The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

(66)
Issuers of e-money tokens should be authorised either as a credit institution under Directive 2013/36/EU or as an
electronic money institution under Directive 2009/110/EC. E-money tokens should be deemed to be 'electronic
money' as that term is defined in Directive 2009/110/EC and their issuers should, unless specified otherwise in
this Regulation, comply with the relevant requirements set out in Directive 2009/110/EC for the taking up,
pursuit and prudential supervision of the business of electronic money institutions and the requirements on
issuance and redeemability of e-money tokens. Issuers of e-money tokens should draw up a crypto-asset white
paper and notify it to their competent authority. Exemptions regarding limited networks, regarding certain
transactions by providers of electronic communications networks and regarding electronic money institutions
issuing only a limited maximum amount of electronic money, based on the optional exemptions specified in
Directive 2009/110/EC, should also apply to e-money tokens. However, issuers of e-money tokens should still be
required to draw up a crypto-asset white paper in order to inform buyers about the characteristics and risks of
the e-money tokens and should also be required to notify the crypto-asset white paper to the competent authority
before its publication.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU MiCA Title IV e-money-token issuer regime are designed to coexist — obligations apply cumulatively without collision. AMLA supervises EMT-issuer CASPs as AMLR-obliged entities — aligned. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The FATF passages (chunk_id fe52dd87e13dba41::261::59a4) provide general international guidance on anti-money laundering (AML) and counter-terrorist financing (CTF) principles, noting that financial inclusion and AML/CFT serve complementary objectives. The Singapore PSA DPT passages (chunk_id 4b4c3c417dc293ba::185::f41d) detail the specific legal framework for digital payment token service providers under the Payment Services Act 2019. While both regimes address AML/CFT obligations, the Singapore regime is a specific jurisdictional implementation of the general FATF principles. The passages do not describe a specific obligation in one regime that pushes against a specific obligation in the other; rather, they describe the same topic (AML/CFT) from different perspectives (general international standard vs. specific national regulation).


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

2020Ed. Act 2012 20
(2) An organisation must not -
(a) as a condition of providing a product or service, require an
individual to consent to the collection, use or disclosure of
personal data about the individual beyond what is
reasonable to provide the product or service to that
individual; or
(b) obtain or attempt to obtain consent for collecting, using or
disclosing personal data by providing false or misleading
informationwithrespecttothecollection,useordisclosure
of the personal data, or using deceptive or misleading
practices. (3) Anyconsentgiveninanyofthecircumstancesinsubsection(2)
is not validly given for the purposes of this Act. (4) InthisAct,referencestoconsentgiven,ordeemedtohavebeen
given, by an individual for the collection, use or disclosure of
personal data about the individual include consent given, or deemed
to have been given, by any person validly acting on that individual's
behalf for the collection, use or disclosure of such personal data.

Explanation: EU_MIFID2 (investment-firm KYC, client suitability assessment, client categorisation, transaction reporting under MiFID II/MiFIR) and SG_PDPA (Singapore PDPA). EU investment firms providing services to SG-resident clients must collect detailed personal/financial data and may transmit suitability assessments and transaction reports cross-border. PDPA restricts the SG-side collection/disclosure. Operationally resolvable via PDPA s.13(b) 'required or authorised by law' plus PDPA's third-party-disclosure framework. Same shape as the labelled EU TFR ↔ EU GDPR conflict, applied to investment-services KYC.


Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Article 18(2) and in so far as this Directive provides for
more of the activities listed in Article 6(1)(e) and it is
harmonisation, Member States shall not maintain or introduce
unknown in advance what proportion of funds is to be
provisions other than those laid down in this Directive.
used as electronic money, all funds requested by the elec
tronic money holder shall be redeemed.
2. Member States shall ensure that an electronic money
7. Notwithstanding paragraphs 4, 5 and 6, redemption rights issuer does not derogate, to the detriment of an electronic
of a person, other than a consumer, who accepts electronic money holder, from the provisions of national law imple
money shall be subject to the contractual agreement between menting or corresponding to provisions of this Directive
the electronic money issuer and that person. except where explicitly provided for therein.

Article 12

Article 49
Issuance and redeemability of e-money tokens
1.
By way of derogation from Article 11 of Directive 2009/110/EC, in respect of the issuance and redeemability of e-
money tokens only the requirements set out in this Article shall apply to issuers of e-money tokens.
2.
Holders of e-money tokens shall have a claim against the issuers of those e-money tokens.
3.
Issuers of e-money tokens shall issue e-money tokens at par value and on the receipt of funds.
EN
L 150/107

4.
Upon request by a holder of an e-money token, the issuer of that e-money token shall redeem it, at any time and
at par value, by paying in funds, other than electronic money, the monetary value of the e-money token held to the
holder of the e-money token.
5.
Issuers of e-money tokens shall prominently state the conditions for redemption in the crypto-asset white paper as
referred to in Article 51(1), first subparagraph, point (d).
6.
Without prejudice to Article 46, the redemption of e-money tokens shall not be subject to a fee.

Explanation: MiCA Title IV explicitly builds on EMD2: MiCA Recital 66 stipulates that EMT issuers must be authorised as a credit institution or as an EMI under Directive 2009/110/EC (EMD2). MiCA Article 49 derogates from EMD2 Article 11 only in respect of EMT issuance and redeemability, and does so deliberately to carry the issuance-and-redemption-at-par principle into the crypto context. The two regimes are aligned by design — MiCA Title IV is the crypto-specific overlay on the underlying EMD2 authorisation. No EMD2 obligation pushes against any MiCA Title IV obligation; the seed pair note flagged this as expected structural_unresolved but the rubric walk resolves it as a negative (aligned, not conflicting).

EBA-level RTS under MiCA imposed an EMT-specific own-funds floor inconsistent with EMD2 Article 5 — Level-2 work has not produced such a collision.


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: INT_FATF_VASP (FATF VASP guidance — international AML/CFT standards) and SG_MAS_AML_GENERAL (MAS's AML/CFT supervisory framework for DPT providers). FATF establishes the minimum; SG implements via MAS notices. Reinforcing relationship — same regulatory concern, different layers of the hierarchy.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). In contrast, the MAS TRM regime addresses operational risk management, internal processes, and the application of principles-based guidelines to licensees (chunk_ids 20d526d712753652::403::be97, 20d526d712753652::401::f956). The obligations in DAC8 relate to reporting to tax authorities, while the obligations in MAS TRM relate to internal governance and risk assessment. These are distinct regulatory domains with no apparent overlap or conflict.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The regimes regulate distinct aspects of the financial system. Regime A (AU_TRAVEL_RULE) focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations for remittance and virtual asset service providers, specifically regarding customer identification and reporting (c4a92930a8caf822::380::0a18, c4a92930a8caf822::57d::3f76). Regime B (INT_BASEL_CRYPTO) focuses on prudential capital requirements and risk-weighting for banks' exposures to financial institutions (32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they apply in different domains (AML/CTF vs. Capital Adequacy).


Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

RG 1.187 AFS licensees have obligations under s912A requiring them to:
(a) operate their business efficiently, honestly and fairly;
(b) maintain the organisational competence to provide the financial services
covered by their licence;
(c) ensure their representatives are competent and adequately trained to
provide the financial services;
(d) have adequate financial, technological and human resources to provide
the financial services;
(e) have risk management systems;
(f) have arrangements in place for managing conflicts of interest;
(g) comply with the financial services laws and ensure their representatives
comply with those laws;
(h) comply with the conditions on their licence; and
(i) if they are the operator of an Australian passport fund or a person with
responsibilities in relation to an Australian passport fund-comply with
the law of each host economy for the fund.
Note 1: If you are an eligible body under ASIC Corporations (Foreign Financial Services
Providers-Foreign AFS Licensees) Instrument 2020/198 you may be exempt from some
of these obligations.
Note 2: If you are providing financial services to retail clients, you will have additional
dispute resolution and compensation obligations. Please see s912B for more information.
© Australian Securities and Investments Commission June 2025 Page 38

RG 1.193 If we grant you an AFS licence, your licensee obligations include your
statutory obligations including those in s912A, the licence conditions imposed
under the Corporations Regulations including reg 7.6.04, and the licence
conditions imposed by ASIC in PF 209, as well as any tailored licence
conditions that apply specifically to you.
© Australian Securities and Investments Commission June 2025 Page 39

Efficiently, honestly and fairly

RG 1.194 Section 912A(1)(a) requires that a financial services licensee do all things
necessary to ensure that the financial services covered by the licence are
provided efficiently, honestly and fairly.

Explanation: EU_MICA (EU's broad crypto-asset regulation) and AU_ASIC_AFSL (AU AFSL framework, extended to crypto-as-financial-product per ASIC INFO 225). Whether AU AFSL applies to a given crypto activity turns on FACTS about the underlying crypto-asset's characteristics (whether it is a financial product). The combined regulatory burden on an entity operating in both jurisdictions depends on that fact-sensitive determination.


Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Article 59
Authorisation
1.
A person shall not provide crypto-asset services, within the Union, unless that person is:
(a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Explanation: MiCA Title VI explicitly imports a MAR-style market-abuse regime for crypto-assets admitted to trading on EU venues. The two regimes are designed to coexist with MiCA providing the crypto-specific market-abuse rules and MAR remaining the lex generalis for financial-instrument market abuse. Hard negative.

A crypto-asset that is also a financial instrument under MiFID II — that's a classification question handled by ESMA Guidelines on Qualification of CAs as FIs.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

Explanation: The evidence for Regime A (AU_FEDREG_AML) focuses on Anti-Money Laundering (AML) obligations, customer identification, and reporting requirements for reporting entities. The evidence for Regime B (EU_EMD2) concerns Digital Operational Resilience for the financial sector (DORA) and financial rules for the Authority. The passages describe distinct regulatory domains (AML compliance vs. operational resilience and financial administration) with no overlapping obligations or conflicting requirements. Therefore, the regimes do not conflict.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

25. The reverse solicitation exemption is based on the premise that the crypto-asset product,
service or activity is provided at the client's own exclusive initiative. Article 61(2) of MiCA
leaves open the possibility for the third-country firm to market to that client crypto-assets
or crypto-asset services or activities of the same type. However, the requirement that the
crypto-asset services be provided on the basis of the own exclusive initiative of the client
still applies.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and ESMA's reverse-solicitation Guidelines under MiCA operate in disjoint regulatory domains at the obligation level. AML supervisory directive vs MiCA reverse-solicitation guidelines — different subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Such a warning may be
provided in a standardised format;
(d) the investment firm complies with its obligations under Article 23.
5. The investment firm shall establish a record that includes the document or documents agreed between the
investment firm and the client that set out the rights and obligations of the parties, and the other terms on which
the investment firm will provide services to the client. The rights and duties of the parties to the contract may be
incorporated by reference to other documents or legal texts.
6. The investment firm shall provide the client with adequate reports on the service provided in a durable medium. Those reports shall include periodic communications to clients, taking into account the type and the complexity of
financial instruments involved and the nature of the service provided to the client and shall include, where applicable, the
costs associated with the transactions and services undertaken on behalf of the client. When providing investment advice, the investment firm shall, before the transaction is made, provide the client with a
statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences,
objectives and other characteristics of the retail client.

Article 24
General principles and information to clients
1. Member States shall require that, when providing investment services or, where appropriate, ancillary services to
clients, an investment firm act honestly, fairly and professionally in accordance with the best interests of its clients and
comply, in particular, with the principles set out in this Article and in Article 25.
2. Investment firms which manufacture financial instruments for sale to clients shall ensure that those financial
instruments are designed to meet the needs of an identified target market of end clients within the relevant category
of clients, the strategy for distribution of the financial instruments is compatible with the identified target market, and the
investment firm takes reasonable steps to ensure that the financial instrument is distributed to the identified target
market. An investment firm shall understand the financial instruments they offer or recommend, assess the compatibility of the
financial instruments with the needs of the clients to whom it provides investment services, also taking account of the
identified target market of end clients as referred to in Article 16(3), and ensure that financial instruments are offered or
recommended only when this is in the interest of the client.
3.

All information, including marketing communications, addressed by the investment firm to clients or potential
clients shall be fair, clear and not misleading. Marketing communications shall be clearly identifiable as such.
4. Appropriate information shall be provided in good time to clients or potential clients with regard to the investment
firm and its services, the financial instruments and proposed investment strategies, execution venues and all costs and
related charges. That information shall include the following:
(a) when investment advice is provided, the investment firm must, in good time before it provides investment advice,
inform the client:
(i) whether or not the advice is provided on an independent basis;
(ii) whether the advice is based on a broad or on a more restricted analysis of different types of financial instruments
and, in particular, whether the range is limited to financial instruments issued or provided by entities having close
links with the investment firm or any other legal or economic relationships, such as contractual relationships, so
close as to pose a risk of impairing the independent basis of the advice provided;
(iii) whether the investment firm will provide the client with a periodic assessment of the suitability of the financial
instruments recommended to that client;

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

4. This guidance is based on the same general principles that govern both the interpretation and
assessment of the FATF standards. As noted in the introduction to the 2012 FATF
"Countries have diverse legal, administrative and operational frameworks and different
Recommendations:
financial systems, and so cannot all take identical measures to counter these threats. The FATF
Recommendations, therefore, set an international standard, which countries should implement
through measures adapted to their particular circumstances."
how

Box 3.1. Potential Use of Financial Intelligence to Assess Cross-border TF
Risks
Cross-border transaction or movement reports (CTRs) - The FATF
Standards require that all countries implement a declaration or disclosure
system for incoming and outgoing cross-border transportation of currency
and bearer negotiable instruments (CBNIs) with a maximum threshold of
USD/EUR 15 000 (FATF Recommendation 32.) While the low volume of
funds often used by terrorists presents challenges for detection in a
threshold-based system, countries to date have found that information on
40 Notably, chapter 2 above also contains guidance and information sources relevant when assessing
cross-border TF risks. 34 │ TERRORIST FINANCING RISK ASSESSMENT GUIDANCE
the general inflows/outflows of CBNI may still provide useful information
on the potential TF vulnerabilities posed by different borders. Suspicious Transaction Reports (STRs) - The FATF Standards require
that all financial institutions and DNFBPs should be required to notify the
FIU if they suspect or have reasonable grounds to suspect that funds are the
proceeds of a criminal activity, or are related to TF (FATF Recommendation
20).

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1, Article 24, Article 25). The INT_FATF_GENERAL passages provide high-level guidance on assessing money laundering and terrorist financing (ML/TF) risks and the general principles of the FATF Recommendations. The obligations in MIFID2 relate to the suitability and quality of financial advice for clients, while the FATF passages relate to national risk assessments and reporting suspicious transactions. There is no specific obligation in MIFID2 that conflicts with a specific obligation in the FATF guidance; rather, they regulate distinct domains of financial regulation. Therefore, the regimes are non-conflicting.


Article 57
Voluntary classification of e-money tokens as significant e-money tokens
1.
An issuer of an e-money token, authorised as a credit institution or as an electronic money institution, or applying
for such authorisation, may indicate that it wishes for its e-money token to be classified as a significant e-money token.
In that case, the competent authority shall immediately notify such request of the issuer to EBA, to the ECB and, in the
cases referred to in Article 56(3), second subparagraph, to the central bank of the Member State concerned.
In order for the e-money token to be classified as significant under this Article, the issuer of the e-money token shall
demonstrate, through a detailed programme of operations, that it is likely to meet at least three of the criteria set out in

(66)
Issuers of e-money tokens should be authorised either as a credit institution under Directive 2013/36/EU or as an
electronic money institution under Directive 2009/110/EC. E-money tokens should be deemed to be 'electronic
money' as that term is defined in Directive 2009/110/EC and their issuers should, unless specified otherwise in
this Regulation, comply with the relevant requirements set out in Directive 2009/110/EC for the taking up,
pursuit and prudential supervision of the business of electronic money institutions and the requirements on
issuance and redeemability of e-money tokens. Issuers of e-money tokens should draw up a crypto-asset white
paper and notify it to their competent authority. Exemptions regarding limited networks, regarding certain
transactions by providers of electronic communications networks and regarding electronic money institutions
issuing only a limited maximum amount of electronic money, based on the optional exemptions specified in
Directive 2009/110/EC, should also apply to e-money tokens. However, issuers of e-money tokens should still be
required to draw up a crypto-asset white paper in order to inform buyers about the characteristics and risks of
the e-money tokens and should also be required to notify the crypto-asset white paper to the competent authority
before its publication.

EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

Article 16
Detection of missing information on the originator or the beneficiary
1.
The crypto-asset service provider of the beneficiary shall implement effective procedures, including, where appro
priate, monitoring after or during the transfers, in order to detect whether the information referred to in Article 14(1)
and (2) on the originator and the beneficiary is included in, or follows, the transfer or batch file transfer of crypto-assets.
2.
In the case of a transfer of crypto-assets made from a self-hosted address, the crypto-asset service provider of the
beneficiary shall obtain and hold the information referred to in Article 14(1) and (2) and shall ensure that the transfer of
crypto-assets can be individually identified.
Without prejudice to specific risk mitigating measures taken in accordance with Article 19b of Directive (EU) 2015/849,
in the case of a transfer of an amount exceeding EUR 1 000 from a self-hosted address, the crypto-asset service provider
of the beneficiary shall take adequate measures to assess whether that address is owned or controlled by the beneficiary.
3.
Before making the crypto-assets available to the beneficiary, the crypto-asset service provider of the beneficiary
shall verify the accuracy of the information on the beneficiary referred to in Article 14(2) on the basis of documents,
data or information obtained from a reliable and independent source.
4.
Verification as referred to in paragraphs 2 and 3 of this Article shall be deemed to have taken place where one of
the following applies:
(a) the identity of the beneficiary has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the
information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b) Article 14(5) of Directive (EU) 2015/849 applies to the beneficiary.

Explanation: An EMT issuer authorised under MiCA Title IV (and therefore operating as a credit institution or electronic money institution under EMD2 / CRD IV) becomes simultaneously subject to the TFR travel-rule regime when it provides crypto-asset transfer services or when EMT transfers occur through CASPs. MiCA Title IV imposes white-paper, reserve and redemption-at-par obligations; the TFR overlays an originator / beneficiary information, retention and detection duty on top. The tension is operational rather than structural: both regimes apply, neither blocks the other, but the EMT issuer must layer in TFR-grade KYC and transmission infrastructure on top of its MiCA Title IV compliance stack — at meaningful cost. This is operationally resolvable through a single integrated CDD + transmission design.

Build a unified CDD + transmission layer that satisfies both MiCA Art. 49 redemption-at-par customer-identification needs and TFR Art. 14 transmission fields.

Use TFR Art. 16 risk-based procedures for detection of missing information at the EMT-distribution boundary.

EMT issuer also acts as CASP for distribution; if distribution is exclusively through external CASPs, the TFR duty sits primarily on those CASPs.


27.12.2022 EN Official Journal of the European Union L 333/33
(d) ensure that data is protected from risks arising from data management, including poor administration, processing-
related risks and human error.
4. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall:
(a) develop and document an information security policy defining rules to protect the availability, authenticity, integrity
and confidentiality of data, information assets and ICT assets, including those of their customers, where applicable;
(b) following a risk-based approach, establish a sound network and infrastructure management structure using appropriate
techniques, methods and protocols that may include implementing automated mechanisms to isolate affected
information assets in the event of cyber-attacks;
(c) implement policies that limit the physical or logical access to information assets and ICT assets to what is required for
legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and
controls that address access rights and ensure a sound administration thereof;
(d) implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated
control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of
approved data classification and ICT risk assessment processes;
(e) implement documented policies, procedures and controls for ICT change management, including changes to software,
hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are
an integral part of the financial entity's overall change management process, in order to ensure that all changes to ICT
systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner;
(f) have appropriate and comprehensive documented policies for patches and updates.

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

In order to be able to demonstrate compliance with this Regulation, the controller should
adopt internal policies and implement measures which meet in particular the principles of data protection by
design and data protection by default. Such measures could consist, inter alia, of minimising the processing of
personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and
processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to
create and improve security features. When developing, designing, selecting and using applications, services and
products that are based on the processing of personal data or process personal data to fulfil their task, producers
of the products, services and applications should be encouraged to take into account the right to data protection
when developing and designing such products, services and applications and, with due regard to the state of the
art, to make sure that controllers and processors are able to fulfil their data protection obligations. The principles
of data protection by design and by default should also be taken into consideration in the context of public
tenders.

Explanation: DORA's information-security policy obligation (Art. 9) expressly requires the protection of the availability, authenticity, integrity and confidentiality of data and explicitly references data-protection considerations. GDPR Article 25 imposes data protection by design and by default. The two regimes reinforce rather than oppose: DORA tells regulated firms to invest in ICT security capabilities; GDPR Art. 25 tells them to make those capabilities serve data-protection ends. Where breach reporting is concerned (DORA Art. 17–18 ICT incident reporting vs GDPR Art. 33 breach notification), the obligations are cumulative — the same incident may trigger both reporting channels, which is a coordination cost but not a conflict.

DORA mandated retention of full ICT logs beyond a period GDPR allows for personal-data minimisation; current text avoids this by limiting log retention to what is necessary for the ICT-risk purpose.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The evidence from the Australian Corporations Act (Regime A) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up (chunk 0fc4f857c226f510::375::66b5). The evidence from the International Organization of Securities Commissions (Regime B) outlines the IOSCO Principles and their role as key standards for securities regulation, emphasizing cooperation and the establishment of standards for financial systems (chunk f173909614befd49::455::1a1a). The obligations in Regime A relate to corporate governance and statutory compliance for bodies corporate, while Regime B provides international methodological guidance and principles for securities regulation. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they operate in different domains (corporate governance vs. international securities standards).


57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: EU_MICA_RTS (EU MiCA regulatory technical standards) and EU_MICA_TITLE_V_CASP (EU MiCA Title V CASP authorisation). Both are parts of the same MiCA framework — Title V establishes the CASP authorisation regime; the RTS provide detailed technical specifications. Aligned by design.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The evidence from the Australian regime (AU_ATO_CRYPTO) focuses on token mapping, tax compliance, and general crypto adoption statistics (chunk_id e6bb47e92e88e16c::567::36c4). The evidence from the Singaporean regime (SG_PSA_DPT) outlines the licensing requirements and AML/CFT obligations for Digital Payment Token (DPT) service providers under the Payment Services Act (chunk_id 4b4c3c417dc293ba::185::f41d). While both regimes regulate the crypto sector, the specific obligations cited—tax reporting and AML/CFT licensing—are distinct domains. There is no evidence of a specific obligation in one regime directly conflicting with a specific obligation in the other. Therefore, the regimes are non-conflicting.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The Australian regime (AU_ASIC_AFSL) regulates the licensing and conduct of financial services providers, specifically digital asset facilities and intermediaries, focusing on financial product definitions, AFSL requirements, and financial resources. The Singaporean regime (SG_MAS_AML_GENERAL) focuses on Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations, specifically regarding targeted financial sanctions, the role of the compliance function, and the supervision of Digital Payment Token (DPT) providers. The obligations in Regime A (licensing and financial requirements) do not directly oppose or conflict with the obligations in Regime B (AML/CFT compliance and sanctions), but rather apply to different aspects of the same entity's operations. The Singaporean text explicitly mentions that entities operating under a transitional exemption are not licensed under the Payment Services Act but are allowed to continue providing services, indicating a regulatory pathway that accommodates the licensing requirements of other regimes like AFSL.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The EU_MAR regime regulates market integrity, specifically insider dealing and market manipulation (chunks 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The INT_BASEL_CRYPTO regime regulates capital adequacy and prudential standards for banks (chunks 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The obligations in MAR relate to the conduct of trading and reporting suspicious activity, while the obligations in Basel relate to the calculation of capital requirements and risk weighting of exposures. These are distinct regulatory domains; compliance with one does not impede compliance with the other.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users with non-Union jurisdictions (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). In contrast, the SG_MAS_AML_GENERAL regime addresses Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) obligations, licensing, and supervision of Digital Payment Token (DPT) service providers and financial institutions (chunk_ids 20d526d712753652::3ee::1555, b49627bb889ef1d9::1b6::0802). The obligations in DAC8 are administrative and tax-focused, while the obligations in MAS are regulatory and compliance-focused. There is no specific obligation in one regime that pushes against a specific obligation in the other; rather, they operate in different domains (tax vs. AML/CFT supervision).


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

(ii) all versions of the crypto-asset white paper referred to in Article 48(7) of Regulation
(EU) 2023/1114;
(iii) all versions of the marketing communications referred to in Article 53 of Regulation (EU)
2023/1114;
(iv) information about the organisational structure, operational conditions and compliance
with the requirements set out in Title IV of Regulation (EU) 2023/1114 of the issuer of
the e-money token and information provided as part of the authorisation process as
credit institution pursuant to Directive 2013/36/EU of the European Parliament and of
the Council13 or as electronic money institution pursuant to Directive 2009/110/EC of the
European Parliament and of the Council 14 and as updated in the framework of
supervision, including but not limited to:
(1) its compliance with the requirements on the investment of funds set out in Article
54 of Regulation

Explanation: The evidence from APRA (Regime A) focuses on the prudential supervision of financial institutions, specifically the licensing and supervision of entities like ADIs and RSE licensees, and the issuance of legally binding prudential standards and reporting requirements (chunk_id 66d049e24f0863da::3f7::aec8). The evidence from MICA Title IV EMT (Regime B) focuses on the disclosure and authorisation requirements for issuers of e-money tokens and asset-referenced tokens, including the content of crypto-asset white papers and notification to competent authorities (chunk_id 363e42358ddfaad9::36d::b55c). The obligations in Regime A relate to the financial stability and capital adequacy of regulated financial institutions, while the obligations in Regime B relate to the transparency and consumer protection of crypto-asset issuers. These are distinct regulatory domains with no apparent overlap of obligations.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The evidence from the Australian Corporations Act passage (chunk 0fc4f857c226f510::375::66b5) outlines general corporate governance duties, such as the duties of directors and secretaries, and interaction with the ACNC Act. The evidence from the Singapore AML passage (chunk 3d521e61e49aaf46::38f::e615) outlines specific training obligations for direct life insurers regarding AML/CFT laws and suspicious transaction reporting. The obligations in the Singapore AML regime are specific to the prevention of money laundering and do not impose conflicting requirements on the general corporate governance duties detailed in the Australian Corporations Act. Therefore, the regimes regulate different domains and do not conflict.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Explanation: AMLR/TFR addresses AML/CFT — customer due diligence, information accompanying transfers, retention. MiFID II addresses investment-firm authorisation and conduct — best execution, suitability, appropriateness, organisational requirements for trading venues. The two regimes apply to overlapping populations (an EU investment firm is both a MiFID-authorised firm and an obliged entity under AMLR), but the subject matters are disjoint at the obligation level. No AMLR/TFR obligation pushes against any MiFID II obligation. Hard negative — easy to mistake for a conflict because the regulated population overlaps.

MiFID II suitability rules required disclosure to clients that AMLR confidentiality (tipping-off) rules prohibited — these regimes carve out the SMR / SAR confidentiality requirement separately.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: The EU_PSD2 passages focus on technical security standards for payment transactions, specifically strong customer authentication (SCA) and the protection of personalised security credentials (chunk_ids: adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The INT_FATF_GENERAL passages focus on general principles for assessing money laundering and terrorist financing (ML/TF) risks and the implementation of AML/CFT standards (chunk_ids: fe52dd87e13dba41::261::59a4, 08b3db1cc7362f25::3bb::5dba). The obligations in PSD2 regarding authentication and security are complementary to, rather than in conflict with, the broader AML/CFT risk assessment and supervisory guidance provided by FATF. There is no specific obligation in PSD2 that pushes against a specific obligation in FATF.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: The AU_TRAVEL_RULE passages discuss Australia's current status regarding the FATF 'Travel Rule' for digital currency exchanges, noting that it has not yet been implemented and that the regulatory framework currently only applies to exchanges between digital currency and fiat currency. In contrast, the EU_AMLA passages describe the overarching legal framework for AML/CFT obligations in the EU and the establishment of the AMLA authority. The regimes regulate different jurisdictions and the specific implementation status of the Travel Rule, with no evidence of a direct obligation in EU_AMLA that conflicts with the current or proposed obligations in AU_TRAVEL_RULE.