Frequently asked questions: AML and Identity Verification

As part of our compliance with New Zealand's Anti-Money Laundering and Countering Financing of Terrorism Act 2009 we need to verify the identity of our customers.

Below are some frequently asked questions:

Who is required to complete identity verification? 

Account holder

We need to have the identity details for the account holder. This includes all new and existing customers. This always needs to be a real person (not a company).

Directors and Shareholders

For companies utilising Private Box's registered office or Principal Place of Business addresses, we need to complete identity verification on all the directors and shareholders.

For personal accounts - if you are receiving mail for more than one person

If you are receiving mail for family members on your account, then they do not need to complete the identity verification immediately, but may be required to complete an identity verification later.

If you will be receiving mail on behalf of friends on your mailbox account, then they will each need to complete the identity verification process.


How long do I have to complete identity verification?

Customers are provided 30 days to complete the identity verification requirements. 


What happens if I do not complete the identity verification process?

Failure to provide the necessary ID will result in us no longer being able to offer you mail services.

We are in breach of the law when we supply services to someone whose identity we cannot verify. So failure to complete the identity verification process will result in your account being closed.


How do I supply documents?

These are the methods you can use to provide documents:

  1. Secure upload in your Private Box account
  2. Via email
  3. During your video call or meeting

Secure upload in your Private Box account

When logged in to your Private Box account you can upload documents securely.

Read our step-by-step guide on uploading documents in your Private Box account >>

Via email 

You can email our team at

To help us, it's best to contact us using the email address used for your Private Box account.

During your video call or meeting

During a video call or meeting with one of our staff members, you can provide documents.

See more about completing a video call >>




How long do you keep my information for? 

We keep all identity documentation securely while you have an account with us.

If your Private Box account is closed we are required to hold customer data for a further 5 years for Anti-Money Laundering (AML) as per our privacy policy. This is because of Section 50 (3)(a) and 51(2) of New Zealand's AML act.


AML CFT, TCSP and DIA - There are lots of abbreviated terms which are not explained. What do all of these terms mean?

AML/CFT = the Anti-Money Laundering / Counter Funding of Terrorism Act. An “act” is a piece of legislation that is passed into law by the New Zealand government. This is the act that makes it a criminal offence if we do not identify our customers. We normally just refer to this as AML or the AML act.

TCSP = Trust and Company Service Provider. This is the type of entity we are identified as under by the AML act.

DIA = Department of Internal Affairs. This is our ‘supervisor’ for our implementation of the AML/CFT act.

DOB = Date of Birth


If the request is based on the Anti-Money Laundering and Countering Financing of Terrorism Act 2009, I do not believe your business is listed within the definition of reporting entity under section 5 of the Act.  Your company is not a bank or financial institution?

Great question! Private Box is a mail forwarding company and does not deal with financial transactions - how can you launder money in the first place!  At first look you would think the AML act would exclude us. However - we are caught in the AML regulations seen here - Particularly this bit -

" (2) This regulation applies to a person who carries out, as the only or principal part of their business, 1 or more of the following activities: ... (c)providing a registered office, a business address, a correspondence address, or an administrative address for a company, a partnership, or any other legal person or arrangement.". 

So its the "correspondence address" part of this law that has all of our customers caught by the act! We are as frustrated as you are at these new laws! It's very heavy handed and we have requested an exemption from the Minister of Justice which has been denied by the Honourable Simon Bridges (please see letter attached below). 

We have also sought clarification on the term “legal persons” and have received this advice from our legal team:

“Natural people are also considered “legal persons” for the purposes of the regulations.”

Here is the full explanation:

“There is no definition of “legal persons” in the regulations or Act.    The Interpretation Act 1999 does not define this term either.  The Interpretation Act’s definition of person is ‘person includes a corporation sole, a body corporate, and an unincorporated body’.

There is no explicit legislation on the fact that a natural person is a “person” at law.  The reason for this is that it is not arguable that the term “person” does not include a natural person as that is the word’s basic meaning.  The term “legal” in front of the word “person” simply notes it is the legal form of “person” the law is concerned with (i.e. the term is widened from its ordinary meaning to include companies etc).”

This basically means a “legal person” is normal people as well as other legal entities (like companies and trusts).


Do you take any additional actions to verify my identity documents and details?

We are required by law to verify your details. We do this by using providers in different countries that give us access to public databases and credit files in those countries. We only work with suppliers that we are satisfied that they have strong privacy practices of their own.

We do not get a credit report on our customers. If the credit file is available in a country for a certain individual then the details supplied to us are cross-referenced with their file (eg. name, DOB and residential address).

For full details on who we use to verify your information please see our privacy policy at policy


Does Private Box receive a financial benefit for giving out this information to these corporations, who admit in their own privacy statements that they then provide it to others?

Of course not. We actually pay these companies for a service. We do not receive any financial benefit and they will not disclose our customer's details to anyone else. If they did they would be in breach of the contract we have with them.

The privacy policy you are referring to is their public website and is different to the service we are using them for.

If you have concerns around this area we can let you know which organisations we have cross-referenced your details with and what contractual obligations they are under to keep your information safe.



Have more questions? Submit a request