Blockchain & Web3 Development Company in Auckland

A scoped Web3 proof of concept in Auckland runs NZD $80,000 to $180,000 over eight to twelve weeks, covering FMA and Privacy Act 2020 scoping, smart-contract design, an independent audit by an NZ-based firm, and a testnet deployment. A production tokenisation rollout for a Fonterra-pattern provenance workflow lands between NZD $300,000 and $900,000 including integration with the client's existing ERP (SAP S/4HANA or Microsoft Dynamics 365), customs and EU Deforestation Regulation documentation, and a year of on-chain monitoring. Bank-grade digital-asset custody designs run higher because of FMA licensing support and RBNZ BS11 outsourcing evidence — typically NZD $500,000 to $1.6M. All proposals are fixed-fee in NZD with no T and M creep.

The Financial Markets Conduct Act 2013 and the Conduct of Financial Institutions Act (commenced March 2025) together set the licensing and fair-conduct expectations for any tokenisation that issues financial products. We map the application to the FMA's classification framework — financial product, derivative, managed investment scheme, or unregulated utility token — and structure smart contracts to fit. For licensed entities (ANZ NZ, ASB, BNZ, Westpac NZ) we work inside their existing licence conditions and produce evidence the FMA's conduct supervisors can read without rework. Unlicensed token launches are scoped against the no-action and exemption regimes, and we will recommend stopping a project if the regulatory pathway is genuinely closed.

Māori Data Sovereignty (Te Mana Raraunga, the Māori Data Sovereignty Network) holds that data about, from, or affecting Māori is taonga (treasure) under Te Tiriti o Waitangi and is subject to Māori governance. For Web3, that means: tokenised assets representing Māori land, fisheries, intellectual property, or cultural identifiers must be designed with iwi or hapū governance from inception, not retrofitted. We run a sovereignty review at discovery, scope iwi or hapū consultation if the application touches Māori-owned assets, and design smart-contract governance (multisig, DAO, or token-based) that respects mana whenua and Treaty settlement structures. The Algorithm Charter for Aotearoa New Zealand also applies if any government agency is in the data flow.

Default to AWS Auckland (ap-southeast-6, generally available 2024). For workloads predating the Auckland region or replication into AWS Sydney ap-southeast-2, we structure trans-Tasman flow under the Privacy Act 2020 cross-border guidance (analogous to but distinct from Australian APP 8). Azure Australia East and Central serve some NZ government workloads through existing arrangements. On-chain data is by design transparent — we use zero-knowledge proofs (Polygon ID, zkSync, Aztec patterns) when identity or commercial-sensitive flows must stay private while keeping verifiability. Customer PII, financial records, and other in-scope Privacy Act 2020 data stays off-chain in NZ-resident storage.

Typical end-to-end for a primary-export tokenised provenance rollout is sixteen to twenty-four weeks. Weeks 1 to 4 are discovery, EU Deforestation Regulation scoping, China customs alignment, and supplier mapping across the milk-collection or kiwifruit-pack network. Weeks 5 to 12 are smart-contract design (typically Hyperledger Fabric for the closed consortium, with Polygon zkEVM or Hedera anchoring public proofs), independent audit, and pilot with two suppliers. Weeks 13 to 18 are integration with the exporter's ERP (SAP or Dynamics), port and customs interfaces, and end-buyer (Tesco, Walmart, Chinese state buyers) verification flows. Weeks 19 to 24 are graded rollout. We have shipped patterns benchmarked against Fonterra and Zespri.

Yes, on a partnership basis through the bank's existing prime panel. Digital-asset custody for a registered NZ bank requires alignment with the RBNZ BS11 Outsourcing Policy (for any third-party custody technology), the FMC Act for any token classified as a financial product, and FMA Custody Standard expectations published 2024. We design custody architectures (MPC versus HSM versus hybrid, hot versus warm versus cold), structure KYT screening against the AML/CFT Act 2009, and produce evidence packs for RBNZ on-site inspection and FMA conduct review. We do not hold our own custody licence — the bank's existing prudential arrangements are the regulatory anchor.

Every production smart contract ships through two audit gates: an internal review by a Codazz security engineer using Slither, Mythril, Foundry fuzzing, and Halmos symbolic execution, then an independent external audit by a third-party firm with NZ presence (typically Auckland-based InPhySec or comparable). For high-value tokenisation (above NZD $5M on-chain TVL) we add a formal verification pass through Certora and a bug-bounty programme on Immunefi or HackenProof. Audit findings are tracked in GitHub with named owners and re-audit before mainnet. We do not deploy unaudited contracts to mainnet for client funds — the FMA and OPC would both take a dim view, and the brand cost to the client is not worth the timeline saving.

Three things. First, our delivery model assumes NZST (UTC+12 / NZDT UTC+13), not AEST/AEDT — Brisbane account team starts Auckland mornings before Sydney consultancies open. Second, our pattern library covers FMA conduct licensing, Privacy Act 2020, RBNZ BS11, NZISM, the GCDO Cloud Risk Assessment, and Māori Data Sovereignty as first-class concerns, not afterthoughts. Third, our fixed-fee NZD model matches NZ procurement practice (heavy on outcomes-based contracting) rather than the East-Coast-Australia time-and-materials default. We partner with the University of Auckland and AUT for academic collaboration when novel research is genuinely required, and we are upfront when standard patterns will do.