How POLi Payments Actually Work in New Zealand

POLi gets mentioned constantly in the context of online casinos, but very few of those mentions actually explain how the thing works. This page sets that right. We're covering POLi as a general New Zealand payment technology — not casino-specific — because understanding the mechanics is what lets you judge any claim about where it can and can't be used, including the claims covered on our POLi deposit casinos guide.

What kind of company POLi actually is

POLi Payments is a New Zealand payment initiation service provider — not a bank, not an e-wallet, and not a lender. Its entire function is to initiate a payment instruction on your behalf, directly between your bank account and a merchant's account. It doesn't hold your money at any stage, which is an important distinction from a wallet-style product like Skrill or Neteller, where a balance genuinely sits in an account controlled by that provider until you spend or withdraw it.

The mechanics: what's actually happening behind the screen

When you use POLi, three parties are involved in real time: you, your bank, and the merchant (with POLi sitting in the middle as a messenger, not a money-holder). The sequence runs like this:

• The merchant's checkout hands POLi the payment amount and its own account details.
• POLi presents you with a list of participating banks and, once you choose, redirects your browser to that bank's genuine authentication system.
• You log in and approve the payment using your bank's own security steps — this might be a password plus a second factor like a text code or app approval, depending on the bank.
• Your bank executes the transfer directly to the merchant's account and sends a confirmation back through the open-banking connection.
• POLi relays that confirmation to the merchant, who then completes the order.

The crucial design detail is that step three happens entirely on your bank's own platform. POLi never sees, stores, or has the ability to replay your banking login.

Bank partnerships in New Zealand

POLi's ability to work at all depends on having a signed agreement with each bank it connects to. In New Zealand, POLi has open-banking arrangements with the country's main trading banks — ANZ, ASB, BNZ and Westpac among them — running through the 2025–2026 period, based on its public status information. If your own bank isn't part of these arrangements, or a particular merchant hasn't enabled that integration, you simply won't see it as an available option, regardless of what any individual website claims.

The security model, properly explained

Open banking works on a principle of "authenticate with your own bank, authorise a scoped action, and never share your login outside that bank's own systems." In practice: your bank issues a short-lived, purpose-specific authorisation when you approve a payment, rather than handing over your actual credentials to a third party. POLi receives confirmation that a payment happened, not your username, password, or ongoing account access. This is a meaningfully different model from a service that simply stores your card number, because there's no card number or password sitting in POLi's database for a breach to expose in the first place.

A bit of history: why this used to work differently

It's worth understanding where POLi came from, because the "type your banking password into a third-party page" pattern that security commentators warn against today is exactly how POLi and similar services used to operate. Before open-banking standards and accreditation frameworks existed in New Zealand, payment initiators like early POLi used a technique called screen-scraping: you'd enter your actual online banking username and password into POLi's own interface, and POLi's systems would log into your bank on your behalf, read your account information, and submit the payment — essentially impersonating you to your own bank.

This worked, but it had an obvious downside: it trained users to treat handing banking credentials to a third-party website as normal, which is precisely the behaviour that phishing attacks exploit. It also meant a breach at the payment initiator could, in theory, expose live banking credentials rather than just payment metadata. As open-banking regulation and accreditation frameworks matured — driven by a broader shift across markets like the UK, Australia and eventually New Zealand toward regulated, API-based account access — POLi moved to the current model, where your credentials stay with your bank and POLi only ever receives a scoped payment confirmation. That shift is the single biggest reason POLi's current approach is considered reasonably safe for everyday use, and it's a genuinely different risk profile from the service's earlier years.

Why none of this guarantees casino acceptance

Understanding the mechanics makes it clear why casino availability is a separate, commercial question rather than a technical one. POLi being technically capable of connecting to a merchant's checkout doesn't mean POLi or a given bank has chosen to enable that for a gambling merchant specifically — and as covered in detail on our main POLi deposit casinos page, we could not verify any currently licensed casino doing so. The reasons are regulatory rather than technical, largely tied to how NZ's Gambling Act 2003 treats facilitation of overseas betting.

Where to go next

If you want the full security and privacy discussion, including gambling-specific risk factors beyond pure payment technology, read is POLi safe. If you're weighing POLi against other payment rails NZ players actually use for gambling-adjacent purchases, our POLi alternatives comparison covers e-wallets, prepaid vouchers, crypto and card payments side by side.

Frequently asked questions