Submission on enhancing the cyber security of New Zealand’s critical infrastructure system
17 Apr 2026
Payments NZ Limited has made a submission on the Government’s discussion document Enhancing the cyber security of New Zealand’s critical infrastructure system.
The consultation sought feedback on the infrastructure services most critical to Aotearoa New Zealand and the level of cyber protection they should be required to meet. Our submission focuses on the payments system and the adequacy of existing, sector‑specific cyber regulation.
Key points
- Payments NZ governs core retail and high‑value payment clearing and settlement arrangements in Aotearoa, but does not own or operate payments infrastructure for the purposes of its clearing systems.
- Cyber risks relating to payment clearing and settlement are already addressed through:
- SWIFT infrastructure for high-value payments,
- settlement in the Exchange Settlement Account System (ESAS) operated by the Reserve Bank of New Zealand Te Pūtea Matua, and
- participant access rules requiring adequate operation and cyber risk management.
- The Reserve Bank has indicated it intends to designate our High Value Clearing System under the Financial Market Infrastructures Act 2021 (FMI Act).
- If designated, Payments NZ would be subject to FMI Standard 17C on cyber resilience, which already requires strong governance, assurance, and regulatory oversight.
- Payments NZ considers the FMI framework fully meets the policy objectives of the proposed cyber security regime when applied proportionately to our role.
Sector‑specific regulation
Payments NZ supports the Government’s intent not to replace existing sector‑specific regimes. We consider that:
- effective sector regulation should operate as a safe harbour,
- cyber oversight for payment systems should sit with the Reserve Bank, and
- entities should not face duplicative compliance or enforcement under multiple regimes.
Any cross‑economy cyber framework should clearly recognise compliance with robust sector frameworks such as the FMI Act.
Conclusion
Payments NZ supports strengthening cyber security across critical infrastructure in Aotearoa. For payment systems, existing regulatory arrangements already provide robust and proportionate cyber risk management, and no additional requirements are necessary.