Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025

1 Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 This standard is issued under section 72 of the Deposit Takers Act 2023 by the Reserve Bank of New Zealand after— (a) complying with section 75(1) of that Act; and (b) being satisfied of the matter in section 72(1) of that Act; and (c) the board of the Reserve Bank of New Zealand having regard to the matter in section 49(1) of the Reserve Bank of New Zealand Act 2021. Contents Page 1 Title 2 2 Commencement 2 3 Revocation 2 Part 1 Preliminary provisions 4 Interpretation 2 5 Application 3 Part 2 DCS depositor page DCS depositor page 6 Account software must contain DCS depositor page or means of getting to page 3 Configuration of DCS depositor page 7 DCS depositor page must collect depositor information 4 8 DCS depositor page must collect depositor information only from authorised individuals 4 9 Confirmation of receipt 4 10 Information to be displayed on DCS depositor page 4 Activating DCS depositor page and deactivating account software 11 Deposit taker must be able to activate DCS depositor page at all times 5 12 Activating DCS depositor page and deactivating account software 5

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 2 13 Activated DCS depositor page must remain readily accessible 5 Deactivating DCS depositor page 14 Existing deposit taker must deactivate DCS depositor page if directed by Bank 5 Other requirements 15 Security, performance, and information storage 6 Part 3 Alternate model to DCS depositor page Requirements for alternate model 16 Bank may approve alternate model to DCS depositor page 6 Implementing alternate model and deactivating account software 17 Implementing alternate model and deactivating account software 7 18 Alternate model that has been implemented must remain readily accessible 7 Ceasing alternate model 19 Existing deposit taker must cease implementing alternate model if directed by Bank 8 Part 4 Miscellaneous provisions 20 Providing information in relation to DCS to Bank 8 21 Transitional provision for mobile applications 8 Standard 1 Title This is the Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025. 2 Commencement This standard comes into force on 1 July 2025. 3 Revocation This standard is revoked on the date on which section 10 of the Act comes into force. Part 1 Preliminary provisions 4 Interpretation In this standard, unless the context otherwise requires,— account software means online software provided by a deposit taker for persons to view or manage accounts in which deposits are placed (for example, an Internet site or a mobile application) Act means the Deposit Takers Act 2023

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 3 activate, in relation to online software, means to make the software readily accessible to the public alternate model has the meaning set out in clause 16 authorised individual, in relation to a deposit, means any individual who has authority to do either or both of the following: (a) authorise money to be paid to a person who is not a holder of the deposit: (b) authorise money to be paid to an account with another deposit taker compensation means compensation payable under the DCS DCS means the depositor compensation scheme DCS depositor page has the meaning set out in clause 6(2) deactivate, in relation to online software, means to remove or disable the software or otherwise prevent it from being accessed by the public depositor information means information described in clause 7(1) existing deposit taker has the meaning set out in clause 2 of Schedule 1 of the Act mobile application means software that is designed to be used on a mobile device online software means software that is— (a) on the Internet; and (b) maintained by, or on behalf of, the deposit taker specified event notice means a notice issued under clause 5(1) of Schedule 1 of the Act. 5 Application This standard applies to an existing deposit taker unless either or both of the following apply: (a) the deposit taker is an overseas licensed deposit taker described in regulation 6(2) of the Deposit Takers Regulations 2025: (b) the deposit taker does not provide account software for persons who hold deposits. Part 2 DCS depositor page DCS depositor page 6 Account software must contain DCS depositor page or means of getting to page (1) An existing deposit taker must ensure that its account software— (a) contains a DCS depositor page; or (b) provides a link or other means to get to a DCS depositor page.

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 4 (2) DCS depositor page means online software for collecting depositor information from authorised individuals in accordance with this standard. Configuration of DCS depositor page 7 DCS depositor page must collect depositor information (1) A DCS depositor page must be configured so that, in relation to a deposit, the page can collect the following information (depositor information): (a) account details for a New Zealand account into which any compensation may be paid: (b) a contact email address and contact phone number for the authorised individual providing the account details. (2) The DCS depositor page must be configured so that it cannot collect information unless the information includes account details. (3) In this clause, account details means the name of an account and the unique number assigned to the account. 8 DCS depositor page must collect depositor information only from authorised individuals (1) A DCS depositor page must be configured so that the page cannot collect depositor information in relation to a deposit unless the identity of the person providing the information and their status as an authorised individual are verified using their electronic credentials. (2) In this clause, electronic credentials means credentials (for example, a password) that the authorised individual is able to use to access the deposit through the deposit taker's account software immediately before a specified event notice is issued in respect of the deposit taker. 9 Confirmation of receipt A DCS depositor page must be configured so that, after an authorised individual provides depositor information, the page displays a statement to the effect that— (a) the information has been received; and (b) any compensation will be paid into an account according to the details provided, after the Bank determines who is entitled to compensation and calculates the amount of their entitlement. 10 Information to be displayed on DCS depositor page A DCS depositor page must be configured so that the page cannot collect depositor information unless, before the information is collected, the page displays— (a) a statement to the effect that— (i) the deposit taker is in liquidation, is in receivership, or is under statutory management (whichever applies); and

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 5 (ii) the Bank has begun the process under the DCS for compensation to be paid to, or on account of, eligible depositors in respect of their protected deposits placed with the deposit taker; and (b) a statement that information about the DCS is available on the Bank's Internet site. Activating DCS depositor page and deactivating account software 11 Deposit taker must be able to activate DCS depositor page at all times An existing deposit taker must be able to comply with clause 12 at all times. 12 Activating DCS depositor page and deactivating account software (1) This clause applies if the Bank— (a) issues a specified event notice in respect of an existing deposit taker; and (b) directs the deposit taker, in writing, to activate its DCS depositor page. (2) The deposit taker must— (a) activate its DCS depositor page; and (b) deactivate all account software except for software that— (i) provides a link or other means of getting to its DCS depositor page: (ii) allows persons to view information about deposits (for example, account balances and transaction histories). (3) The deposit taker must comply with subclause (2) as soon as practicable (which may be outside normal business hours) after receiving the direction. (4) A deposit taker must not activate a DCS depositor page except in accordance with this clause. 13 Activated DCS depositor page must remain readily accessible An existing deposit taker must ensure that, after a DCS depositor page is activated,— (a) the page remains readily accessible to the public until it is deactivated under clause 14; and (b) assistance is available for queries from the public about accessing or using the page. Deactivating DCS depositor page 14 Existing deposit taker must deactivate DCS depositor page if directed by Bank (1) This clause applies if the Bank directs a deposit taker, in writing, to deactivate a DCS depositor page. (2) The deposit taker must deactivate the DCS depositor page as soon as practicable but, in any event, no later than 8 am on the day after receiving the direction.

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 6 Other requirements 15 Security, performance, and information storage A deposit taker must, in relation to a DCS depositor page, take all reasonable steps to ensure that— (a) depositor information provided through the page is securely collected (including preventing the information from being intercepted while a person types it into the page); and (b) depositor information collected through the page is stored— (i) in a secure manner; and (ii) according to the deposit taker's unique identifier for the eligible depositor in relation to the deposit; and (iii) separately from any other information that the deposit taker holds in relation to the deposit; and (c) the page functions efficiently, and in accordance with the requirements in this standard, for the maximum number of persons who could reasonably be expected to access the deposit taker's account software simultaneously in the usual course of business. Part 3 Alternate model to DCS depositor page Requirements for alternate model 16 Bank may approve alternate model to DCS depositor page (1) An existing deposit taker may submit a written proposal to the Bank setting out a model for collecting depositor information from authorised individuals otherwise than through a DCS depositor page (an alternate model). (2) An existing deposit taker may submit a proposal for an alternate model in respect of all or some account software. (3) The Bank may, in writing, approve an alternate model if it is reasonably satisfied that— (a) the alternate model will enable the deposit taker to collect depositor information from authorised individuals, and store the information, effectively and securely; and (b) the deposit taker will be able to comply with clause 17 at all times. (4) For the purposes of subclause (3)(a), the Bank must have regard to whether the model will— (a) enable the deposit taker to collect depositor information from authorised individuals; and (b) enable the identity of the persons providing depositor information and their status as authorised individuals to be verified; and

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 7 (c) provide the information specified in clause 10 to an authorised individual who is providing depositor information; and (d) collect depositor information in a secure manner; and (e) store depositor information collected through the alternate model— (i) in a secure manner; and (ii) according to the deposit taker's unique identifier for the eligible depositor in relation to the deposit; and (f) function efficiently, and in accordance with the requirements in paragraphs (a) to (e), for the maximum number of persons who could reasonably be expected to access the account software to which the alternate model relates simultaneously in the usual course of business. Implementing alternate model and deactivating account software 17 Implementing alternate model and deactivating account software (1) This clause applies if— (a) an existing deposit taker has an alternate model that has been approved by the Bank under clause 16; and (b) the Bank— (i) issues a specified event notice in respect of the existing deposit taker; and (ii) directs the deposit taker, in writing, to implement its alternate model. (2) The deposit taker must— (a) make the alternate model readily accessible to the public in respect of the account software to which it applies; and (b) deactivate all account software except for software that— (i) provides a link or other means to get to the alternate model or information about how to access the alternate model: (ii) allows persons to view information about deposits (for example, account balances and transaction histories). (3) The deposit taker must comply with subclause (2) as soon as practicable (which may be outside normal business hours) after receiving the direction. (4) A deposit taker must not implement an alternate model except in accordance with this clause. 18 Alternate model that has been implemented must remain readily accessible An existing deposit taker must ensure that, after an alternate model is implemented,— (a) the alternate model remains readily accessible to the public until, under clause 19, the model ceases to be implemented; and (b) assistance is available for queries from the public about accessing or using the alternate model.

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 8 Ceasing alternate model 19 Existing deposit taker must cease implementing alternate model if directed by Bank (1) This clause applies if the Bank directs a deposit taker, in writing, to cease implementing an alternate model. (2) The deposit taker must cease implementing the model as soon as practicable but, in any event, no later than 8 am on the day after receiving the direction. Part 4 Miscellaneous provisions 20 Providing information in relation to DCS to Bank (1) This clause applies if, by a notice given under section 99 of the Act, the Bank requires a deposit taker to provide information that the Bank considers necessary or desirable for the performance or exercise of its functions, powers, or duties under Part 6 of the Act. (2) The deposit taker must provide the information— (a) in a format that is readily transferable to, and compatible with, the Bank's systems; and (b) by secure electronic transmission using an information management facility (if any) made available by the Bank for that purpose. 21 Transitional provision for mobile applications (1) This clause applies to an existing deposit taker that has account software that includes— (a) an Internet site; and (b) a mobile application. (2) The existing deposit taker is not required to ensure that its mobile application— (a) contains a DCS depositor page; or (b) provides a link or other means to get to a DCS depositor page. (3) This clause applies despite clause 6. (4) This clause applies until the close of 31 December 2025. Made at Wellington on 15 May 2025. Reserve Bank of New Zealand

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 9 Explanatory note This note is not part of the standard but is intended to indicate its general effect. This standard comes into force on 1 July 2025. It has effect until section 10 of the Deposit Takers Act 2023 (the Act), which requires all deposit takers to be licensed, comes into force (unless it is earlier revoked). The standard is issued under section 72 of the Act and sets out transitional provisions relating to the depositor compensation scheme (the DCS). The transitional provisions are contemplated by clause 7 of Schedule 1 of the Act. The standard applies to existing deposit takers, meaning— • registered banks under the Banking (Prudential Supervision) Act 1989; and • licensed non-bank deposit takers under the Non-bank Deposit Takers Act 2013. The standard does not apply to overseas licensed deposit takers described in regulation 6(2) of the Deposit Takers Regulations 2025. This means that the standard does not apply to overseas licensed deposit takers that mainly provide services to wholesale clients. The standard also does not apply to deposit takers who do not provide online banking services for their customers. The standard requires existing deposit takers to have a DCS depositor page. A DCS depositor page is software that enables a deposit taker to collect, in relation to a deposit, alternate account information and contact details from an individual who is authorised to carry out certain transactions. The page must be on the Internet and maintained by or on behalf of the deposit taker. It must be provided on, or accessible from, the online banking service. A deposit taker must not activate its DCS depositor page unless the Reserve Bank of New Zealand (the Bank)— • issues a specified event notice under clause 5 of Schedule 1 of the Act; and • directs the deposit taker to activate the page. A deposit taker must, when it activates its DCS depositor page, deactivate other software used by authorised individuals to manage deposits (with some exceptions). A DCS depositor page must remain accessible to the public until the deposit taker is directed by the Bank to deactivate it. While it is accessible, customers must have a point of contact for assistance with queries about accessing or using the page. The standard also sets out requirements relating to security and performance of the page and storage of information collected through the page. The standard allows a deposit taker to request the Bank's approval for the deposit taker to collect alternate account information and contact details otherwise than by using a DCS depositor page (an alternate model). The Bank may approve an alternate model if it is reasonably satisfied that— • it will enable the deposit taker to collect depositor information from authorised individuals, and store the information, effectively and securely; and • the deposit taker will be able to implement the model and deactivate account software (with some exceptions) at all times. A deposit taker that has an approved alternate model must, if directed by the Bank, implement the model and deactivate the relevant account software.

Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 10 A deposit taker that has an approved alternate model is subject to requirements relating to security and performance of the page and storage of information similar to those applying to a deposit taker that has a DCS depositor page. Information provided by deposit takers to the Bank in relation to the DCS must be readily transferable to, and compatible with, Bank systems. The information must be provided through an information management facility made available by the Bank. The standard includes a transitional provision in relation to mobile applications. The effect of the provision is that, if a deposit taker provides its customers with online banking services through a website and a mobile application, the deposit taker is not required to have a DCS page in respect of the mobile application. The transitional provision ceases to apply on the close of 31 December 2025. This is secondary legislation issued under the authority of the Legislation Act 2019. Title Deposit Takers (Depositor Compensation Scheme Transitional Provisions) Standard 2025 Empowering Act Deposit Takers Act 2023 Empowering provision(s) Section 72 Maker name Reserve Bank of New Zealand Administering agency Reserve Bank of New Zealand Date made 15 May 2025 Publication date 21 May 2025 Notification date 21 May 2025 Commencement date 1 July 2025 End date (when applicable) The date on which section 10 comes into force