NZ's first government digital credential: fix onboarding now

What MBIE launched

On 3 November the Ministry of Business, Innovation and Employment started trialling the NZBN Business Passport, a digital credential linked to a firm's New Zealand Business Number (MBIE release via Scoop). A business keeps the passport in the Govt.nz app's digital wallet on a phone. From there it can share verified business details with other organisations, including confirmation that a named person can act on the firm's behalf. MBIE calls the passport the first credential issued by government and the second accredited under the Digital Identity Services Trust Framework. The Trust Framework Authority independently assessed it against privacy and security requirements before accreditation.

The trial is small for now. Only selected Westpac NZ business customers can use the passport, and they link it to their banking services (RNZ). MBIE hasn't published how many businesses are taking part, when the trial ends or when a wider release might happen. The ministry says feedback from Westpac and the participating firms will guide decisions on broader adoption, and it's already talking with other banks and organisations.

How the passport works with Westpac's bank account credential

The passport is designed to sit alongside a credential Westpac announced on 17 September. A Westpac business customer picks an account in Westpac One Business and generates a QR code. They scan the code with the Govt.nz wallet and confirm with a code sent by text message. The wallet then holds a Westpac Business Bank Account credential, which stays valid for 72 hours (1News, September). According to the same report, Westpac was the third organisation accredited to issue credentials under the framework, after NEC New Zealand and the Government Digital Delivery Agency. ID Tech reports that the bank credential replaces the routine of redacting bank statements and emailing them to the other party.

Used together, the two credentials let a business prove its identity and its bank account details online, with no attachments changing hands. Those checks underpin supplier onboarding, trade credit applications and most controls against payment redirection fraud.

Why the trial matters if you don't bank with Westpac

Most NZ organisations still check a counterparty with documents. A typical supplier file holds a Companies Office extract, a bank letter or deposit slip, and an email from whoever says they run the accounts. Staff judge those papers by eye, and a convincing forgery takes little skill. An accredited credential lets the receiving organisation confirm that the bank or MBIE issued the information and that the information is still current. That's a stronger check than a visual review of a PDF.

The time saved on repeat requests helps small firms as much as large ones. Alan Carnaby, MBIE's acting head of digital business enablement, said businesses "are often asked to provide the same information to multiple organisations" (MBIE release via Scoop). Every repeated request costs admin time for the business supplying the documents and for the team checking them.

The value depends on how many organisations accept credentials. Russell Jones, Westpac's chief data, digital and AI officer, told 1News that digital ID needs verification at large scale before it succeeds (1News, September). Few verifiers exist outside Westpac today. The privacy design also shapes what a receiving business actually gets. Credentials are stored only on devices the holder chooses rather than in a cloud or government database, and the holder decides what to share (1News, November). A receiving business gets a verified claim at the moment of sharing, so keeping a record of the verification is up to the receiver.

What it means for NZ businesses

Westpac business customers may soon see the passport offered during their own dealings with the bank. For most other firms, the near-term effect falls on the receiving side. Suppliers, customers and lenders may start offering a credential where they'd once have sent a document, and your processes need a defined way to accept one.

The vendor master file is where most organisations will feel the gap first. A typical ERP or accounting system stores a bank account number and perhaps a scanned attachment. Few have a field recording how the account was verified, who checked it or on what date. A 72-hour credential is a point-in-time check, so your records have to capture that point if an auditor or insurer later asks why a payment went to a particular account. Firms that already treat supplier onboarding as a defined workflow inside their ERP will find credentials easy to add. Firms that run onboarding through shared inboxes and spreadsheets will struggle to show which check they relied on.

Credential and document checks will run side by side for years, because accepting credentials depends on each counterparty holding one. Staff need written rules for when a credential satisfies a check on its own, when a document is still required and how to handle a credential that conflicts with what's on file. Without those rules, the new method becomes one more inconsistent path through an already patchy process.

Practical next steps

• Map every point where your organisation collects proof of business identity, proof of authority or bank account details, including supplier setup, customer credit applications and bank detail changes.
• Add verification fields to supplier and customer records in your finance system: method used, date verified, staff member and the expiry of any credential relied on.
• Rewrite the bank account change procedure so a verified credential counts as one acceptable method, while phone call-back to a known contact stays in place for counterparties without a credential.
• If you bank with Westpac, ask your relationship manager whether your business can join the trial, so your team sees how holding and sharing a credential works in practice.
• Ask your bank, ERP vendor and onboarding software providers whether they plan to support verifying Govt.nz wallet credentials, and when.
• Watch for MBIE's trial findings and any announcement of further banks joining, then decide whether credential checks belong in your 2027 digital transformation roadmap.