(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: The EU DAC8 regime regulates the automatic exchange of tax information regarding crypto-asset users (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The SG AML regime regulates the prevention of money laundering and terrorism financing, including customer due diligence and reporting obligations for financial institutions and digital payment token service providers (chunk_ids 3d521e61e49aaf46::38f::e615, 018117ef1e757630::428::d321). The obligations in DAC8 relate to tax transparency and administrative cooperation, while the obligations in SG AML relate to financial crime prevention and internal controls. These are distinct regulatory domains that do not impose conflicting obligations on the same activity; rather, they operate in parallel to address different risks (tax evasion vs. money laundering).


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

Explanation: The EU DAC8 regime regulates tax transparency and the reporting of crypto-asset user information to tax authorities (c0300673081f7232::320::7b46, c0300673081f7232::498::163c). In contrast, the INT_BASEL_GENERAL regime addresses banking supervision, capital adequacy, and leverage ratios (32afd37cade34f84::34b::8d30, ffa7a3de1e0fc7f0::7bc::38ba). The obligations in DAC8 relate to administrative cooperation and tax reporting, while the obligations in INT_BASEL_GENERAL relate to financial institution capital and risk management. There is no specific obligation in one regime that pushes against a specific obligation in the other; they regulate distinct domains of financial activity.


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The FATF VASP regime focuses on AML/CFT obligations and definitions for Virtual Asset Service Providers (chunk 85240528438654b9::1cd::07d7, chunk 85240528438654b9::3c5::d461). The Singapore MAS Prudential Crypto regime focuses on capital adequacy, risk management, and licensing for Digital Payment Token (DPT) services and Stablecoin issuers (chunk 321e082bdbe732d3::309::b080, chunk 7c04f2a0bd85290a::449::02f2). While both regulate crypto assets, they operate in different domains: FATF establishes minimum standards for AML/CFT, whereas MAS establishes prudential standards for financial stability and consumer protection. The passages do not show a specific obligation in one regime pushing against a specific obligation in the other; rather, they reinforce the need for a robust regulatory framework in different areas. Therefore, the regimes are non-conflicting.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The EU_MIFID2 passages describe obligations for investment firms regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1, Article 24, Article 25). The SG_PSA_GENERAL passages discuss the scope of the Payment Services Act, specifically regarding digital payment token services, licensing, and transitional exemptions (e.g., section 23(14), transitional entities). The obligations in MIFID2 relate to the conduct of investment services and product manufacturing, while the obligations in the SG_PSA_GENERAL relate to payment services licensing and asset safeguarding. The regimes regulate distinct domains of financial services activity, and there is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise and the development of a licensing framework for crypto assets to clarify regulatory application (chunk_id d75262e404517e0c::47b::7c9f). The SG_AML passages focus on the Monetary Authority of Singapore's (MAS) AML/CFT supervisory expectations for Digital Payment Token (DPT) service providers, specifically regarding risk awareness and controls (chunk_id 018117ef1e757630::428::d321). The regimes regulate different aspects of the crypto ecosystem: one focuses on the overarching regulatory perimeter and licensing framework for crypto assets in Australia, while the other focuses on specific AML/CFT controls for DPT service providers in Singapore. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

MAS Notice PSN02
5 December 2019
NOTICE TO HOLDERS OF PAYMENT SERVICE LICENCE (DIGITAL PAYMENT TOKEN
SERVICE)
MONETARY AUTHORITY OF SINGAPORE ACT, CAP. 186
PREVENTION OF MONEY LAUNDERING AND COUNTERING THE FINANCING OF
TERRORISM - HOLDERS OF PAYMENT SERVICE LICENCE (DIGITAL PAYMENT TOKEN
SERVICE)
______________________________________________________________________

Explanation: SG_PSA_DPT (MAS Notice PSN02 — AML/CFT obligations for DPT-licence holders under the Payment Services Act) and SG_PSA_GENERAL (broader Singapore Payment Services Act framework and amendments). The DPT framework is a subset of the general PSA framework; they operate together. The cited passages confirm PSN02 is issued under the PSA framework, with the general PS Regulations providing the supporting structure.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

Explanation: The evidence for APRA CPS234 (chunk 4b6fab404e7acfca::3c4::1564) describes the publication as a 'Prudential practice guide' that discusses requirements from legislation but does not create enforceable requirements. The evidence for MIFID II (chunk 28dfda0f6a6539b6::620::92ed) outlines obligations for investment firms regarding product approval processes and information disclosure. The obligations in MIFID II relate to investment services and product governance, while the APRA passage describes the nature of the APRA guidance document itself. There is no specific obligation in APRA CPS234 that pushes against a specific obligation in MIFID II; the regimes regulate different domains (Australian prudential guidance vs. EU investment services regulation).


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

(a) a digital payment token service;
(b) a digital payment token transfer service;
(c) a custodian wallet service;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
"TSOFA" means the Terrorism (Suppression of Financing) Act 2002;
"value transfer" refers to any transaction carried out on behalf of a value transfer originator
through a financial institution with a view to making one or more digital tokens available
to a beneficiary person at a beneficiary institution, irrespective of whether the originator
and the beneficiary are the same person; and
"wire transfer" refers to any transaction carried out on behalf of a wire transfer originator
through a financial institution by electronic means with a view to making an amount of
funds available to a beneficiary person at a beneficiary institution, irrespective of whether
the originator and the beneficiary are the same person.

2 In the case of a limited liability partnership or a limited partnership. Securities Regulation issued by the International Organisation of Securities
Commissions, or the Insurance Core Principles issued by the International Association of
Insurance Supervisors;
"cross-border wire transfer" means a wire transfer where the ordering institution and the
beneficiary institution are located in different countries or jurisdictions and also refers to
any chain of wire transfer in which at least one of the financial institutions involved is
located in a different country or jurisdiction;
"custodian wallet service" means the service of safekeeping and administration of digital
payment tokens or instruments enabling control over digital payment tokens;
"customer", in relation to a bank, means a person (whether a natural person, legal person
or legal arrangement) -
(a) with whom business relations are established or with whom the bank intends to
establish business relations; or
(b) for whom the bank undertakes or intends to undertake any transaction without an
account being opened;
[MAS Notice 626 (Amendment) 2025]
"digital CMP token" means a digital representation of a capital markets product which can
be transferred, stored or traded electronically;
"digital payment token" has the same meaning as defined in section 2(1) of the PS Act;
"digital payment token service" has the same meaning as defined in section 2(1) of the
PS Act;
"digital payment token transfer service" means the service of accepting digital payment
token from one digital payment token address or account, whether in Singapore or outside
Singapore, as principal or agent, for the purposes of transferring, or arranging for the
transfer of, the digital payment token to another digital payment token address or account,
whether in Singapore or outside Singapore;
"digital token" means -
(a) a digital payment token; or
(b) a digital CMP token;
"digital token transaction" means -
(a) a payment service transaction; or

Explanation: APRA CPS 230 is an Australian operational-risk standard for APRA-regulated entities; the SG PSA DPT regime governs Singapore digital-payment-token service providers. Different jurisdictions, different regulated populations, different subject matters. Easy hard negative.

A firm dual-regulated as both APRA-RE and SG DPT licensee — the regimes apply cumulatively on their respective jurisdictional surfaces.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: FATF_R16 (FATF Recommendation 16 — AML travel rule for VAs/VASPs) and INT_BASEL_CRYPTO (Basel prudential treatment of crypto-asset exposures for banks). Both are international standards bodies addressing crypto-asset regulation from different but coordinated angles (AML and prudential). Aligned pillars of international financial regulation.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The AU_PRIVACY regime regulates the cross-border disclosure of personal information, requiring entities to ensure overseas recipients comply with Australian Privacy Principles (APPs) and making the entity accountable for breaches (chunk_ids e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3). The MAS_TRM regime regulates the conduct of financial institutions and licensees, focusing on principles-based guidelines for risk assessments and business practices (chunk_id 20d526d712753652::401::f956). The obligations in AU_PRIVACY relate to data protection and cross-border data flows, while the obligations in MAS_TRM relate to financial institution conduct and risk management. There is no specific obligation in MAS_TRM that directly conflicts with the requirement to ensure overseas recipients comply with APPs. Therefore, the regimes are in different domains and do not conflict.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

Explanation: The EU_EMD2 passages focus on digital operational resilience for the financial sector, specifically Directive (EU) 2022/2556 and Regulation (EU) 2022/2554 (chunks 85307f9e2a040982::14a::134d and cf4bab4773787409::1e6::5413). In contrast, the FATF_R16 passages address Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards, including guidance on digital identity and virtual assets (chunks 5d489619a0fb9ecf::377::a91e and 85240528438654b9::396::417b). The obligations in the EU regime regarding operational resilience do not conflict with the AML/CFT obligations in the FATF regime; rather, they regulate distinct domains of financial stability and compliance.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Article 14
Additional transfer of direct supervision tasks and powers in exceptional circumstances upon the request of
a financial supervisor
1. A financial supervisor may submit a reasoned request to the Authority for the Authority to assume direct supervision
and carry out the tasks listed in Article 5(2) with respect to a particular non-selected obliged entity. The request referred to in the first subparagraph shall only be submitted in exceptional circumstances with the aim of
addressing at Union level a heightened ML/TF risk or compliance failures at a non-selected obliged entity and to ensure
a consistent application of high supervisory standards.
2. The request referred to in paragraph 1 shall:
(a) identify the non-selected obliged entity in respect of which the financial supervisor is of the view that the Authority
should assume direct supervision;
(b) state the reasons for which AML/CFT direct supervision of the non-selected obliged entity is necessary;
(c) identify and duly justify the proposed transfer date and the period for which the transfer of the tasks and powers is
requested; and
(d) provide all necessary supporting information, data and evidence that could be useful for the assessment of the request.
3.

(5) Since the adoption of Directive (EU) 2015/849, recent developments in the Union's criminal law framework have
contributed to strengthening the prevention of and fight against money laundering, its predicate offences and
terrorist financing. Directive (EU) 2018/1673 of the European Parliament and of the Council (9) has led to
a common understanding of the money laundering crime and its predicate offences. Directive (EU) 2017/1371 of
the European Parliament and of the Council (10) defined financial crimes affecting the Union's financial interest,
which should also be considered predicate offences to money laundering. Directive (EU) 2017/541 of the European
Parliament and of the Council (11) has achieved a common understanding of the crime of terrorist financing. As
those concepts are now clarified in Union criminal law, it is no longer necessary for the Union's AML/CFT rules to
define money laundering, its predicate offences or terrorist financing. Instead, the Union's AML/CFT framework
should be fully coherent with the Union's criminal law framework.

(6) Harmonisation in the relevant area of criminal law enables a strong and coherent approach at Union level to the
prevention of and fight against money laundering and its predicate offences, including corruption. At the same time,
such an approach ensures that Member States that have adopted a broader approach to the definition of criminal
activities which constitute predicate offences for money laundering can continue to apply such an approach. For that
reason, in line with Directive (EU) 2018/1673, any kind of punishable involvement in the commission of a predicate
offence for money laundering as criminalised in accordance with national law should also be considered as
a criminal activity for the purposes of that Directive and of this Regulation.

Explanation: AMLA (Regulation (EU) 2024/1620) establishes the EU Anti-Money Laundering Authority — the supervisor for selected obliged entities subject to AMLR (Regulation (EU) 2024/1624) and the TFR. The two regulations are part of the same AML/CFT package and are structurally complementary: AMLR imposes substantive obligations on obliged entities, AMLA supervises those entities directly under Articles 13–14. No obligation in AMLA points against any obligation in AMLR; AMLA's authority is *to enforce* AMLR. Easy hard negative.

AMLA exercised supervisory powers beyond AMLR's substantive scope — Art 13 cabins AMLA's direct-supervision perimeter.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

Explanation: EU_DAC8 (EU directive on administrative cooperation for crypto-asset reporting — Articles 19+ requiring crypto-asset operators to report personal data of crypto-asset users including those resident in non-Union jurisdictions when qualifying competent authority agreements exist) and SG_PDPA (Singapore Personal Data Protection Act — consent/disclosure restrictions). DAC8's cross-jurisdictional reporting of SG-resident crypto-asset users' personal data to EU tax authorities engages PDPA on the SG side. Operationally resolvable via PDPA s.13(b) ('required or authorised under any other written law') plus inter-jurisdictional competent-authority agreements. Same shape as the AML reporting × privacy conflict family, applied to tax-reporting context.


Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The EU_MAR regime regulates market abuse, specifically insider dealing and market manipulation (chunk 5cc4a27bc578287a::4ee::5950). The SG_FSMA_DTSP regime regulates the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022 (chunk cc1be49e9cf8c821::2f4::ea8f). The obligations in MAR relate to the prevention and detection of market abuse by market operators and investment firms, whereas the obligations in SG_FSMA_DTSP relate to the licensing requirements and operational conduct of DTSPs. The passages describe distinct regulatory domains with no apparent overlap of specific obligations that would create a conflict.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The EU AMLA regime focuses on the institutional framework for anti-money laundering and countering the financing of terrorism (AML/CFT), including the establishment of the Authority for AMLA and cooperation with supervisory authorities (chunk df546f2364aaf9e2::25a::6ab3). The Singapore Stablecoin regime focuses on the regulatory perimeter for Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from other digital payment tokens (chunk 58f45cd2ef3de201::36c::e2f6). The obligations in the EU regime relate to information exchange and supervisory cooperation, while the Singapore regime relates to the scope of stablecoins and reserve asset requirements. These are distinct regulatory domains with no apparent overlap of obligations.


Powers of Authority to ensure interoperability between
payment systems
26.-(1) The Authority may, by written notice, direct a payment
service provider (being a major payment institution, an exempt
payment service provider or a person exempt under section 100) that
operates a payment system to adopt any common standard, on such
terms and conditions as the Authority may consider appropriate, in
order to ensure interoperability between different payment systems
operated by different payment service providers. 2020Ed. Payment Services Act 2019 66
(2) In considering whether to issue a written notice under
subsection (1), the Authority must have regard to the following
matters:
(a) whether ensuring interoperability between different
payment systems would be in the interests of the public;
(b) theinterestsofeverypaymentserviceproviderthatwill be
directed to adopt the common standard;
(c) theinterestsofpersonswho,inthefuture,mayberequired,
or may desire, to adopt the common standard;
(d) such other matters as the Authority may consider to be
relevant.

Explanation: The AU_PAYMENT_SYSTEMS passage discusses the powers of the Authority to ensure interoperability between payment systems and the requirements for payment service providers to access technical infrastructures (chunk_id 6644db515eb0e280::423::b3f1). The SG_STABLECOIN passage outlines the scope of MAS's stablecoin framework, specifically distinguishing between Single-currency Stablecoins (SCS) and Non-SCS, and clarifying that Non-SCS will continue to be subject to the existing DPT regulatory regime (chunk_id 58f45cd2ef3de201::36c::e2f6). The obligations in the Australian regime regarding payment system interoperability and access do not overlap with the Singaporean regime's classification of stablecoin types. Therefore, the regimes are in different domains and do not conflict.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure of personal information) and EU_DAC8 (EU directive on administrative cooperation for crypto-asset reporting — mandates cross-jurisdictional reporting of crypto-asset users' personal data, including those resident in non-Union jurisdictions like Australia, to EU tax authorities). When EU CASPs hold data on AU-resident crypto-asset users and transmit it to EU tax authorities under DAC8 reporting requirements, APP 8 engages on the AU side (AU APP entities have obligations regarding overseas-recipient compliance with APPs). Operationally resolvable via APP 6.2(b) ('use or disclosure required or authorised by law') plus APP 8.2(d) permitted-general-situations framework, supported by AU-EU tax-information-exchange agreements. Same shape as DAC8 × PDPA conflict, applied to AU-EU cross-jurisdictional framing. Severity medium because DAC8's structured reporting is sharper than ad-hoc tax reporting.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

1. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

2. MiCA sets out a new legal framework applicable to legal persons or other undertakings
intending to provide crypto-asset services, requiring such entities to submit an
application for authorisation containing all the information set out in Article 62(2) of MiCA,
as specified by the RTS on the information for authorisation as a CASP.

3. The next paragraphs present the cost-benefit analysis of the main policy options included
in this final report on the requirements for the application for authorisation as a CASP
under Article 62 of MiCA.
Problem identification

Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The EU MiCA passages focus on the requirements for obtaining authorisation as a Crypto-Asset Service Provider (CASP), including the information to be submitted to the National Competent Authority (NCA) and the establishment of a public register (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::340::9399). In contrast, the Singapore MAS passages discuss Anti-Money Laundering (AML) and Countering the Financing of Terrorism (CFT) obligations, specifically regarding the FSM Sanctions Regulations, reliance on third parties, and the risk-based supervision of Digital Payment Token (DPT) providers (20d526d712753652::3ee::1555, b49627bb889ef1d9::1b6::0802). While both regimes regulate crypto-asset service providers, the obligations cited relate to distinct regulatory pillars: MiCA focuses on the licensing and registration process, whereas MAS focuses on AML/CFT compliance and sanctions. There is no evidence in the provided passages of a specific obligation in MiCA that directly conflicts with a specific obligation in the MAS AML/CFT regime.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

46 For information on ASIC's interpretation of this obligation, see ASIC PF 209 Australian financial services
licence conditions
Licensing digital asset intermediaries | 23

(vi) having the financial,47 technological, and human resources to carry out and supervise the
financial service covered by the AFSL,
(vii) having a dispute resolution system48 and compensation arrangements for retail clients for
loss or damage suffered due to breaches of obligations, and
(viii) maintaining a risk management system.
Financial requirements
(g) A platform provider must meet:
(i) the standard solvency and positive net asset requirements,49
(ii) the standard cash needs requirement, and
(iii) a net tangible assets (NTA) requirement for holding cash or cash equivalents and holding
liquid assets of at least:
• 0.5 per cent of the value of the facility (if using a sub-custodian digital asset facility that
has $5m NTA),50 or
• $5 million (if performing the custody function).
Info Box 6 Financial requirements
AFSL holders have obligations to meet 'financial requirements'. These requirements are typically
tailored for different financial products through ASIC legislative instruments. The NTA obligation is
to address the costs of orderly wind-up in the event the provider fails.51
A key issue with digital assets is concentration risk (see Info Box 11 Additional Standards for token
holders). The proposed financial requirements balance the need to avoid concentration of digital
assets among a small number of custodians with the need to ensure robust NTA. It sets the
required level of NTA at the greater of $5 million or 0.5% of the value of the assets held by the
facility.52 This arrangement ensures that as a facility expands, and the operational risk exposure of
the platform provider grows, the provider will maintain a corresponding level of financial
resources.

This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers (e.g., platform providers, brokers) dealing in digital asset facilities. The AU_ATO_CRYPTO regime, based on the provided passages, focuses on the tax treatment and compliance approach for crypto assets, including token mapping and tax return reporting. The obligations in Regime A (licensing, financial requirements, conduct) do not directly oppose the obligations in Regime B (tax reporting, compliance approach). The regimes regulate different domains—financial services conduct versus tax administration—resulting in no conflict.


Part 1-Consideration of personal information
privacy
1 Australian Privacy Principle 1-open and transparent
management of personal information
1.1 The object of this principle is to ensure that APP entities manage
personal information in an open and transparent way. Compliance with the Australian Privacy Principles etc.
1.2 An APP entity must take such steps as are reasonable in the
circumstances to implement practices, procedures and systems
relating to the entity's functions or activities that:
(a) will ensure that the entity complies with the Australian
Privacy Principles and a registered APP code (if any) that
binds the entity; and
(b) will enable the entity to deal with inquiries or complaints
from individuals about the entity's compliance with the
Australian Privacy Principles or such a code. APP Privacy policy
1.3 An APP entity must have a clearly expressed and up-to-date policy
(the APP privacy policy) about the management of personal
information by the entity.
1.4 Without limiting subclause 1.3, the APP privacy policy of the APP
entity must contain the following information:
(a) the kinds of personal information that the entity collects and
holds;
(b) how the entity collects and holds personal information;
(c) the purposes for which the entity collects, holds, uses and
discloses personal information;
358 Privacy Act 1988

Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Reporting structuring Related legislation Part 3, Division 3 (Sections 43 and 44) of the AML/CTF Act (latest version) - Threshold
transactions Chapter 19 of the AML/CTF Rules (latest version) - Reportable details for threshold
transactions The content on this website is general and is not legal advice. Before you make a decision or
take a particular action based on the content on this website, you should check its accuracy,
completeness, currency and relevance for your purposes. You may wish to seek independent
professional advice. https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 2/3 https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 3/3

Explanation: The Privacy Act / APPs regulate handling of personal information generally. The TTR regime regulates threshold transaction reports for cash transactions of A$10,000 or more. The two regimes apply to overlapping populations (AUSTRAC-registered reporting entities are also APP entities) but the subject matters are essentially disjoint: TTR is a reporting duty, not a personal-data-handling rule. APP 6.2(b) provides the law-required carve-out for any personal-data leg of the TTR submission. Hard negative.

TTR Form fields demanded personal information beyond what APP 3 collection-purpose would allow — current TTR fields stay within reasonable AML/CTF collection necessity.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

Explanation: The EU_MAR passages regulate financial market integrity, specifically insider dealing and market manipulation (chunks 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The SG_PDPA passages regulate the collection, use, and disclosure of personal data, focusing on consent requirements and data protection (chunks 0e996ae99839f19e::37b::85a8, 0e996ae99839f19e::61d::14e5). The obligations in the EU_MAR relate to preventing market abuse and detecting insider dealing, while the obligations in the SG_PDPA relate to obtaining consent for personal data processing. These are distinct regulatory domains with no apparent overlap of obligations or conflicting requirements.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise and the development of a licensing framework for crypto assets (chunk_ids: d75262e404517e0c::47b::7c9f, e6bb47e92e88e16c::37a::29f6). In contrast, the EU_PSD2 passages regulate payment services, specifically focusing on strong customer authentication and the authorisation of payment institutions (chunk_ids: adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The obligations in the EU regime relate to electronic payment transactions and authentication, whereas the Australian regime addresses the broader regulatory perimeter of crypto assets and the licensing of crypto asset service providers. The two regimes regulate distinct domains—payment services versus crypto asset regulation—and do not impose conflicting obligations on the same entity or transaction type.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU_REVERSE_SOLICITATION regime regulates the authorization and solicitation of crypto-asset services for third-country firms serving EU clients (chunk_id 25cbbd878a1b21d3::4f8::561c). In contrast, the INT_IOSCO_GENERAL regime provides a general methodology and principles for securities regulation, including disclosure standards and cooperation between securities authorities (chunk_id f173909614befd49::455::1a1a). The passages describe distinct regulatory domains—one specific to MiCA crypto-asset services and the other a general international framework for securities regulation—without indicating any specific obligation in one regime that conflicts with the other.


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

32. An APRA-regulated entity's internal audit activities must include a review of the
design and operating effectiveness of information security controls, including

11 Also referred to as an 'untrusted' environment.

12 For the avoidance of doubt, paragraph 28 of this Prudential Standard applies to all information
assets managed by related parties and third parties, not only those captured under agreements with
service providers of outsourced material business activities under Prudential Standard CPS 231
Outsourcing or Prudential Standard SPS 231 Outsourcing.
CPS 234 - 7

those maintained by related parties and third parties (information security control
assurance).

33. An APRA-regulated entity must ensure that the information security control
assurance is provided by personnel appropriately skilled in providing such
assurance.

Notifications
Interaction between CPS 232 and CPS 234 notifications
Under CPS 234, an APRA-regulated entity must notify APRA of information security
incidents that meet specified criteria. Prudential Standard CPS 232 Business Continuity
Management also includes a requirement for notifying APRA of disruptions that meet
specified criteria. Where a disruption resulting from an information security incident
meets the criteria for notifying APRA under CPS 232, an APRA-regulated entity must
notify APRA in accordance with the CPS 232 requirements. Under these circumstances,
the notification under CPS 232 would be taken to also be a notification under CPS 234. CPS 234 notifications
Under CPS 234, an APRA-regulated entity is required to notify APRA of information
security incidents and information security control weaknesses as soon as possible and
no later than the timeframes prescribed. For this purpose, APRA expects a regulated
entity would notify APRA as soon as possible of such an incident or control weakness,
even in the absence of complete information as to the incident and the intended
response.

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

Explanation: APRA's Prudential Standard CPS 234 imposes an information-security capability, incident-notification and third-party-management regime on APRA-regulated entities. DORA establishes a substantively parallel ICT risk-management, incident-reporting and third-party risk regime on EU financial entities. They share architecture (governance accountability, board oversight, third-party controls, incident notification) but apply to non-overlapping regulated populations and use different reporting channels and thresholds. A single firm with operations in both jurisdictions must comply with both, but the obligations do not pull against each other; rather, DORA tends to be the strict-set and CPS 234 compliance is largely subsumed by mature DORA controls. This is a candidate for the equivalences corpus.

Reporting timelines were strictly incompatible (e.g. APRA requires same-day notification for a class of incident that DORA forbids reporting until classified) — current text shows no such collision.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 230 operational-risk management standard and Australian AML/CTF Act + Rules (binding instruments) operate in disjoint regulatory domains at the obligation level. Operational risk management vs AML/CTF statutory obligations — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: AU_FEDREG_AML (Australia's AML/CTF Act and Rules — AUSTRAC framework) and SG_MAS_AML_GENERAL (MAS AML/CFT supervisory framework). Both jurisdictions implement comparable AML/CFT obligations consistent with FATF standards. Reinforcing rather than conflicting.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Explanation: The AU_AML_CTF regime focuses on anti-money laundering and counter-terrorism financing obligations, specifically requiring reporting entities to report suspicious matters, threshold transactions, and international funds transfer instructions to AUSTRAC (chunk 254ca2d92d196180::2ac::a5fe). The EU_DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-assets and their users (chunk c0300673081f7232::320::7b46). The obligations in the AU regime are regulatory compliance and financial crime prevention, whereas the obligations in the EU regime are tax reporting and administrative cooperation. The two regimes regulate distinct domains—financial crime compliance versus tax administration—and do not impose conflicting obligations on the same activity.


28. Third-country firms should be able to provide records tracking the relationship with the
client and, in particular, whether the client has taken the initiative to receive crypto asset
services with respect to a new product.

5.4 When is a crypto-asset or a crypto-asset service of the same
type as another one (Guideline 4)

29. The reverse solicitation regime leaves open the possibility for a third-country firm to
market crypto-assets or crypto-asset services or activities of the same type in the context
of the relationship started at the own exclusive initiative of a given client, subject to the
third-country firm also complying with Guideline 3 above.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU_REVERSE_SOLICITATION regime regulates the authorization requirements and solicitation activities of third-country crypto-asset service providers (CASPs) within the EU (e.g., chunk 25cbbd878a1b21d3::298::6f7d). The MAS_TRM regime, as evidenced by chunk 20d526d712753652::401::f956, focuses on the application of principles-based guidelines (TRM Guidelines) and Fit and Proper criteria to licensees in Singapore. The passages describe distinct regulatory frameworks governing different jurisdictions and financial sectors (crypto-asset services vs. general financial institution licensing and conduct), with no evidence of overlapping obligations or conflicting requirements between the two.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU DAC 8 crypto-asset tax-reporting directive and EU EMD2 e-money-institution directive operate in disjoint regulatory domains at the obligation level. Crypto-tax reporting vs e-money institution authorisation — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.