last item is the sharpest point in the piece, because a single vague term can decide whether a one-person firm can follow a law at all.

Regulators in other countries are pressing on the same pressure points. The US Treasury’s action against MEXC, covered in our report on FinCEN cutting off MEXC over $16B in alleged flows, shows what enforcement looks like at the big end of the market. The Flow Crypto NZ story shows the opposite end, where the work lands on one founder and a laptop. This analysis separates what is confirmed from what is not, then looks at what the Bill could change for small crypto firms and the developers who build their compliance software.

Don't miss new tech stories on Google

Add Shattered once in the Google app and our stories show up in your news suggestions.

What Happened: A Year of Paperwork for One Small Broker

The core facts are short. Flow Crypto NZ is a crypto exchange in Christchurch, New Zealand, and the headline calls it a small crypto broker. Before it opened, the firm spent almost a year on anti-money-laundering work. Interest.co.nz ties that experience to the AML/CFT Omnibus Amendment Bill, which is the vehicle the government is using to rewrite parts of the country’s AML/CFT regime.

The timing matters. The Bill page on Interest.co.nz carries a publication stamp of November 13, 2026, at 9:49am, so this is current news and not a retrospective. A small operator is describing the compliance burden while the legislation is still in play. That makes the account useful to lawmakers, to supervisors and to anyone weighing whether to launch a regulated crypto business in New Zealand.

What the sources do not provide is also worth stating up front. The accessible reporting does not give an exact dollar cost for the year of work. It does not list a regulatory decision on Flow Crypto NZ’s application, and it does not quote the Bill’s text on the undefined word. Where this article goes beyond the headline facts, it labels the material as reported or as analysis.

The Facts on the Record

The table below lays out what the verified material supports and what it leaves open. Readers who cite this story elsewhere should stay inside the left two columns.

Three of the five confirmed rows are names and a date. The substance sits in the time claim and in the argument about the Bill. That is typical of a first-person policy piece. It is strong on lived detail and light on audited numbers, which is why the analysis below leans on the structure of the rules instead of invented statistics.

What Flow Crypto NZ Had to Build Before Serving a Customer

Hylands lists the pre-launch hurdles in plain terms. In his words, “Before we could serve one customer we had to register on the Financial Service Providers Register, join an approved dispute resolution scheme, write a risk assessment and an AML/CFT programme, and come under Department of Internal Affairs supervision.”

Each of those steps has its own owner, its own paperwork and its own wait. A larger exchange hands them to separate teams. A small broker hands them to one person. The table sorts the five obligations by the kind of work they demand.

The last column is analysis, not reporting. It is a fair description of how larger financial firms divide the work, and it explains why a year feels long for a business with one decision-maker. Nothing on the list is exotic. The pain comes from stacking all five before the first sale.

One Founder, Three Jobs: Compliance Officer, Developer, Reviewer

Hylands describes his own role in the same first-person account. He says, “I am also its AML compliance officer, I wrote its software, and I review every customer application myself.” He also states, “I run Flow Crypto NZ, a crypto exchange in Christchurch that opened in September.”

That combination is the heart of the story for this site’s readers. The person who writes the code also signs off the compliance programme and reads every application. In a big firm those jobs sit in different reporting lines, partly so that nobody marks their own homework. In a one-person broker the separation disappears, and the law still expects the controls to work.

It also changes the security picture. A founder who builds the onboarding system holds the keys, the customer files and the review queue in one place. Our coverage of 1,379 secrets exposed through Claude Code settings files on GitHub shows how easily a solo developer leaks credentials by accident. A compliance stack that stores identity documents makes that risk heavier, not lighter.

What the AML/CFT Omnibus Amendment Bill Proposes

Beyond Hylands’ own account, Interest.co.nz coverage of the Bill, as summarized in the research behind this story, points to a package of changes. The table groups them and gives a plain reading of what each could mean for a small crypto broker. The right-hand column is analysis.

The mix is not a simple deregulation. Some items cut routine checks, and others raise the stakes for getting a judgment wrong. For a firm of one, the net result depends on whether the looser rules save more time than the sharper penalties cost in caution.

The “One Undefined Word” Problem

Interest.co.nz flags “one undefined word” in the Omnibus Bill as a concern. The accessible results do not reveal which word it is, and this article will not guess. The more useful question is why an undefined term hurts small firms in particular.

A large exchange can buy legal opinions, test an interpretation with its supervisor and absorb the risk of being wrong. A small broker cannot afford that route. When a statute leaves a key term open, the small firm has two choices. It can read the term narrowly and risk a breach, or it can read it broadly and build controls it may not need. Both choices cost money, and the second one also costs customers.

Developers know this pattern well. An API with an ambiguous field name forces every integrator to guess, and the guesses diverge. Statutes work the same way. A definition written once in the Bill, or in guidance published by the supervisor, would save every small firm from solving the same puzzle alone.

Risk-Based Rules and the Case for Judgment Calls

Reported coverage describes the Bill’s policy direction as risk-based regulation instead of universal box-ticking. In theory that helps small firms, because they can scale effort to actual risk. A low-risk customer buying a modest amount gets lighter checks, and attention shifts to the cases that matter.

Legal commentators cited in the coverage questioned whether the Bill would lower compliance costs or just move more responsibility into case-by-case judgments. That concern deserves weight. A checklist is expensive to build but cheap to run. A judgment call is cheap to describe but expensive to defend, especially for a business without a legal department.

Where judgment helps and where it hurts

Judgment helps when the firm has good data and a clear standard. It hurts when the standard is vague and the penalty is real. The Bill’s higher penalties and new infringement regime raise the price of a wrong call, so the quality of supervisor guidance will decide whether risk-based rules feel like relief or like a trap.

The Crypto Cash Offence and the Missing Threshold

One crypto-specific proposal stands out. Per the reporting summarized here, the Bill would make it an offence to knowingly or recklessly buy or sell virtual assets with cash above a future threshold. The Bill does not set that number. The Ministry of Justice reportedly planned consultation on the threshold in early 2027.

The same coverage notes that Cabinet agreed in principle in 2025 to ban crypto ATMs, then in July 2026 dropped an outright ban in favor of a power to restrict virtual-asset cash transactions through regulation. That shift moves the real decision from Parliament to a later regulation, which means the final line will be drawn after the Bill passes.

For a broker like Flow Crypto NZ, the practical effect depends on whether it takes cash at all. A firm that accepts only bank transfers faces little direct exposure. It still has to confirm that its onboarding and monitoring rules reflect the offence, and it cannot finish that work until the threshold exists. A legal rule with a blank number is hard to turn into code.

DIA as Sole Supervisor: Current Model vs Proposed

The research also reports that the government announced in 2026 that the Department of Internal Affairs would become New Zealand’s sole AML/CFT supervisor. Today three bodies share the job, with DIA, the Reserve Bank and the Financial Markets Authority each overseeing different sectors. Flow Crypto NZ already answers to DIA, so the change would not move its supervisor. It would change the system around it.

  • Current model: three supervisors, split by sector, with different contacts and different habits.
  • Proposed model: one supervisor, with one set of guidance and one enforcement approach.
  • Funding: an industry levy was proposed to pay for the system, with implementation not expected before 2027.
  • Open question: whether a single supervisor can give fast, consistent answers to hundreds of small firms.

A single supervisor is good news for consistency. It could be bad news for responsiveness if the workload grows faster than the staff. The levy adds another wrinkle, since a flat charge hits a one-person broker harder than a bank in proportion to revenue. The design of that levy will matter as much as the Bill itself.

Why This Matters for Developers: Compliance as Code

This story belongs in the coding-tools conversation because AML compliance at a small firm is mostly a software problem. Hylands wrote the broker’s software himself. Customer onboarding, risk scoring, record keeping and review queues all run as code, and every legal change becomes a ticket.

Developers in this position tend to ask the same questions. Which rules are stable enough to hard-code? Which should live in configuration so they can change without a deploy? How do you keep an audit trail that a supervisor will accept? An undefined term in the law makes all three harder, since the safe answer is to build flexible rules and log everything.

AI coding assistants now speed up that work, but they bring their own exposure when they touch customer data. Our step-by-step 12-step audit of open-source AI coding assistants for outbound traffic shows how to check what a tool sends off the machine before it sees regulated data. Readers who follow software tooling more broadly can find related pieces in our software section.

Historical Context: From the 2009 Law to the Omnibus Bill

Interest.co.nz coverage frames the Omnibus Bill as the largest AML reform since the AML/CFT law was enacted in 2009, a description attributed in that coverage to the Justice Minister. The 2009 law was written before crypto exchanges existed as a consumer category. Over the years since, the rules were extended to cover virtual asset businesses, and the compliance load grew with each extension.

Earlier reforms already trimmed some friction. Hylands acknowledges this directly, saying “The reform programme has already fixed some of this.” He adds, “Earlier changes removed mandatory address verification.” Those two lines matter because they show the argument is not against reform. It is a request to finish the job and to make the new text usable by firms of one.

The Bill’s own path is uncertain. Reports say it was introduced in the final weeks of the previous Parliament and will lapse unless the incoming government adopts it. If that holds, the small-business fixes Hylands wants depend on a political decision as well as a drafting one.

Market Impact: Who Pays When Compliance Costs Are Fixed

Fixed regulatory costs fall hardest on the smallest players. A year of work to register, document and open is a small share of a large exchange’s early costs and a huge share of a startup’s. The accessible sources give no dollar figures for Flow Crypto NZ, so the comparison here is structural. The same five obligations apply to a business with one employee and to a business with five hundred.

The consequence is market concentration. If starting a regulated broker takes the better part of a year, fewer founders will try, and the field tilts toward firms that can fund a compliance team from day one. Customers then get fewer choices, and local brokers lose ground to offshore platforms that may face lighter local rules.

The counterweight is crime prevention, and it is real. Rules exist because criminals use financial services, including crypto. Our report on $16M lost on one fake pig-butchering platform shows how quickly stolen money moves once it enters the system. Hylands’ own framing, which asks which rules actually prevent crime, accepts that goal. He is asking regulators to separate controls that stop criminals from steps that only produce paper.

Competitive Comparison: New Zealand’s Approach Against Larger Regimes

Other regulators face the same tradeoff between safety and burden. In the United States, the enforcement story runs through large platforms and large alleged flows, as in the MEXC action. In Europe, lawmakers are drafting consumer rules that trade bodies already call unworkable. Our coverage of the Digital Fairness Act, with its proposed 6% fines, shows the same pattern of industry pushback against heavy, loosely defined obligations.

New Zealand’s debate has a distinctive feature. The loudest voice in this story is not a lobby group but a single founder who describes his workload in the first person. That framing gives the policy discussion concrete detail that association statements usually lack. It also makes the case that small-business fixes belong inside the main reform bill and not in a later patch.

Where New Zealand could stand out is in execution. A single supervisor, a risk-based standard and a published definition for every key term would put it ahead of regimes that rely on layered agencies and long guidance documents. Whether it gets there depends on drafting choices still to be made.

Five Predictions for the Omnibus Bill and Small Crypto Firms

The following predictions are analysis, not reporting. They rest on the confirmed facts above and on the usual path of legislation. None is a certainty.

  • The undefined term gets defined. Public attention on a single vague word makes a clarifying amendment or supervisor guidance the cheapest fix, so one of the two looks likely.
  • The cash threshold becomes the next fight. Once the Ministry of Justice opens its consultation in early 2027, as reported, brokers and consumer groups will argue over the number.
  • DIA publishes small-business guidance. A sole supervisor will need a plain-language path for tiny firms, and a template AML/CFT programme is a natural product.
  • Levy design draws pushback. A flat industry levy would weigh more on one-person brokers, and expect submissions asking for tiered charges.
  • Compliance tooling grows. Demand for off-the-shelf onboarding and monitoring components rises as founders stop writing their own, which is good news for vendors and for developers who package that work.

What to Watch Next

Four markers will show where this goes. First, watch whether the incoming government adopts the AML/CFT Omnibus Amendment Bill, since reports say it lapses otherwise. Second, watch for any change to the Bill’s wording around the undefined term. Third, watch for the Ministry of Justice consultation on the cash threshold in early 2027. Fourth, watch the design of the industry levy and the timeline for DIA taking over supervision, which is not expected before 2027.

For founders weighing a New Zealand launch, the takeaway is practical. Budget close to a year for registration and AML documentation, plan the compliance build as a real engineering project, and keep the architecture flexible enough to absorb the final rules. The Hylands account suggests the process is doable by one person, but it is not quick.

The Takeaway

Flow Crypto NZ shows what AML regulation looks like when it reaches the smallest regulated crypto business. Almost a year of work, five stacked obligations and one founder in three roles add up to a clear case study. The Omnibus Bill promises some relief through risk-based checks and a single supervisor, and it adds new penalties and a cash offence with a number still missing.

The test for lawmakers is simple. Fix the vague words, publish the thresholds early, and make sure the rules that prevent crime are the ones that take the time. Everything else is paperwork that a small broker pays for twice, once in hours and once in lost customers.

Frequently Asked Questions

What is Flow Crypto NZ?

Flow Crypto NZ is a crypto exchange in Christchurch, New Zealand, described in the Interest.co.nz headline as a small crypto broker. Eli Hylands is the named person behind it. He says he runs the business, serves as its AML compliance officer, wrote its software and reviews every customer application.

How long did the AML work take?

Interest.co.nz reports almost a year of anti-money-laundering work before the broker could open. The reporting available to us gives no exact dollar cost or month-by-month timeline, so those details remain unconfirmed.

What is the AML/CFT Omnibus Amendment Bill?

It is New Zealand legislation that amends the country’s anti-money-laundering and countering-financing-of-terrorism rules. Reported changes include simplified due diligence for low-risk customers, higher penalties with an infringement regime, a crypto cash offence and a move to a single supervisor.

What is the “one undefined word” in the Bill?

Interest.co.nz says the Bill contains one undefined word that matters to small businesses. The accessible results do not name it, so we do not either. The point of the criticism is that undefined terms leave small firms guessing at compliance.

Who supervises Flow Crypto NZ?

Hylands says the firm came under Department of Internal Affairs supervision before serving customers. Separate reporting says DIA is slated to become the sole AML/CFT supervisor, replacing a model shared with the Reserve Bank and the Financial Markets Authority.

Will the Bill ban crypto ATMs?

According to the reporting summarized here, Cabinet agreed in principle in 2025 to ban crypto ATMs, then dropped an outright ban in July 2026. The government now prefers a power to restrict virtual-asset cash transactions through regulation, with the threshold still to be set.

Does the Bill make compliance cheaper for small firms?

It may in some areas and not in others. Simplified due diligence for low-risk customers could cut paperwork, yet legal commentators questioned whether the Bill shifts burden into case-by-case judgments. Higher penalties and a possible industry levy could offset the savings.

Daniel Roth covers cryptocurrency and the cryptography behind provably-fair systems, explaining how commitment schemes and verification actually work rather than how they are marketed.