A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

Content of the proposed updates
12 The proposed changes to draft updated INFO 225 include:
(a) adding guidance on a facility for making a financial investment (s763B
of the Corporations Act);
(b) decreasing the focus on the role of initial coin offerings, as this is only
one method for selling digital assets to consumers;
(c) adding further discussion of the typical financial services that we expect
an entity would apply for when applying for or applying to vary an
Australian financial services (AFS) licence, and noting the application
process;
(d) including 13 worked examples to outline how ASIC interprets the
existing financial product definitions applied to hypothetical scenarios;
(e) extending the good practice guidance directed to responsible entities in
INFO 225 to also apply to providers of custodial and depository
services;
(f) adding a section to address applications for relief and granting no-action
letters;
(g) adding consideration of the design and distribution obligations; and
(h) edits to consolidate concepts, improve flow and provide further details
and clarifications, where appropriate.
13 The current version of INFO 225 is titled 'Crypto-assets'. We propose as
part of this update to change the title of INFO 225 to 'Digital assets', and use
this term throughout.

This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: AU_ATO_CRYPTO (ATO crypto-asset tax framework — every disposal is a CGT event) and AU_ASIC_CRYPTO (ASIC AFSL/INFO 225 framework — operational obligations on entities providing crypto-asset services). The friction is ongoing: every transaction on an AU crypto-asset platform generates both a CGT event (taxpayer obligation, platform-side recordkeeping) and AFSL operational obligations (record-keeping, reporting, suitability documentation for facility access). Neither regime causes the other's friction, but the combination scales with transaction count — design choice for crypto regulation in AU creates a recurring cost both parties bear.


1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The passages for SG_MAS_AML_GENERAL discuss AML/CFT obligations, specifically the licensing of Digital Payment Token (DPT) service providers and the supervision of money laundering risks (chunk_ids 321e082bdbe732d3::309::b080, b49627bb889ef1d9::1b6::0802). The passages for SG_MAS_PRUDENTIAL_CRYPTO discuss prudential treatment and capital requirements for cryptoasset exposures and stablecoin issuers (chunk_ids 321e082bdbe732d3::309::b080, 7c04f2a0bd85290a::449::02f2). While both regimes apply to entities in the digital asset space, the specific obligations—AML/CFT compliance versus prudential capital and risk management—are distinct and do not create a direct conflict. The regimes regulate different aspects of the digital asset ecosystem.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access controls and cryptography under the NIS2 Directive (chunk_id 3c9eb3a25c93f394::474::4786). The SG_PSA_DPT passage applies to holders of a payment service licence providing digital payment token services under the Payment Services Act 2019 (chunk_id 4b4c3c417dc293ba::185::f41d). The obligations regarding ICT security and access controls under NIS2 are distinct from the AML/CFT licensing and operational requirements for DPT service providers under Singapore's MAS Notice PSN02. The regimes regulate different domains (ICT security vs. financial services licensing and AML/CFT), and there is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The evidence from the Australian Corporations Act passage (chunk 0fc4f857c226f510::375::66b5) outlines general corporate governance duties and interactions with the Australian Charities and Not-for-profits Commission Act, such as director duties and constitutional requirements. The evidence from the Singapore Stablecoin passage (chunk 58f45cd2ef3de201::36c::e2f6) describes the scope of MAS's stablecoin regulatory regime, specifically focusing on Single-Currency Stablecoins (SCS) and their distinction from Digital Payment Tokens. The two regimes regulate distinct domains: the Australian regime governs corporate governance and director responsibilities, while the Singapore regime governs the issuance and regulation of specific digital assets (stablecoins). There is no evidence of a specific obligation in the Australian Corporations Act that conflicts with a specific obligation in the Singapore Stablecoin regime. Therefore, the regimes are non-conflicting.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

(89) Provision of payment services by the payment services providers may entail processing of personal data. Directive
95/46/EC of the European Parliament and of the Council ( 1) , the national rules which transpose Directive 95/46/EC
and Regulation (EC) No 45/2001 of the European Parliament and of the Council ( 2 ) are applicable to the
processing of personal data for the purposes of this Directive. In particular, where personal data is processed
for the purposes of this Directive, the precise purpose should be specified, the relevant legal basis referred to, the
relevant security requirements laid down in Directive 95/46/EC complied with, and the principles of necessity,
proportionality, purpose limitation and proportionate data retention period respected. Also, data protection by
design and data protection by default should be embedded in all data processing systems developed and used
within the framework of this Directive.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: EU_GDPR (cross-border data transfer principles) and SG_PSA_GENERAL (Singapore Payment Services Act licensing framework including AML/CFT and customer-due-diligence obligations on PSA licensees). When SG PSA-licensed entities serve EU-resident clients, the PSA-mandated customer data collection and transmission to MAS or counterparty CASPs engages GDPR cross-border transfer restrictions on the EU side. Operationally resolvable via GDPR Article 6(1)(c) + Chapter V mechanisms. Same conflict shape as EU TFR ↔ EU GDPR.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

Explanation: The FATF passages (chunk_id fe52dd87e13dba41::261::59a4) provide general guidance on risk assessment and the complementary nature of financial inclusion and AML/CFT objectives. The SG Stablecoin passages (chunk_id 58f45cd2ef3de201::36c::e2f6) describe the scope of Singapore's MAS stablecoin framework, specifically that non-SCS will continue to be subject to the existing DPT regulatory regime. The regimes regulate different domains: FATF provides international standards for AML/CFT risk assessment, while the SG Stablecoin regime defines the specific regulatory perimeter for stablecoin issuance in Singapore. There is no specific obligation in the FATF passages that pushes against a specific obligation in the SG Stablecoin passages.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules — AUSTRAC reporting obligations requiring KYC data collection and cross-border transfer reporting) and SG_PDPA (Singapore Personal Data Protection Act restricting collection and disclosure of personal data without consent or statutory authorisation). When AU reporting entities have SG-resident customers and report their data to AUSTRAC or to SG counterparties, PDPA's restrictions engage. Operationally resolvable via PDPA s.13(b) (required or authorised by law) carve-out. Same conflict shape as the labelled AU AML/CTF ↔ AU PRIVACY conflict in the careful cohort, scaled to SG-cross-jurisdictional framing.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Explanation: AU_ASIC_AFSL (Australian Financial Services Licence framework — proposed digital-asset-facility licensing) and EU_MIFID2 (EU Markets in Financial Instruments Directive — investment-firm conduct of business and product governance). Both regulate financial-services entities in their jurisdictions but with materially different mechanisms — AU AFSL is general entity-licensing; EU MiFID2 is investment-firm-specific conduct. Distinct jurisdictional perimeters; no direct conflict on cited passages.


Part 1-Consideration of personal information
privacy
1 Australian Privacy Principle 1-open and transparent
management of personal information
1.1 The object of this principle is to ensure that APP entities manage
personal information in an open and transparent way. Compliance with the Australian Privacy Principles etc.
1.2 An APP entity must take such steps as are reasonable in the
circumstances to implement practices, procedures and systems
relating to the entity's functions or activities that:
(a) will ensure that the entity complies with the Australian
Privacy Principles and a registered APP code (if any) that
binds the entity; and
(b) will enable the entity to deal with inquiries or complaints
from individuals about the entity's compliance with the
Australian Privacy Principles or such a code. APP Privacy policy
1.3 An APP entity must have a clearly expressed and up-to-date policy
(the APP privacy policy) about the management of personal
information by the entity.
1.4 Without limiting subclause 1.3, the APP privacy policy of the APP
entity must contain the following information:
(a) the kinds of personal information that the entity collects and
holds;
(b) how the entity collects and holds personal information;
(c) the purposes for which the entity collects, holds, uses and
discloses personal information;
358 Privacy Act 1988

Authorisation as a crypto-asset service provider pursuant to Article 59 is not required for providing custody and
administration of crypto-assets on behalf of clients or for providing transfer services for crypto-assets in relation to
crypto-assets whose offers to the public are exempt pursuant to paragraph 3 of this Article, unless:
(a) there exists another offer to the public of the same crypto-asset and that offer does not benefit from the exemption;
or
(b) the crypto-asset offered is admitted to a trading platform.
6. Where the offer to the public of the crypto-asset other than an asset-referenced token or e-money token concerns
a utility token providing access to goods and services that do not yet exist or are not yet in operation, the duration of
the offer to the public as described in the crypto-asset white paper shall not exceed 12 months from the date of
publication of the crypto-asset white paper.
7. Any subsequent offer to the public of the crypto-asset other than an asset-referenced token or e-money token shall
be deemed a separate offer to the public to which the requirements of paragraph 1 apply, without prejudice to the
possible application of paragraph 2 or 3 to the subsequent offer to the public.

Explanation: The Privacy Act/APPs regulate handling of personal information by Australian APP entities. MiCA regulates crypto-asset market authorisation and conduct by EU CASPs. The two regimes apply to different regulated populations in different jurisdictions and address different subject matters. An Australian APP entity is not within MiCA's territorial scope unless it also operates as a CASP in the EU; in that case it complies with both independently. No obligation in one pushes against any obligation in the other.

MiCA delegated regulation purported to override APP cross-border-disclosure rules for an Australian-based CASP (it does not and could not, given territorial scope).


13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for ICT security measures, specifically access controls and cryptography, within the context of the Network and Information Security Directive (NIS2) and the Critical Entities Regulation. In contrast, the SG_AML passage outlines mandatory training obligations for officers and employees regarding AML/CFT laws, suspicious transaction reporting, and internal policies. The obligations in the EU_NIS2 passage relate to technical ICT security measures, while the obligations in the SG_AML passage relate to financial crime prevention and staff training. These are distinct regulatory domains with no apparent overlap or conflict.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Explanation: AU_TRAVEL_RULE (FATF travel rule for digital currency exchanges — AUSTRAC consultation; per the cited passage Australia has NOT YET implemented the travel rule for digital currency exchanges) and SG_PDPA (Singapore Personal Data Protection Act). When/if Australia implements the FATF travel rule, AU DCEs sending crypto value to SG counterparties would need to share originator/beneficiary personal data, engaging PDPA's collection/disclosure restrictions on the SG side. The conflict is currently latent (interpretive_fact_sensitive: depends on whether and how AU implements the travel rule, and whether the SG counterparty is a regulated DPT licensee with the 'required by law' carve-out). Low severity because the obligation is not in force and the resolution path (SG PDPA s.13(b) carve-out) is established.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU MICA Title IV EMT passages regulate the content and liability of crypto-asset white papers for issuers of e-money tokens (e.g., Article 51 notification requirements and Article 52 liability for misleading information) [491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e]. The Singapore foundational legislation passages discuss MAS enforcement actions against ICO issuers and exchanges, and the intention to align with international AML/CFT standards [b49627bb889ef1d9::3ef::7168, 7c04f2a0bd85290a::413::fc6a]. The obligations in the EU regime regarding white paper disclosure and liability do not directly oppose the enforcement or supervisory scope described in the Singapore passages. Instead, the Singapore text explicitly acknowledges the applicability of foreign regulations, such as the EU MiCA, and suggests that foreign SCS (Security Token Offerings) meeting equivalent standards may be recognized [7c04f2a0bd85290a::413::fc6a]. Therefore, the regimes regulate distinct aspects of the token ecosystem (disclosure standards vs. enforcement and supervisory scope) and do not conflict.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

FATF REPORT
Virtual Assets
Red Flag Indicators
of Money Laundering and
Terrorist Financing
September 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Money Laundering and Terrorist Financing Red Flag Indicators Associated with Virtual Assets,
FATF (2020),
FATF, Paris, France,
www.fatf-gafi.org/publications/fatfrecommendations/documents/Virtual-Assets-Red-Flag-Indicators.html
© 2020 FATF/OECD.

Explanation: The EU_MAR regime regulates market integrity, specifically insider dealing and market manipulation (chunks 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The FATF_R16 regime regulates Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards, specifically regarding virtual assets and money transfer services (chunks 5d489619a0fb9ecf::377::a91e, d758cb6128239f36::429::2caa). The obligations in EU_MAR focus on preventing market abuse and detecting insider dealing, while FATF_R16 focuses on identifying customers and detecting money laundering/terrorist financing. These are distinct regulatory domains with no apparent overlap of obligations.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: EU_NIS2 (EU Network and Information Security Directive — ICT access controls and security) and SG_MAS_OUTSOURCING (MAS's Outsourcing Guidelines — material outsourcing arrangements with third-party service providers). Both touch on third-party / ICT risk but address different specific concerns — NIS2 is broad cybersecurity for in-scope entities; MAS outsourcing focuses on supervision of outsourced business activities. Distinct mechanisms; no direct obligation conflict.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

Explanation: The Australian regime (AU_ASIC_CRYPTO) focuses on the licensing and classification of crypto-assets as financial products and services under the Corporations Act 2001. The FATF regime (FATF_R16) focuses on anti-money laundering and counter-terrorist financing (AML/CFT) obligations for Virtual Asset Service Providers (VASPs). The passages confirm that the FATF guidance addresses AML/CFT risks and red flags for virtual assets (chunk_id d758cb6128239f36::429::2caa), while the Australian guidance outlines the licensing framework for entities offering crypto products and services (chunk_id abc9007e907ef318::3c9::4151). These are distinct regulatory domains: one governs financial product licensing and consumer protection, while the other governs financial crime prevention. There is no evidence of a direct obligation in one regime that conflicts with a specific obligation in the other.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Explanation: The AU_TRAVEL_RULE passages describe the registration and management of remittance networks and virtual asset service providers (chunk_ids c4a92930a8caf822::380::0a18, c4a92930a8caf822::57d::3f76). The EU_MIFID2 passages describe obligations for investment firms regarding product governance, suitability assessments, and client information (chunk_ids 28dfda0f6a6539b6::620::92ed, 28dfda0f6a6539b6::502::1957). The obligations in the AU regime relate to anti-money laundering/counter-terrorist financing (AML/CTF) registration and reporting, while the obligations in the EU regime relate to investment services and product governance. These are distinct regulatory domains with no apparent overlap of obligations.


Powers of Authority to ensure interoperability between
payment systems
26.-(1) The Authority may, by written notice, direct a payment
service provider (being a major payment institution, an exempt
payment service provider or a person exempt under section 100) that
operates a payment system to adopt any common standard, on such
terms and conditions as the Authority may consider appropriate, in
order to ensure interoperability between different payment systems
operated by different payment service providers. 2020Ed. Payment Services Act 2019 66
(2) In considering whether to issue a written notice under
subsection (1), the Authority must have regard to the following
matters:
(a) whether ensuring interoperability between different
payment systems would be in the interests of the public;
(b) theinterestsofeverypaymentserviceproviderthatwill be
directed to adopt the common standard;
(c) theinterestsofpersonswho,inthefuture,mayberequired,
or may desire, to adopt the common standard;
(d) such other matters as the Authority may consider to be
relevant.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: AU_PAYMENT_SYSTEMS (PSRA 1998 — RBA powers over payment-system access and interoperability) and SG_PSA_DPT (MAS DPT licence AML notice under the PSA) both fall in the broad 'payments' topic but address different specific obligations. The A passage is about MAS authority to direct payment service providers on interoperability standards (note: appears to be SG content despite the AU prefix — possible weak retrieval). B is the MAS PSN02 AML notice for DPT licensees. No obligation tension visible on the cited passages.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The EU regime (Regime A) regulates the solicitation of clients by third-country crypto-asset service providers, specifically prohibiting reverse solicitation where the firm solicits clients in the EU. The Singapore regime (Regime B) discusses the regulatory scope of the Monetary Authority of Singapore (MAS) regarding Security Token Offerings (SCS) and the adoption of a collegiate approach with regulators in other jurisdictions, including the recognition of foreign SCS issued under EU MiCA. The passages do not describe conflicting obligations; instead, they address distinct regulatory topics—client solicitation in the EU versus the recognition of foreign security tokens in Singapore. Therefore, the regimes are in different domains and do not conflict.


(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

Explanation: EU_AMLR_TFR (EU's AMLR + TFR — Regulation 2023/1113 and the broader EU AML framework) and INT_FATF_GENERAL (FATF's AML/CFT recommendations). The EU's AMLR/TFR is the EU's binding implementation of FATF AML standards including R16; the regimes are aligned by design.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

Binance is supportive of the redemption-related requirements. In general, five business
days should be sufficient to return the par value of the SCS to customers. However, given
that this is ultimately dependent on the availability of the relevant banking services,
Binance would propose that this is aligned to the prevailing turnaround time provided by
the financial institution that the reserve assets are held with. Question 7. MAS seeks comments on whether the prudential requirements outlined in paragraph
4.21 are risk proportionate. MAS welcomes suggestions on alternative approaches to
address the risks. Binance is supportive of the prudential requirements outlined in paragraph 4.21. 15 August 2023 | 23
Question 10. MAS seeks comments on whether the scenario outlined in paragraph 4.22 is a likely
development and whether the approaches outlined in paragraph 4.24 are feasible. MAS
welcomes suggestions on other approaches to address this issue. As per Q1, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU PSD2 passages focus on strong customer authentication (SCA) and security credentials for payment services (chunks adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The SG MAS passages discuss the prudential treatment of cryptoasset exposures, stablecoins, and the Payment Services Act (chunks 7c04f2a0bd85290a::46d::fd1b, 7c04f2a0bd85290a::449::02f2). The obligations in PSD2 regarding authentication and security credentials do not directly oppose the MAS prudential requirements for cryptoasset exposures or stablecoins. The regimes regulate distinct aspects of financial services—payment security versus cryptoasset prudential standards—resulting in no direct conflict.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Article 81
Financial rules
The financial rules applicable to the Authority shall be adopted by the Executive Board after consulting the Commission.
They shall not depart from Delegated Regulation (EU) 2019/715 unless such a departure is specifically required for the
Authority's operation and the Commission has given its prior consent.
(41) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules
applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013,
(EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision
No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).
76/90 ELI: http://data.europa.eu/eli/reg/2024/1620/oj

EN

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The EU AMLD6 passages discuss financial rules and operational resilience for the financial sector (chunk 85307f9e2a040982::14a::134d) and the financial rules applicable to the Authority (chunk 3a1785f95cb37b3c::34d::1756). The SG PSA_GENERAL passages discuss the scope of Payment Services Regulations, specifically regarding Digital Payment Token Services (DPT) and licensing (chunk 14cb9eb911d15322::42b::fe23), and the submission of comments on the regulatory scope of SCS (Secure Custody Services) (chunk 321e082bdbe732d3::309::b080). The obligations and topics in the EU passages (financial rules, resilience) do not overlap with the obligations and topics in the SG passages (payment services licensing, DPT scope). Therefore, the regimes regulate different domains and do not conflict.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU PSD2 payment-services directive are designed to coexist — obligations apply cumulatively without collision. PSPs are AMLR-obliged entities; AMLA supervises them via Article 13's direct-supervision perimeter — aligned. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Article 18(2) and in so far as this Directive provides for
more of the activities listed in Article 6(1)(e) and it is
harmonisation, Member States shall not maintain or introduce
unknown in advance what proportion of funds is to be
provisions other than those laid down in this Directive.
used as electronic money, all funds requested by the elec
tronic money holder shall be redeemed.
2. Member States shall ensure that an electronic money
7. Notwithstanding paragraphs 4, 5 and 6, redemption rights issuer does not derogate, to the detriment of an electronic
of a person, other than a consumer, who accepts electronic money holder, from the provisions of national law imple
money shall be subject to the contractual agreement between menting or corresponding to provisions of this Directive
the electronic money issuer and that person. except where explicitly provided for therein.

Article 12

Article 28(5) and Article 29(7) thereof, shall apply mutatis mutandis to such electronic money institution.
5. Notwithstanding paragraph 4 of this Article, electronic money institutions shall not issue electronic money
through agents. Electronic money institutions shall be allowed to provide payment services referred to in point (a)
of Article 6(1) of this Directive through agents subject to the conditions laid down in Article 19 of Directive (EU)
2015/2366.';
(2) in Article 18, the following paragraph is added:
'4. Member States shall allow electronic money institutions that have, before 13 January 2018, taken up activities
in accordance with this Directive and with Directive 2007/64/EC in the Member State in which their head office is
located to continue those activities in that Member State or in another Member State without being required to seek
authorisation in accordance with Article 3 of this Directive or to comply with other requirements laid down or
referred to in Title II of this Directive until 13 July 2018.
Member States shall require electronic money institutions referred to in the first subparagraph to submit all relevant
information to the competent authorities in order to allow the later to assess, by 13 July 2018, whether those
electronic money institutions comply with the requirements laid down in Title II of this Directive, and, if not, which
measures need to be taken in order to ensure compliance or whether a withdrawal of authorisation is appropriate.
Electronic money institutions referred to in the first subparagraph which upon verification by the competent
authorities comply with the requirements laid down in Title II shall be granted authorisation and shall be entered
in the register. Where those electronic money institutions do not comply with the requirements laid down in Title II
by 13 July 2018 they shall be prohibited from issuing electronic money.'.

Explanation: EMD2 (Directive 2009/110/EC) and PSD2 (Directive (EU) 2015/2366) are companion directives: EMD2 authorises and regulates electronic money institutions (EMIs), PSD2 authorises payment service providers (PSPs) more broadly. EMIs are specifically named in PSD2 as a class of PSP, with Article 28 cross-referencing EMD2 for agent-based distribution rules. The two directives are explicitly aligned — no obligation in one pushes against any obligation in the other. Hard negative.

EMD2 Art 11 redemption rules required disclosures PSD2 confidentiality rules forbade — no such collision in current text.


PART 3
GENERAL RULES WITH RESPECT TO
PROTECTION OFAND ACCOUNTABILITY FOR
PERSONAL DATA
11. Compliance with Act
12. Policies and practices

2020Ed. Act 2012 2

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Section
13. Consent required
14. Provision of consent
15. Deemed consent
15A. Deemed consent by notification
16. Withdrawal of consent
17. Collection, use and disclosure without consent
Division 2 - Purpose
18. Limitation of purpose and extent
19. Personal data collected before 2 July 2014
20. Notification of purpose

PART 5
ACCESS TO AND CORRECTION OF
PERSONAL DATA
21. Access to personal data
22. Correction of personal data
22A. Preservation of copies of personal data

Transfer of personal data outside Singapore
26.-(1) An organisation must not transfer any personal data to a
country or territory outside Singapore except in accordance with
requirements prescribed under this Act to ensure that organisations
provideastandardofprotectiontopersonaldatasotransferredthatis
comparable to the protection under this Act. (2) The Commission may, on the application of any organisation,
by written notice exempt the organisation from any requirement 33 Act 2012 2020Ed.
prescribed pursuant to subsection (1) in respect of any transfer of
personal data by that organisation. (3) An exemption under subsection (2) -
(a) may be granted subject to such conditions as the
Commission may specify in writing; and
(b) neednotbepublishedintheGazetteandmayberevokedat
any time by the Commission. (4) The Commission may at any time add to, vary or revoke any
condition imposed under this section.

13 Act 2012 2020Ed.
by a data intermediary as if the personal data were processed by the
organisation itself. (4) This Act does not apply in respect of -
(a) personal data about an individual that is contained in a
record that has been in existence for at least 100 years; or
(b) personal data about a deceased individual, except that the
provisions relating to the disclosure of personal data and
section 24 (protection of personal data) apply in respect of
personal data about an individual who has been dead for
10 years or less. (5) Except where business contact information is expressly
mentioned, Parts 3, 4, 5, 6 and 6A do not apply to business contact
information.
[40/2020]
(6) Unless otherwise expressly provided in this Act -
(a) nothinginParts 3,4, 5, 6, 6Aand6Baffectsanyauthority,
right, privilege or immunity conferred, or obligation or
limitation imposed, by or under the law, including legal
privilege, except that the performance of a contractual
obligation is not an excuse for contravening this Act; and
(b) theprovisionsofotherwrittenlawprevailtotheextentthat
any provision of Parts 3, 4, 5, 6, 6A and 6B is inconsistent
with the provisions of that other written law.
[40/2020]

"payment service transaction" means any transaction accepted, processed, or executed
by the merchant bank in the course of carrying on its business of providing a specified
payment service;
"personal data" has the same meaning as defined in section 2(1) of the Personal Data
Protection Act 2012;
"PS Act" means the Payment Services Act 2019;
"reasonable measures" means appropriate measures which are commensurate with the
level of money laundering or terrorism financing risks;
"SFA" means the Securities and Futures Act 2001;
"specified payment service" means any of the following service:
(a) a digital payment token service;
(b) a digital payment token transfer service;
(c) a custodian wallet service;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
"TSOFA" means the Terrorism (Suppression of Financing) Act 2002;
"value transfer" refers to any transaction carried out on behalf of a value transfer originator
through a financial institution with a view to making one or more digital tokens available
to a beneficiary person at a beneficiary institution, irrespective of whether the originator
and the beneficiary are the same person; and
"wire transfer" refers to any transaction carried out on behalf of a wire transfer originator
through a financial institution by electronic means with a view to making an amount of
funds available to a beneficiary person at a beneficiary institution, irrespective of whether
the originator and the beneficiary are the same person.

2 In the case of a limited liability partnership or a limited partnership. Securities Regulation issued by the International Organisation of Securities
Commissions, or the Insurance Core Principles issued by the International Association of
Insurance Supervisors;
"cross-border wire transfer" means a wire transfer where the ordering institution and the
beneficiary institution are located in different countries or jurisdictions and also refers to
any chain of wire transfer in which at least one of the financial institutions involved is
located in a different country or jurisdiction;
"custodian wallet service" means the service of safekeeping and administration of digital
payment tokens or instruments enabling control over digital payment tokens;
"customer", in relation to a bank, means a person (whether a natural person, legal person
or legal arrangement) -
(a) with whom business relations are established or with whom the bank intends to
establish business relations; or
(b) for whom the bank undertakes or intends to undertake any transaction without an
account being opened;
[MAS Notice 626 (Amendment) 2025]
"digital CMP token" means a digital representation of a capital markets product which can
be transferred, stored or traded electronically;
"digital payment token" has the same meaning as defined in section 2(1) of the PS Act;
"digital payment token service" has the same meaning as defined in section 2(1) of the
PS Act;
"digital payment token transfer service" means the service of accepting digital payment
token from one digital payment token address or account, whether in Singapore or outside
Singapore, as principal or agent, for the purposes of transferring, or arranging for the
transfer of, the digital payment token to another digital payment token address or account,
whether in Singapore or outside Singapore;
"digital token" means -
(a) a digital payment token; or
(b) a digital CMP token;
"digital token transaction" means -
(a) a payment service transaction; or

Explanation: MAS Notice PSN02 and the parallel MAS notices (626/824/1014) impose customer due diligence on DPT service providers, including collection of identifying information on customers and ongoing transaction monitoring. PDPA Part 4 imposes a consent baseline on the collection, use and disclosure of personal data, supplemented by Section 26 restricting cross-border transfer of personal data. The tension is operational: DPT service providers must collect customer personal data under PSN02-grade obligations while remaining within PDPA's consent architecture. Resolution: PDPA Part 4 Division 3 permits collection, use and disclosure without consent where required or authorised under written law — and MAS Notices issued under the PS Act / MAS Act / FSM Act are such law. For cross-border transmission, PDPA s 26's comparable-protection standard is met where the receiving institution is subject to equivalent AML/CFT obligations. The pair mirrors the previously-labelled `SG_AML :: SG_PDPA` operationally resolvable conflict and reaches the same conclusion at comparable severity.

Rely on the PDPA 'required or authorised by law' carve-out for collection/use/disclosure of CDD data under PSN02.

For cross-border DPT-transfer information, evidence comparable-protection standard via the receiving institution's AML/CFT obligations or binding contractual clauses.

When CDD data cannot be lawfully transmitted, refuse the wire transfer — itself the PDPA-compatible outcome under PSN02 paragraph 11.9 / 15.11.

DPT service provider is MAS-licensed under the PS Act and captured by PSN02 or one of the parallel notices.

Customer is a natural person under PDPA scope (entity-level CDD has a different overlay).


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

19. Article 62(4) of MiCA sets out that NCAs must not require an applicant CASP to provide
any information referred to in Article 62(2) of MiCA that they have already received under
the respective authorisation procedures in accordance with Directive 2009/110/EC4,
2014/65/EU5 or (EU) 2015/23666, or pursuant to national law applicable to crypto-asset
services prior to the date of entry into force of MiCA, provided that such previously
submitted information or documents are still up-to-date.

3.2 Feedback statement
Q2: Do you agree with the list of information to be provided with an application for
authorisation as a crypto-asset service provider? Please also state the reasons for your
answer.

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: The EU MiCA passages (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::2bc::cafa) focus on the requirements for obtaining authorisation as a Crypto-Asset Service Provider (CASP) and the information required for applications. The SG MAS Outsourcing passages (a82833dc0f7ca903::5f1::735d) focus on the supervision of material outsourcing arrangements and the rights of MAS to access information from service providers. While both regimes involve supervision and information access, they regulate distinct obligations: MiCA regulates the licensing and registration of CASPs, whereas MAS regulates the conduct of outsourcing by financial institutions. There is no specific obligation in MiCA that conflicts with the specific outsourcing obligations in the MAS guidelines.