Legal Risks of A Cashless Future

More Kiwi customers are tapping, scanning, and paying online than ever before. For many small businesses, going “mostly cashless” feels like the obvious next step: it’s faster at the till, reduces cash-handling headaches, and can make your bookkeeping simpler.

But there’s a catch. When you move away from cash, you’re also taking on a new set of legal and operational risks - from privacy and cyber security obligations, to consumer disputes, surcharges, outages, and third-party payment provider contracts.

This guide breaks down what you need to know about cashless payments in New Zealand, the key laws that matter, and practical steps you can take to protect your business from day one (and keep things running smoothly as you grow).

Why Cashless Payments Are Becoming The Norm In New Zealand

“Cashless” doesn’t just mean card payments. For most small businesses, it’s a mix of:

in-store card and contactless payments
online payments through your website
invoicing and bank transfers
QR-based payments and other digital wallet options

The benefits are real - and for many industries, cashless is now the expectation. But from a legal perspective, the important thing to recognise is this:

when you accept cashless payments, you’re handling more data, relying more on third parties, and creating more “points of failure” than a simple cash sale.

That doesn’t mean you shouldn’t go cashless. It just means you should set up your legal foundations so your business is protected if something goes wrong.

What Legal Risks Come With Cashless Payments In New Zealand?

Most legal issues around cashless payments in New Zealand fall into a few predictable categories. If you plan for these early, you’ll avoid a lot of stress later.

1) Misleading Payment Information (And Surprise Fees)

If you charge a surcharge for certain payment methods, or you only accept specific types of payments, you need to be upfront about it.

In New Zealand, the Fair Trading Act 1986 is a key law here. In plain English, it means you can’t mislead customers - including by omission. So if the advertised price doesn’t match what customers will actually pay at the counter (because of an undisclosed surcharge or fee), you could be creating risk.

It’s also worth checking your payment provider agreement, because some providers limit (or set conditions around) surcharging and how it must be displayed.

Practical tips:

Make signage clear at the point of sale (and on menus, booking pages, or price lists where relevant).
If your online checkout adds fees, make sure they’re disclosed before payment.
Train staff to explain surcharges consistently (a surprising number of disputes start here).

2) Outages, Offline Periods, And “No Pay” Scenarios

Going cashless can leave you exposed when the internet is down, your EFTPOS terminal isn’t working, or your payment provider has an outage.

That’s not automatically a “legal breach”, but it can create:

lost revenue (and arguments with customers where payment can’t be completed as expected)
reputational damage
staff safety risks (if a customer becomes aggressive)
operational confusion about when a sale is actually complete (and whether you should hand over goods or provide the service)

From a risk management perspective, it’s worth having an offline plan (and documenting it) so your team knows what to do in the moment. For example, whether you will (a) pause trading, (b) take payment later via invoice, or (c) allow bank transfers, and what proof you will require before releasing goods.

3) Disputes, Chargebacks, And Customer Complaints

Cash transactions are usually final. Cashless payments are not always. With digital payments, customers may dispute transactions or request chargebacks, and you may have to provide evidence of what happened.

Even if you’re confident you’re in the right, your ability to respond will depend on how well your business:

keeps records (receipts, invoices, delivery confirmations, booking logs)
sets customer expectations (refunds, cancellations, change-of-mind policies)
uses clear terms for online sales

4) Privacy And Data Breaches

This is the big one. The more you rely on cashless payments, the more you touch personal information - names, email addresses, phone numbers, delivery addresses, and sometimes even behavioural data (like purchase history).

That triggers obligations under the Privacy Act 2020, and it’s not something you want to treat as an afterthought.

5) Third-Party Provider Risk

Most small businesses don’t build their own payment systems - you rely on a provider. That means your customer experience and your cashflow can depend on a contract you didn’t negotiate much, and that you might not have read closely.

Key risks include:

fee changes (and how much notice you get)
settlement timing (when you actually receive funds)
frozen or delayed payouts if your account is flagged
limits on liability (especially for outages or losses)
rules around disputes and evidence

This is where having the right contracts and internal policies matters.

Privacy And Cybersecurity: Handling Card And Digital Payment Data

If you’re moving towards cashless payments that New Zealand customers love, you should assume you’re also increasing your privacy risk profile.

Under the Privacy Act 2020, your business generally needs to take reasonable steps to:

collect personal information in a fair and lawful way
only collect what you actually need
store information securely
allow individuals to request access to their information (and correction where appropriate)
respond appropriately if there is a privacy breach (including notifying affected people and/or the Privacy Commissioner when required)

Do You Need A Privacy Policy?

If you collect customer information online (even just through a checkout, enquiry form, bookings, or email newsletter sign-ups), having a clear Privacy Policy is usually essential.

A good privacy policy isn’t just legal “box-ticking”. It reduces complaints because it tells customers, in plain language:

what you collect
why you collect it
who you share it with (including payment and delivery providers)
how customers can contact you about privacy issues

Secure Storage And Access Controls

Even if your payment provider handles the card details, your business might still store personal information like customer names, contact details, receipts, invoices, and order notes.

Simple steps that make a big difference include:

restricting staff access to only what they need
using strong passwords and multi-factor authentication
keeping devices updated (especially point-of-sale tablets and computers)
training staff to spot phishing attempts

Have A Plan For Data Breaches

Data breaches aren’t only “big company” problems. Small businesses are often targeted because security is lighter and teams are busy.

Having a written Data Breach Response Plan helps you respond quickly, preserve evidence, and meet your legal obligations if something goes wrong.

Don’t Forget Staff Privacy

Cashless systems often come with cameras, audit logs, employee logins, and transaction tracking. That can be useful for theft prevention and training, but you still need to be careful about how you monitor staff.

Consider whether you need an Employee privacy handbook or workplace policy that explains what monitoring occurs, why it’s needed, and how information is handled. It’s a practical step that can prevent misunderstandings (and disputes) later.

Consumer Law And Chargebacks: Getting Your Sales Process Right

When customers pay by cash, the “paper trail” is often minimal. With cashless transactions, customers expect fast resolutions - and they may escalate issues through disputes or chargebacks.

The best protection is having a clear, legally compliant customer process.

Consumer Guarantees And What You Can’t Contract Out Of

If you sell goods or services to consumers, the Consumer Guarantees Act 1993 will often apply. In general terms, it requires that goods and services meet certain guarantees (like acceptable quality and being fit for purpose).

This matters for cashless payments because refund disputes can escalate quickly, and customers often assume “digital payment = automatic refund”. The law is more nuanced than that, so you’ll want your team to understand what applies and how you handle remedies.

Be Careful With “No Refund” Signs

Blanket “no refunds” signs can create legal risk, because they may be misleading under the Fair Trading Act 1986 if they suggest customers have fewer rights than they really do.

If you have a change-of-mind policy, that’s fine - but it needs to be expressed carefully, and it should sit alongside (not override) consumer guarantees.

Online Sales Need Clear Checkout Terms

If your business takes payments through your website (including bookings, subscriptions, pre-orders, or delivery orders), your checkout flow should be backed by clear terms.

Having Website Terms And Conditions can help set expectations around things like:

when payment is taken
when a contract is formed (e.g. at checkout vs on dispatch/confirmation)
delivery timelines and what happens if a package goes missing
cancellations and refunds
fraud prevention and identity verification

Well-drafted terms won’t stop every dispute, but they put you in a much stronger position to respond quickly and consistently.

Contracts, Policies And Operational Documents To Protect You

Going cashless is not just a “payments” decision - it’s a business systems decision. The right legal documents make it easier to run your operations consistently and reduce your exposure when things go wrong.

1) Customer-Facing Terms (In-Store And Online)

Depending on your business model, you might need customer terms that cover:

pricing and any surcharges
booking and cancellation rules
refund and return processes
pre-orders and deposits
chargeback response expectations

For many businesses, this sits neatly within Business Terms that you can apply across sales channels, with additional eCommerce terms where required.

2) Supplier And Service Provider Contracts

Cashless systems often mean you rely on several providers at once - point-of-sale software, hardware, IT support, website developers, delivery platforms, and payment processors.

Whenever a third party is critical to your ability to trade (or to get paid), it’s worth documenting the relationship properly. A tailored Service Agreement can help clarify:

service scope (what they are actually responsible for)
service levels and response times
fees and payment terms
data handling obligations
what happens if something breaks, is delayed, or goes offline

3) Internal Policies For Staff (So Everyone Does It The Same Way)

Many payment disputes become messy because staff handle them differently. A simple internal policy can cover:

when staff can manually key in payments (and approvals required)
what to do if a customer claims they’ve paid but it hasn’t come through
refund approval limits and documentation requirements
how to manage outages and offline trading
how to spot suspicious transactions

From a practical standpoint, this also supports your health and safety obligations under the Health and Safety at Work Act 2015, because clear processes reduce stressful conflict situations at the counter.

4) Advertising And Pricing Processes

Cashless payments and dynamic checkout systems can change how pricing is presented (especially if fees, delivery charges, or discounts apply).

It’s worth checking that:

your advertised prices match what customers actually pay
any time-limited specials are accurate and not misleading
discounts are applied consistently (and can be evidenced in your records)

This isn’t just about avoiding complaints - it’s about reducing your risk under the Fair Trading Act 1986 and protecting your brand trust.

5) Record-Keeping And Tax Basics

Cashless systems can make record-keeping easier, but only if you treat it as a system (not just a set of transactions).

Make sure you can easily access and export:

sales records and receipts
refund records
chargeback correspondence
proof of delivery or service completion

Also keep in mind that New Zealand tax record-keeping rules still apply regardless of whether you take cash or card (including GST obligations if you’re GST-registered). As a general guide, you’ll want processes that support accurate reporting and that retain records for the required period.

6) “Can I Refuse Cash?” (A Practical Note)

There’s no one-size-fits-all answer for every scenario, and the details can depend on when and how the payment terms are communicated. In practice, businesses can often choose what payment methods they will accept, but the safest approach is to set the expectation clearly before the customer commits to the purchase (so there’s no dispute about the “deal” they agreed to).

If you’re choosing to be cashless (or mostly cashless), reduce risk by:

making it obvious before the customer commits to the purchase (signage, online checkout notices, booking confirmations)
considering accessibility and customer impact (some customers may have limited access to cards or digital banking)
training staff on how to communicate it calmly and consistently

It’s also worth getting tailored advice if your business is in a high-complaint environment (hospitality, events, essential services) or you’ve had disputes around payment method acceptance.

Key Takeaways

Cashless payments in New Zealand can streamline your business, but they also introduce privacy, security, and third-party provider risks that cash doesn’t.
Make sure your pricing and any surcharges are clearly disclosed to avoid issues under the Fair Trading Act 1986 (and check any surcharging rules in your payment provider agreement).
If you collect customer data through digital payments or online checkouts, you’ll likely need a clear Privacy Act 2020-compliant Privacy Policy and good data handling practices.
Online payment flows should be supported by clear Website Terms And Conditions so disputes and chargebacks are easier to manage.
Strong Business Terms and properly documented supplier relationships (often through a Service Agreement) help reduce operational uncertainty when systems fail or disputes arise.
Don’t wait for a breach to happen - having a Data Breach Response Plan and clear staff processes can save you time, money, and reputational damage.

If you’d like help setting up the right legal documents and privacy foundations for cashless payments in your business, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.

Legal Risks Of A Cashless Future For New Zealand Businesses