This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_ATO_CRYPTO passages discuss the general tax treatment and adoption of crypto assets in Australia, including token mapping and compliance approaches (chunk_id e6bb47e92e88e16c::567::36c4). The EU_REVERSE_SOLICITATION passages specifically address the regulatory treatment of third-country crypto-asset service providers and the 'reverse solicitation' exemption under MiCA, focusing on client initiative and marketing activities (chunk_id 25cbbd878a1b21d3::4f8::561c). The obligations in the EU regime regarding client initiative and marketing do not impose a specific tax reporting or compliance burden that contradicts the general Australian tax framework described in the AU passages. Therefore, the regimes regulate different aspects of the crypto ecosystem and do not conflict.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

94. The FATF Standards, including the definitions of virtual assets and VASPs, represent
a minimum standard for countries to introduce. In line with the RBA, countries may
choose to extend their AML/CFT regimes to include other digital assets and entities,
beyond the FATF definition of virtual asset and VASP. Such a determination should
be made on the basis of a ML/TF risk assessment, with consideration of the
challenges associated with regulatory divergence.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  37
PART THREE:
APPLICATION OF FATF STANDARDS TO COUNTRIES AND
COMPETENT AUTHORITIES

Explanation: AU_TRAVEL_RULE (AUSTRAC travel-rule consultation and AML/CTF obligations on DCE providers — AU is implementing FATF travel-rule standards) and INT_FATF_VASP (FATF VASP standards including R16 travel rule). AU is moving to implement FATF VASP guidance via the AML/CTF framework. Aligned direction.


1 This Guidance also updates the 2015 FATF Guidance for a Risk-Based Approach to Virtual
Currencies. UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  5
The Guidance details the full range of obligations applicable to VASPs as well as to VAs
under the FATF Recommendations, following a Recommendation-by-
Recommendation approach. This includes clarifying that all of the funds or value-
based terms in the FATF Recommendations (e.g., "property," "proceeds," "funds,"
"funds or other assets," and other "corresponding value") include VAs. Consequently,
countries should apply all of the relevant measures under the FATF
Recommendations to VAs, VA activities, and VASPs. The Guidance explains the VASP registration or licensing requirements, in particular
how to determine in which country/ies VASPs should be registered or licensed - at a
minimum where they were created; or in the jurisdiction where their business is
located in cases where they are a natural person.

Introducing a risk-based approach to supervision of DNFBPs 87
8.3. Co-ordination and information sharing 90
9. Supervision of VASPs 92
9.1. Identifying the VASP population 92
9.2. Identification of risk in the VASP sector 92
9.3. VASP sector outreach and guidance 94
9.4. Use of technology in VASP supervision 94
9.5. Recruitment and training of VASP supervisors 95
9.6. Multi-jurisdictional operations and supervisory co-operation on VASPs 95
10. Supervision in the COVID-19 context 97
10.1. Risk-based flexibility for reporting entities and clear communication of expectations and
provision of Guidance 97
Glossary 98 4  GUIDANCE ON RISK-BASED SUPERVISION
Acronyms
AML/CFT Anti-money Laundering/Countering the Financing of Terrorism
DNFBF Designated Non-financial Businesses and Professions
FATF Financial Action Taskforce
FI Financial Institution
FIU Financial Intelligence Unit
MI Management Information
ML Money Laundering
MVTS Money Value Transfer Service
RPA Robotic Process Automation
SRA Supervisory Risk Assessments
SRB Self-Regulatory Body
TF Terrorist Financing
TCSP Trust and Company Providers
VASP Virtual Asset Service Providers

A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

Explanation: INT_FATF_VASP (FATF VASP definition for AML/CFT purposes) and AU_ASIC_CRYPTO (ASIC INFO 225 — when crypto activity is a 'financial service' requiring AFSL). Both classify the same crypto-asset activity but for different purposes, and the classifications turn on FACTS about the service that may yield divergent results (FATF VASP yes, AU financial-product no — or vice versa). The downstream obligations differ; resolution requires fact-specific analysis.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Explanation: AU_ASIC_AFSL (Australian Financial Services Licence — KYC, recordkeeping, and client-disclosure obligations on AFS licensees) and EU_GDPR (cross-border data transfer principles under Article 44+). When AU AFS licensees serve EU-resident clients, the AFSL-mandated KYC and recordkeeping generates personal-data flows from EU to AU; GDPR Chapter V cross-border transfer restrictions engage. Operationally resolvable via GDPR Article 6(1)(c) (legal-obligation lawful basis) plus Chapter V mechanisms (SCCs or Art. 49 derogations). Same conflict shape as the labelled EU TFR ↔ EU GDPR conflict, applied to AU AFSL framework.


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 234 information security standard and AU Treasury Digital Asset Platforms framework operate in disjoint regulatory domains at the obligation level. Info-sec standard vs DAP-framework proposal — different statutory frames. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

1. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

2. MiCA sets out a new legal framework applicable to legal persons or other undertakings
intending to provide crypto-asset services, requiring such entities to submit an
application for authorisation containing all the information set out in Article 62(2) of MiCA,
as specified by the RTS on the information for authorisation as a CASP.

3. The next paragraphs present the cost-benefit analysis of the main policy options included
in this final report on the requirements for the application for authorisation as a CASP
under Article 62 of MiCA.
Problem identification

Explanation: The AU_TRAVEL_RULE passages discuss the registration of remittance network providers and virtual asset service providers (DCEs) under Australian law, and note that Australia is consulting on extending the FATF 'Travel Rule' to digital currency transactions (chunk_ids c4a92930a8caf822::380::0a18, cf7cefacba3f94bc::383::7d9d). The EU_MICA_TITLE_V_CASP passages focus on the application for authorisation as a Crypto-Asset Service Provider (CASP) under the Markets in Crypto-Assets Regulation (MiCA), including the information requirements for applications and the establishment of a public register (chunk_ids c51ad46265cea4e5::147::6214, c51ad46265cea4e5::340::9399). The obligations in the EU regime regarding authorisation and registration do not conflict with the Australian regime's focus on remittance sector registration and the potential future implementation of the Travel Rule. The regimes regulate different aspects of the crypto-asset ecosystem (authorisation vs. remittance registration/travel rule consultation) and do not impose mutually exclusive obligations.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Explanation: DAC8 is the EU crypto-asset tax-reporting directive imposing due-diligence and reporting obligations on Reporting Crypto-Asset Service Providers. MiFID II is the investment-firm conduct regime. The two directives operate in disjoint domains — tax reporting vs investment conduct. No obligation in one pushes against any obligation in the other.

A future MiFID amendment classified crypto-assets as financial instruments and DAC8 reporting overlapped with MiFID II transaction reporting — possible but speculative.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

Explanation: The evidence for APRA CPS234 (chunk 4b6fab404e7acfca::3c4::1564) establishes that it is a Prudential Practice Guide regarding Operational Risk Management and Information Security for APRA-regulated entities. The evidence for EU MiCA Title V CASP (chunk c51ad46265cea4e5::147::6214) outlines the requirements for authorisation as a Crypto-Asset Service Provider (CASP) under the Markets in Crypto-Assets Regulation. The two regimes regulate distinct domains: APRA CPS234 governs prudential risk management for traditional financial institutions, while MiCA Title V CASP governs the licensing and conduct of crypto-asset service providers. There is no specific obligation in one regime that conflicts with a specific obligation in the other.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The AU_PRIVACY regime regulates the cross-border disclosure of personal information, requiring entities to take reasonable steps to ensure overseas recipients comply with Australian Privacy Principles (APPs) (chunk_ids e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3). The SG_PSA_DPT regime regulates Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations for Digital Payment Token (DPT) service providers under the Payment Services Act (chunk_ids 4b4c3c417dc293ba::185::f41d, 018117ef1e757630::4b5::9ef5). The obligations are distinct: one focuses on data protection and privacy standards for cross-border data flows, while the other focuses on financial crime prevention and licensing for digital asset services. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other; they regulate different domains of compliance.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Article 29
Language arrangements in direct supervision
1. The Authority and the financial supervisors shall adopt arrangements for their communications within the AML/CFT
supervisory system, including the language(s) to be used.
2. Any document which a selected obliged entity or any other natural or legal person individually subject to the
Authority's supervisory procedures submits to the Authority may be drafted in any of the official languages of the Union,
chosen by the selected obliged entity or natural or legal person concerned.
3. The Authority, the selected obliged entities and any other legal or natural person individually subject to the
Authority's supervisory procedures may agree to exclusively use one of the official languages of the Union in their written
communications, including with regard to the Authority's supervisory decisions.
4. Where an agreement on the exclusive use of one language as referred to in paragraph 3 is subsequently revoked, that
revocation shall only affect the aspects of the Authority's supervisory procedure which have not yet been carried out.
5. Where participants in an oral hearing request to be heard in an official language of the Union other than the language
of the Authority's supervisory procedure, sufficient advance notice of that requirement shall be given to the Authority so
that it can make the necessary arrangements.
SECTION 4
Indirect supervision of non-selected obliged entities

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Member States shall ensure that supervisors have the power to disassociate persons convicted of money laundering,
its relevant predicate offences or terrorist financing, who are beneficial owners of obliged entities as referred to in
paragraphs 1 and 2, from obliged entities, including by granting supervisors the power to request the divestment of the
holding by those beneficial owners in obliged entities.
6. For the purposes of this Article, Member States shall ensure that, in accordance with national law, supervisors or any
other authority competent at national level for assessing the requirements applicable to persons referred to in paragraphs 1
and 2 of this Article, check the central AML/CFT database under Article 11 of Regulation (EU) 2024/1620 and whether
a relevant conviction exists in the criminal record of the person concerned. Any exchange of information for those
purposes shall be carried out in accordance with Framework Decision 2009/315/JHA and Decision 2009/316/JHA as
implemented in national law.
7.

Explanation: AMLA (Reg 2024/1620) and AMLD6 (Dir 2024/1640) are the two supervisory pieces of the EU AML package: AMLA establishes the new EU-level supervisor, AMLD6 sets out the Member-State supervisory architecture and predicate-offence framework. They allocate supervisory responsibility between EU and Member-State levels without overlap or contradiction. Hard negative — both regulations were drafted in tandem to dovetail.

AMLA's direct-supervision powers extended into Member-State conduct that AMLD6 reserves to national authorities — Art 13 of AMLA explicitly carves the perimeter.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: The EU AMLD6 passage (chunk 85307f9e2a040982::14a::134d) discusses the scope of the Directive, specifically mentioning the inclusion of 'digital operational resilience for the financial sector' and referencing other financial directives. The INT_BASEL_CRYPTO passage (chunk 32afd37cade34f84::3a4::1a5b) defines 'bank exposure' for capital requirements, focusing on claims on licensed financial institutions and prudential standards. The obligations in the Basel text regarding capital adequacy and risk weighting do not impose a specific, conflicting obligation on the entity or transaction type that is regulated by the AMLD6 passage. The regimes regulate distinct aspects of financial stability—AML compliance and operational resilience versus capital adequacy—resulting in no direct conflict.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Such a warning may be
provided in a standardised format;
(d) the investment firm complies with its obligations under Article 23.
5. The investment firm shall establish a record that includes the document or documents agreed between the
investment firm and the client that set out the rights and obligations of the parties, and the other terms on which
the investment firm will provide services to the client. The rights and duties of the parties to the contract may be
incorporated by reference to other documents or legal texts.
6. The investment firm shall provide the client with adequate reports on the service provided in a durable medium. Those reports shall include periodic communications to clients, taking into account the type and the complexity of
financial instruments involved and the nature of the service provided to the client and shall include, where applicable, the
costs associated with the transactions and services undertaken on behalf of the client. When providing investment advice, the investment firm shall, before the transaction is made, provide the client with a
statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences,
objectives and other characteristics of the retail client.

Article 24
General principles and information to clients
1. Member States shall require that, when providing investment services or, where appropriate, ancillary services to
clients, an investment firm act honestly, fairly and professionally in accordance with the best interests of its clients and
comply, in particular, with the principles set out in this Article and in Article 25.
2. Investment firms which manufacture financial instruments for sale to clients shall ensure that those financial
instruments are designed to meet the needs of an identified target market of end clients within the relevant category
of clients, the strategy for distribution of the financial instruments is compatible with the identified target market, and the
investment firm takes reasonable steps to ensure that the financial instrument is distributed to the identified target
market. An investment firm shall understand the financial instruments they offer or recommend, assess the compatibility of the
financial instruments with the needs of the clients to whom it provides investment services, also taking account of the
identified target market of end clients as referred to in Article 16(3), and ensure that financial instruments are offered or
recommended only when this is in the interest of the client.
3.

All information, including marketing communications, addressed by the investment firm to clients or potential
clients shall be fair, clear and not misleading. Marketing communications shall be clearly identifiable as such.
4. Appropriate information shall be provided in good time to clients or potential clients with regard to the investment
firm and its services, the financial instruments and proposed investment strategies, execution venues and all costs and
related charges. That information shall include the following:
(a) when investment advice is provided, the investment firm must, in good time before it provides investment advice,
inform the client:
(i) whether or not the advice is provided on an independent basis;
(ii) whether the advice is based on a broad or on a more restricted analysis of different types of financial instruments
and, in particular, whether the range is limited to financial instruments issued or provided by entities having close
links with the investment firm or any other legal or economic relationships, such as contractual relationships, so
close as to pose a risk of impairing the independent basis of the advice provided;
(iii) whether the investment firm will provide the client with a periodic assessment of the suitability of the financial
instruments recommended to that client;

IRAS e-Tax Guide
(Third Edition) Published by
Inland Revenue Authority of Singapore
Published on 30 Jan 2026
First edition on 19 Nov 2019
Second edition on 3 Aug 2022
Disclaimers: IRAS shall not be responsible or held accountable in any way for any damage, loss or expense
whatsoever, arising directly or indirectly from any inaccuracy or incompleteness in the Contents of this e-Tax
Guide, or errors or omissions in the transmission of the Contents. IRAS shall not be responsible or held
accountable in any way for any decision made or action taken by you or any third party in reliance upon the
Contents in this e-Tax Guide. Except where specific contents carry legal force, this information aims to provide
a better general understanding of taxpayers' tax obligations and is not intended to comprehensively address
all possible tax issues that may arise. While every effort has been made to ensure that this information is
consistent with existing law and practice, should there be any changes, IRAS reserves the right to vary its
position accordingly.
© Inland Revenue Authority of Singapore
All rights reserved.

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

12.1 Taxpayers should keep proper records of transactions and provide them to
IRAS upon request. These supporting records should include information
such as:
• Date of transaction
• Number of units of digital tokens received or sold
• Value of digital token at the time of the transaction
• Exchange rate used
• Purpose of the transaction
• Details of customers/suppliers (for buy-sell transactions)
• Details of the ICO
• Receipts/invoices of business expenses

13. Contact Information

13.1 For general enquiries or clarifications on this e-Tax Guide, please call 1800-
356 8622 (Corporate Tax) or 1800-356 8300 (Individual Tax).

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, focusing on product governance, suitability assessments, and client communication standards (e.g., chunk_ids 28dfda0f6a6539b6::620::92ed, 28dfda0f6a6539b6::502::1957). The SG IRAS TAX passages regulate tax obligations, specifically regarding the Goods and Services Tax (GST) treatment of digital payment tokens and record-keeping requirements (e.g., chunk_ids abc2247bc6415d1d::41e::b184, 7c5602f8b898a7ab::277::e4ae). The obligations in MIFID2 relate to the provision of investment services and the suitability of financial instruments, while the obligations in IRAS relate to the tax treatment of digital assets. These are distinct regulatory domains; the conduct requirements of MIFID2 do not impose a tax liability or record-keeping standard that conflicts with the GST treatment outlined in the IRAS passages. Therefore, the regimes are non-conflicting.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The evidence for AU_APRA_CPS230 focuses on operational risk management, business continuity, and service provider management for APRA-regulated entities. The evidence for INT_IOSCO_GENERAL discusses the IOSCO Principles, methodology for disclosure standards, and general regulatory objectives. The obligations in CPS 230 (e.g., maintaining critical operations through disruptions) are specific to prudential supervision and operational resilience, whereas the IOSCO passages address securities regulation, disclosure standards, and cross-border offerings. There is no specific obligation in IOSCO that creates a conflict with the operational risk management requirements of CPS 230. Therefore, the regimes regulate different domains.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

28. Third-country firms should be able to provide records tracking the relationship with the
client and, in particular, whether the client has taken the initiative to receive crypto asset
services with respect to a new product.

5.4 When is a crypto-asset or a crypto-asset service of the same
type as another one (Guideline 4)

29. The reverse solicitation regime leaves open the possibility for a third-country firm to
market crypto-assets or crypto-asset services or activities of the same type in the context
of the relationship started at the own exclusive initiative of a given client, subject to the
third-country firm also complying with Guideline 3 above.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The EU_REVERSE_SOLICITATION regime regulates the authorization and solicitation of crypto-asset services by third-country firms within the EU (chunk_ids 25cbbd878a1b21d3::4f8::561c, 25cbbd878a1b21d3::298::6f7d). In contrast, the INT_BASEL_GENERAL regime addresses banking capital adequacy, specifically the leverage ratio, general provisions, and expected losses (chunk_id 32afd37cade34f84::34b::8d30). The obligations in Regime A relate to marketing and client acquisition for crypto-assets, while Regime B concerns financial reporting and capital calculations for banks. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; the regimes regulate distinct domains of financial activity.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

(10) Directive 2011/16/EU lays down obligations for financial institutions to report financial account information to tax
administrations that are then required to exchange that information with other relevant Member States. However,
most crypto-assets are not obliged to be reported under that Directive because they do not constitute money held in
depository accounts nor in financial assets. In addition, crypto-asset service providers as well as crypto-asset
operators are in most cases not covered by the current definition of financial institution under
Directive 2011/16/EU.

(11) In order to address new challenges arising from the growing use of alternative means of payment and investment,
which pose new risks of tax evasion and are not yet covered by Directive 2011/16/EU, the rules on the reporting
and exchange of information should cover crypto-assets and their users.

Explanation: The regimes regulate distinct domains. APRA CPS234 (and CPG 234) focuses on prudential operational risk management and information security for APRA-regulated entities. In contrast, EU DAC8 is a tax directive governing the automatic exchange of information regarding crypto-asset users. The evidence confirms that DAC8 addresses tax reporting obligations for crypto-asset service providers, which is a separate regulatory objective from the prudential risk management obligations outlined in APRA's guidance. Therefore, there is no overlap of obligations between the two regimes.


141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

Explanation: The Basel III framework (Regime A) regulates banking capital adequacy, leverage ratios, and credit risk provisions (e.g., fiduciary assets, general provisions) [32afd37cade34f84::34b::8d30, 32afd37cade34f84::34e::4d5c]. The Singapore Personal Data Protection Act (PDPA) (Regime B) governs the collection, use, and disclosure of personal data, including requirements for consent and notification [0e996ae99839f19e::37b::85a8, 0e996ae99839f19e::61d::14e5]. The obligations in Regime A relate to financial risk management and accounting, while the obligations in Regime B relate to data privacy and consumer protection. There is no specific obligation in the Basel framework that conflicts with the specific obligations in the PDPA; they regulate distinct domains of banking operations.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): ASIC's crypto-asset INFO 225 / RG 282 guidance and Australian Privacy Act + APPs operate in disjoint regulatory domains at the obligation level. ASIC crypto guidance vs Privacy Act — different subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The evidence from Regime A (AU_CORPS_ACT) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and secretarial responsibilities (chunk 0fc4f857c226f510::375::66b5). The evidence from Regime B (SG_FOUNDATIONAL_LEGISLATION) discusses MAS enforcement actions against ICO issuers and exchanges, and the intention to expand legislation to align with international AML/CFT requirements (chunk b49627bb889ef1d9::3ef::7168). The obligations in Regime A relate to corporate governance and internal company operations, while the obligations in Regime B relate to financial services regulation and enforcement against digital token offerings. These are distinct regulatory domains with no apparent overlap of obligations.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

(83) Essential and important entities should ensure the security of the network and information systems which they use
in their activities. Those systems are primarily private network and information systems managed by the essential
and important entities' internal IT staff or the security of which has been outsourced. The cybersecurity risk-
management measures and reporting obligations laid down in this Directive should apply to the relevant essential
and important entities regardless of whether those entities maintain their network and information systems
internally or outsource the maintenance thereof.

(24) Where provisions of a sector-specific Union legal act require essential or important entities to comply with reporting
obligations that are at least equivalent in effect to the reporting obligations laid down in this Directive, the
consistency and effectiveness of the handling of incident notifications should be ensured. To that end, the
provisions relating to incident notifications of the sector-specific Union legal act should provide the CSIRTs, the
competent authorities or the single points of contact on cybersecurity (single points of contact) under this Directive
with an immediate access to the incident notifications submitted in accordance with the sector-specific Union legal
act. In particular, such immediate access can be ensured if incident notifications are being forwarded without undue
delay to the CSIRT, the competent authority or the single point of contact under this Directive. Where appropriate,
Member States should put in place an automatic and direct reporting mechanism that ensures systematic and
immediate sharing of information with the CSIRTs, the competent authorities or the single points of contact
concerning the handling of such incident notifications. For the purpose of simplifying reporting and of
implementing the automatic and direct reporting mechanism, Member States could, in accordance with the sector-
specific Union legal act, use a single entry point.

Explanation: AMLR/TFR is the EU AML/CFT instrument set imposing customer due diligence and travel-rule transmission. NIS2 is the horizontal cybersecurity directive for essential and important entities. The two directives operate in disjoint domains, and NIS2 Recital 24 contains an explicit lex specialis clause for sector-specific Union legal acts with equivalent reporting obligations — DORA fills that role for EU financial entities. No AMLR/TFR obligation pushes against any NIS2 obligation.

NIS2 incident-notification timing forced disclosure of an AML SMR that AMLR confidentiality (tipping-off prohibition) rules forbade — designed to be cumulative with separate channels.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: The AU_CORPS Act passage (chunk 0fc4f857c226f510::375::66b5) outlines the interaction between the Act and the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company duties and director responsibilities. The EU_AMLA passage (chunk df546f2364aaf9e2::25a::6ab3) establishes the legal framework for anti-money laundering and countering the financing of terrorism (AML/CFT) obligations and the institutional framework for the Authority for anti-money laundering and countering the financing of terrorism (AMLA). The obligations described in the AU passage relate to corporate governance and director duties, while the obligations in the EU passage relate to AML/CFT compliance and supervisory cooperation. These are distinct regulatory domains with no apparent overlap of obligations.


(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

Article 3
Definitions
For the purposes of this Regulation, the following definitions shall apply:
(1) 'digital operational resilience' means the ability of a financial entity to build, assure and review its operational integrity
and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service
providers, the full range of ICT-related capabilities needed to address the security of the network and information
systems which a financial entity uses, and which support the continued provision of financial services and their
quality, including throughout disruptions;
(2) 'network and information system' means a network and information system as defined in Article 6, point 1, of
Directive (EU) 2022/2555;
(3) 'legacy ICT system' means an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for
upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT
third-party service provider, but that is still in use and supports the functions of the financial entity;
(4) 'security of network and information systems' means security of network and information systems as defined in

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The obligations in EU_DORA focus on the security of network and information systems, digital operational resilience, and ICT risk management for financial entities (chunk_ids 85307f9e2a040982::4c8::ae53, 85307f9e2a040982::3d7::f935). In contrast, the obligations in SG_PSA_DPT relate to the licensing of Digital Payment Token (DPT) service providers and their Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) controls (chunk_ids 4b4c3c417dc293ba::185::f41d, 018117ef1e757630::4b5::9ef5). The regimes regulate distinct aspects of the financial ecosystem—operational resilience and ICT security versus licensing and AML/CFT compliance for DPT services—and do not impose conflicting obligations on the same specific activity.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

Explanation: The AU_FEDREG_AML passages describe obligations for reporting entities under the AML/CTF Act, including customer identification, suspicious transaction reporting, and program requirements (chunk cf7cefacba3f94bc::49a::f39e). The EU_MICA passages describe a legal framework for crypto-asset services, including the provision of advice on crypto-assets and the authorisation of crypto-asset service providers (chunk f9082873c5d9ba9d::302::bbe0). The obligations in the AML regime relate to financial crime prevention and customer due diligence, while the MiCA regime relates to the licensing and conduct of crypto-asset service providers. The passages do not describe conflicting obligations or overlapping scopes; they regulate distinct domains of financial activity.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure restrictions) and INT_FATF_VASP (FATF VASP guidance — AML/CFT standards requiring customer identification and cross-border information sharing). FATF VASP implementations require sharing personal data of senders/recipients; APP 8 restricts overseas disclosure. Operationally resolvable via APP 6.2(b) (required by law) when AU implements FATF via AML/CTF for VASP-equivalent entities. Same cross-jurisdictional AML-privacy shape.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Explanation: The evidence from APRA CPS 230 focuses on operational resilience, business continuity, and the management of service providers to ensure an entity can meet its prudential obligations during disruptions (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). In contrast, the SG IRAS Tax evidence addresses the Goods and Services Tax (GST) treatment of digital payment tokens, specifically that such tokens are exempt supplies and businesses trading in them are no longer liable for GST registration (chunk_ids abc2247bc6415d1d::41e::b184, abc2247bc6415d1d::5c7::68f5). The obligations in the Australian prudential standard regarding operational risk management do not impose conflicting requirements on the GST treatment or registration status of digital payment tokens under Singaporean tax law. The regimes regulate distinct domains: prudential resilience and tax compliance.