When a regulator changes, check the systems that carry the work.

On 1 July 2026, the Financial Markets Authority - Te Mana Tatai Hokohoko takes over regulatory responsibility for the Credit Contracts and Consumer Finance Act 2003 from the Commerce Commission. The FMA says this makes it the single conduct regulator for financial markets, including consumer credit.

This article is not about interpreting the CCCFA or advising on licensing. That work belongs with the right legal, financial, or regulatory advisers. The useful EQIQ angle is narrower: when a financial-services process moves between agencies, firms should check the technology and information flows that support it.

For New Zealand financial, legal, and advisory firms, this kind of change is a reminder that governance often lives in everyday systems: Microsoft 365, shared mailboxes, document libraries, client records, task lists, administrator accounts, and supplier-supported portals.

The current NZ signal

The FMA's 2 June 2026 media release confirmed 1 July 2026 as the transfer date and noted that the FMA and Commerce Commission had put governance and security protocols in place for information transfer, with attention to data integrity and privacy.

The FMA's CCCFA page says the transfer takes effect on 1 July 2026. Its transfer FAQ also explains that certified consumer lenders at the transfer date will be deemed to hold an FMA licence for the consumer credit service, and that the FSPR will be updated automatically.

That is a regulator-side process. Inside a firm, the practical question is different: are the right people, folders, mailboxes, records, and permissions ready for the new operating state?

1. Confirm who owns regulator communications

Many firms have regulator emails going to a named person, an old distribution list, or a shared mailbox no one actively owns. That works until a staff member leaves, a mailbox rule moves a message, or a time-sensitive request is missed.

Check the nominated email address, shared mailbox ownership, delegates, forwarding rules, and backup contact. Keep the answer somewhere easy to find, not only in one person's inbox.

2. Tidy the folders that hold sensitive credit or client records

Regulatory change is a useful moment to review where related records sit. That might include licensing material, historic correspondence, board or management notes, policies, client files, complaints, breach records, and process documents.

In Microsoft 365, check whether these records live in the right SharePoint site or Teams workspace, whether access is limited to the people who need it, and whether old sharing links or guest access are still appropriate.

3. Review administrator and portal access

Regulator portals, finance systems, document platforms, and Microsoft 365 admin roles often accumulate access over time. A regulator change is a good reason to confirm who can submit, update, export, or delete important information.

At minimum, check named administrators, MFA status, backup access, former staff, external adviser access, and whether generic accounts are being used where individual accountability would be safer.

4. Keep process notes simple and current

The FMA FAQ points to documented processes as part of good organisational capability in a licensing context. A technology team should not turn that into a heavy compliance project, but clear operational notes still matter.

A simple internal page can cover: where regulator communications arrive, where related documents are stored, who owns the process, which systems are used, who has administrator access, and what to do if a key person is away.

5. Check retention before deleting or moving records

When teams clean up folders, there is always a risk of moving too quickly. Before deleting, archiving, or restructuring sensitive records, confirm the firm's retention requirements with the right adviser or internal owner.

The technology task is to make retention manageable: labels, structured folders, audit-friendly naming, sensible permissions, and recoverable storage. The legal or regulatory retention decision should sit with the right professional owner.

6. Treat AI tools carefully around regulated information

AI can be useful for summarising public guidance or drafting internal checklists. It should not be used casually with confidential client information, personal information, regulator correspondence, or sensitive financial records unless the firm has approved the tool and the controls are understood.

For firms using Microsoft 365 Copilot or similar tools, access hygiene matters even more. AI-connected tools can surface information based on existing permissions, so broad access and old sharing links become more visible.

Common questions

Does the 1 July 2026 CCCFA regulator transfer create a technology task for every firm?

No. The transfer is a regulatory matter for consumer credit providers. This article draws general technology housekeeping lessons for firms that hold sensitive client or financial information.

What technology checks are useful after a regulator or portal change?

Useful checks include access permissions, shared mailboxes, contact records, document storage, administrator accounts, MFA, retention settings, and clear ownership of regulator communications.

Is this article legal, financial, regulatory, privacy, or compliance advice?

No. It is general information about technology risk and information governance. Firms should take appropriate professional advice for their own obligations and circumstances.

Source note

Compliance note: This article is general information only. It is technology-risk and information-governance guidance, not legal advice, financial advice, regulatory advice, privacy advice, or compliance advice. Firms should take appropriate professional advice for their own obligations and circumstances.