Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The Australian Treasury DAP passages describe a domestic reform agenda focused on 'token mapping' to identify how crypto assets fit into the existing financial services framework and the subsequent development of a licensing framework (chunk_ids: d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). In contrast, the Singapore Foundational Legislation passages discuss MAS's enforcement actions against specific ICO issuers and exchanges, and its intention to expand the scope of legislation to align with international AML/CFT requirements (chunk_ids: b49627bb889ef1d9::3ef::7168, 7c04f2a0bd85290a::413::fc6a). The regimes regulate different aspects of the crypto ecosystem—Australia focuses on the perimeter and licensing framework, while Singapore focuses on enforcement and AML/CFT alignment—and there is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

Explanation: AU_TREASURY_DAP (Australia's proposed Digital Asset Platforms regime — Treasury consultation) and EU_MICA (EU framework for crypto-asset services). Both regulate crypto-asset service provision in their respective jurisdictions, with materially different mechanisms — AU's proposed DAP framework vs EU's CASP authorisation under MiCA. Distinct perimeters; no obligation conflict on the cited passages.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_FEDREG_AML regime regulates reporting entities' obligations to identify customers and report suspicious transactions (chunk cf7cefacba3f94bc::49a::f39e). The EU_REVERSE_SOLICITATION regime addresses the conditions under which third-country crypto-asset firms can provide services to EU clients without authorisation when the client initiates the relationship (chunk 25cbbd878a1b21d3::4f8::561c). The obligations in the Australian regime relate to AML/CTF compliance and customer identification, while the EU regime concerns the scope of authorisation for crypto-asset services. These are distinct regulatory domains; the EU reverse solicitation exemption does not impose an AML identification obligation on the third-country firm that conflicts with the Australian reporting entity obligations.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Explanation: The EU_MAR passages regulate market integrity, specifically insider dealing and market manipulation (chunks 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The SG_IRAS_TAX passages regulate tax obligations, specifically the Goods and Services Tax (GST) treatment of digital payment tokens (chunks abc2247bc6415d1d::41e::b184, abc2247bc6415d1d::5c7::68f5). The obligations in EU_MAR relate to the conduct of trading and the prevention of market abuse, whereas the obligations in SG_IRAS_TAX relate to the tax treatment of digital assets. These are distinct regulatory domains; the tax treatment of tokens does not create a conflict with the prohibition of market abuse. Therefore, the regimes are in non_conflict.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure restrictions) and SG_AML (MAS Notice 314 AML/CFT framework — training and reporting obligations). When AU entities collect and share data with SG counterparties under AML obligations, APP 8 engages. Operationally resolvable via APP 6.2(b) plus APP 8.2(d) permitted general situations. Same cross-jurisdictional AML-privacy shape.


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Explanation: The AU_APRA_PRUDENTIAL regime regulates prudential standards and reporting obligations for financial institutions (ADIs, insurers, RSE licensees) to ensure financial stability and resilience (chunk 66d049e24f0863da::3f7::aec8). The EU_DAC8 regime regulates the automatic exchange of information regarding crypto-asset users for tax compliance purposes (chunk c0300673081f7232::320::7b46). The obligations in the prudential framework relate to capital adequacy, risk management, and financial system stability, whereas the obligations in DAC8 relate to tax transparency and administrative cooperation. The two regimes regulate distinct domains—prudential supervision versus tax administration—and do not impose conflicting obligations on the same entities or transactions.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: EU_EMD2 (EU E-Money Directive 2 — EMI authorisation) and SG_STABLECOIN (MAS's Single-Currency Stablecoin framework — Singapore-issued G10 stablecoin issuer authorisation). Both regulate stablecoin-like instrument issuance under different jurisdictional frameworks with materially incompatible authorisation requirements. The SG SCS framework specifically requires Singapore issuance and Singapore-resident regulatory perimeter; EU EMD2 authorisation does not transit. Structural conflict.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The EU MiCA RTS passages regulate the notification requirements and acquisition assessments for Crypto-asset service providers (CASP) and financial entities (chunk_ids c51ad46265cea4e5::2f5::4513 and c51ad46265cea4e5::361::e378). The INT_BASEL_CRYPTO passages regulate capital requirements, risk weighting, and exposure definitions for banks and financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b and 32afd37cade34f84::3ec::a3fa). The obligations in MiCA regarding crypto-asset service provision and notification do not impose conflicting capital requirements or operational constraints on banks; rather, they address distinct regulatory domains (crypto-asset service provision vs. banking capital adequacy). Therefore, the regimes are non-conflicting.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: The EU GDPR passages discuss the legal basis for processing, data transfers to third countries, and security measures for payment services. The SG_MAS_OUTSOURCING passages discuss the supervision of Singapore business activities, material outsourcing arrangements with foreign service providers, and the rights of MAS to inspect information. The obligations in the SG_MAS_OUTSOURCING passage (Clause 5.10.2) regarding timely supervision and access to information are complementary to the GDPR's requirements for lawful processing and security, rather than conflicting. The SG_MAS passage does not impose a specific obligation that contradicts the GDPR's data protection principles.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

Explanation: The EU regime (Regime A) regulates the specific operational conduct of crypto-asset service providers regarding client solicitation and authorisation exemptions under MiCA. The FATF regime (Regime B) provides general principles for national-level risk assessments and AML/CFT standards, which are not specific obligations regarding solicitation or authorisation. The passages describe different domains of regulation (operational conduct vs. risk assessment framework), and there is no specific obligation in FATF that conflicts with the EU's solicitation rules.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

Explanation: The AU_ATO_CRYPTO passage discusses the regulation of crypto assets and tax compliance (chunk_id e6bb47e92e88e16c::567::36c4). The EU_DORA passage outlines requirements for digital operational resilience and ICT risk management for financial entities (chunk_id 85307f9e2a040982::5f2::974e). The obligations in these regimes regulate distinct domains—tax compliance and crypto asset classification versus digital operational resilience and ICT risk management—resulting in no overlap of obligations.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise to identify how crypto assets fit within the financial services framework and the subsequent development of licensing and custody reforms. The EU_AMLA passages describe the establishment of an Authority for anti-money laundering and countering the financing of terrorism (AMLA) and the cooperation between obliged entities and supervisory authorities under the EU AML/CFT framework. The obligations in the EU regime relate to anti-money laundering and supervisory cooperation, while the Australian regime focuses on the classification and licensing of crypto assets. The two regimes regulate different domains (AML/CFT vs. crypto asset licensing), and there is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

Explanation: The APRA passage describes a prudential regulatory framework focused on financial stability, licensing, and supervision of institutions (e.g., ADIs, insurers) [66d049e24f0863da::3f7::aec8]. The GDPR passage outlines the legal basis for processing personal data, including conditions for lawful processing and the protection of natural persons [bd84e63f5b622b73::6a8::d132]. The obligations in APRA relate to financial risk management and capital adequacy, while GDPR obligations relate to data privacy and protection. The regimes regulate distinct domains (financial prudential regulation vs. data protection), and there is no evidence of a specific obligation in APRA that conflicts with a specific obligation in GDPR.


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: EU_AMLR_TFR (regime A) and SG_MAS_AML_GENERAL (regime B) both apply AML/CFT obligations to crypto-asset service providers / DPT providers in their respective jurisdictions. Both implement the same underlying FATF standards. The A passage describes the EU framework extending AML/CFT to CASPs; the B passage describes MAS's risk-based supervision of DPT providers. The obligations reinforce each other (entities operating across both jurisdictions face complementary, not contradictory, AML duties).


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Explanation: The AU_AML_CTF regime focuses on reporting obligations for suspicious matters and threshold transactions (chunk 254ca2d92d196180::2ac::a5fe). The EU_PSD2 regime focuses on technical security standards for payment services, specifically strong customer authentication (SCA) and security credentials (chunk adb1a81b9cecaf8c::64f::f5ad). The obligations in the AU regime relate to the detection and reporting of financial crime, while the obligations in the EU regime relate to the technical security of payment transactions. There is no specific obligation in the AU regime that pushes against a specific obligation in the EU regime; they regulate distinct aspects of the financial ecosystem.


2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The evidence for AU_APRA_PRUDENTIAL focuses on the Australian prudential framework, specifically the licensing and supervision of banking, insurance, and superannuation entities (chunk_id 66d049e24f0863da::3f7::aec8). The evidence for SG_FSMA_DTSP focuses on the licensing of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022 in Singapore (chunk_id cc1be49e9cf8c821::2f4::ea8f). The obligations described in the passages regulate distinct sectors (traditional banking/insurance vs. digital token services) and distinct jurisdictions (Australia vs. Singapore). There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are in different domains.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Explanation: The AU Travel Rule passages describe a proposed regulatory expansion to implement the FATF Travel Rule for digital currency exchanges, which is currently in consultation and not yet implemented (cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). The EU DAC8 passages describe the mandatory automatic exchange of information on crypto-asset users to tax authorities (c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The obligations are distinct: one is a prospective AML/CTF reporting requirement for service providers, while the other is a tax information exchange obligation for operators. There is no evidence of a direct conflict between the two regimes in the provided text.


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

Explanation: The EU regime (Regime A) regulates the specific operational conduct of crypto-asset service providers (CASPs) regarding client solicitation and authorisation requirements under MiCA. The FATF regime (Regime B) establishes a minimum global standard for defining Virtual Asset Service Providers (VASPs) and their AML/CFT obligations. The passages show that the FATF definition of VASP is intended to broaden applicability to new asset types and service providers (chunk_id 85240528438654b9::1cd::07d7), whereas the EU regime focuses on the specific exemption of reverse solicitation for third-country firms (chunk_id 25cbbd878a1b21d3::4f8::561c). There is no specific obligation in the FATF text that conflicts with the EU's reverse solicitation exemption; rather, the FATF provides a definition that the EU regime applies to. Therefore, the regimes are in different domains.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical cash transfers exceeding A$10,000 (chunk_ids 6dfe4e63b9fb3c74::3bc::1a3f, 254ca2d92d196180::377::d0c6). The SG_STABLECOIN regime regulates the issuance and reserve requirements of Single-Currency Stablecoins (SCS) issued in Singapore (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The obligations are distinct: one focuses on physical cash reporting thresholds, while the other focuses on the tokenization of assets and reserve management. There is no specific obligation in the SG_STABLECOIN regime that conflicts with the AU_TTR_THRESHOLD reporting requirement. Therefore, the regimes are in different domains.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access control policies and ICT security measures (chunk_id 3c9eb3a25c93f394::474::4786). The INT_BASEL_GENERAL passage discusses the treatment of fiduciary assets and general provisions for leverage ratio exposure measures (chunk_id 32afd37cade34f84::34b::8d30). The obligations and subject matter of the two regimes are distinct; one concerns cybersecurity and access controls, while the other concerns banking capital adequacy and leverage ratios. There is no specific obligation in NIS2 that conflicts with a specific obligation in Basel regarding the same subject matter.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: EU_MICA (EU crypto-asset regulation, market abuse guidelines per Article 92) and INT_FATF_VASP (FATF guidance for VASPs). EU MiCA includes AML/CFT obligations that align with FATF VASP standards; MiCA-authorised CASPs ARE FATF VASPs and face both regulatory frameworks. The B passage notes FATF allows existing licensed financial institutions to perform VASP activities without separate registration — aligned with MiCA's CASP-authorisation approach. Reinforcing rather than conflicting.


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

Explanation: The APRA passages describe a prudential framework for banking, insurance, and superannuation entities, focusing on capital requirements, licensing, and supervision (chunk_ids 9a96d4d1812f257a::2a6::2422, 66d049e24f0863da::3f7::aec8). The SG_STABLECOIN passages describe a specific regulatory regime for 'Single Currency Stablecoins' (SCS) issued in Singapore, distinct from other digital payment tokens (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The SG regime explicitly states that non-SCS will continue to be subject to the existing DPT regulatory regime under the Payment Services Act (chunk_id 58f45cd2ef3de201::36c::e2f6). There is no evidence in the provided passages that APRA's prudential standards impose conflicting obligations on entities regulated by the MAS stablecoin framework, nor is there evidence that the MAS stablecoin framework imposes obligations on APRA-regulated entities that would conflict with APRA's prudential standards. The regimes regulate different domains: APRA regulates financial institutions (ADIs, insurers, RSEs) for prudential safety, while MAS regulates specific stablecoin products for market integrity.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

Box 3.1. Potential Use of Financial Intelligence to Assess Cross-border TF
Risks
Cross-border transaction or movement reports (CTRs) - The FATF
Standards require that all countries implement a declaration or disclosure
system for incoming and outgoing cross-border transportation of currency
and bearer negotiable instruments (CBNIs) with a maximum threshold of
USD/EUR 15 000 (FATF Recommendation 32.) While the low volume of
funds often used by terrorists presents challenges for detection in a
threshold-based system, countries to date have found that information on
40 Notably, chapter 2 above also contains guidance and information sources relevant when assessing
cross-border TF risks. 34 │ TERRORIST FINANCING RISK ASSESSMENT GUIDANCE
the general inflows/outflows of CBNI may still provide useful information
on the potential TF vulnerabilities posed by different borders. Suspicious Transaction Reports (STRs) - The FATF Standards require
that all financial institutions and DNFBPs should be required to notify the
FIU if they suspect or have reasonable grounds to suspect that funds are the
proceeds of a criminal activity, or are related to TF (FATF Recommendation
20).

Explanation: AU_AML_CTF (Australian AML/CTF Act — AUSTRAC reporting framework) and INT_FATF_GENERAL (FATF AML/CFT standards — including R32 on cross-border CTRs). The Australian AML/CTF regime explicitly implements FATF standards including threshold and cross-border reporting. Reinforcing.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

mentioned in item 2 (ii) tracing information
do not apply
4 the transfer of value is a merchant payment card number of the card the payer used in
relation to the merchant payment
5 the transfer of value is a refund of a card number of the card the payer used in
merchant payment relation to the merchant payment that is
refunded
6 the instruction for the transfer of value is card number of the card the payer used in
given by the use of an ATM relation to the withdrawal
7 (a) the value being transferred is money; and tracing information
(b) the money is in a foreign country and, as
a result of the provision of an
international value transfer service, the
money will be in Australia; and
(c) the beneficiary institution receives the
transfer message for the transfer of value
through BECS
8 the value is transferred from a self-hosted (a) payer information; and
virtual asset wallet (b) the

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

12.1 Taxpayers should keep proper records of transactions and provide them to
IRAS upon request. These supporting records should include information
such as:
• Date of transaction
• Number of units of digital tokens received or sold
• Value of digital token at the time of the transaction
• Exchange rate used
• Purpose of the transaction
• Details of customers/suppliers (for buy-sell transactions)
• Details of the ICO
• Receipts/invoices of business expenses

13. Contact Information

13.1 For general enquiries or clarifications on this e-Tax Guide, please call 1800-
356 8622 (Corporate Tax) or 1800-356 8300 (Individual Tax).

Explanation: The AU_TRAVEL_RULE passages discuss the Australian regulatory framework for remittance networks and virtual asset service providers, specifically referencing the FATF 'Travel Rule' and AML/CTF obligations (chunk_ids c4a92930a8caf822::380::0a18, c4a92930a8caf822::57d::3f76, cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). In contrast, the SG_IRAS_TAX passages focus on Singapore's tax treatment of digital payment tokens, specifically GST treatment and record-keeping requirements (chunk_ids abc2247bc6415d1d::5c7::68f5, abc2247bc6415d1d::41e::b184, 7c5602f8b898a7ab::277::e4ae). The obligations in the AU regime relate to anti-money laundering compliance and the identification of parties in transfers, while the obligations in the SG regime relate to goods and services tax and record-keeping for token transactions. These are distinct regulatory domains with no apparent overlap or conflict.


1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The evidence from APRA (Regime A) focuses on the prudential framework, licensing, and supervision of financial institutions (ADIs, insurers, RSE licensees) and reporting standards under the Financial Sector (Collection of Data) Act 2001 (FSCODA) [66d049e24f0863da::3f7::aec8]. The evidence from MAS (Regime B) concerns the Payment Services Act 2019, specifically the licensing of Digital Payment Token (DPT) service providers and AML/CFT obligations [4b4c3c417dc293ba::185::f41d]. The obligations in Regime A relate to prudential capital, risk management, and reporting for traditional financial institutions, while Regime B regulates the licensing and conduct of DPT service providers. These are distinct regulatory domains with no apparent overlap of obligations between the specific prudential standards of APRA and the payment services licensing requirements of MAS.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

46 For information on ASIC's interpretation of this obligation, see ASIC PF 209 Australian financial services
licence conditions
Licensing digital asset intermediaries | 23

(vi) having the financial,47 technological, and human resources to carry out and supervise the
financial service covered by the AFSL,
(vii) having a dispute resolution system48 and compensation arrangements for retail clients for
loss or damage suffered due to breaches of obligations, and
(viii) maintaining a risk management system.
Financial requirements
(g) A platform provider must meet:
(i) the standard solvency and positive net asset requirements,49
(ii) the standard cash needs requirement, and
(iii) a net tangible assets (NTA) requirement for holding cash or cash equivalents and holding
liquid assets of at least:
• 0.5 per cent of the value of the facility (if using a sub-custodian digital asset facility that
has $5m NTA),50 or
• $5 million (if performing the custody function).
Info Box 6 Financial requirements
AFSL holders have obligations to meet 'financial requirements'. These requirements are typically
tailored for different financial products through ASIC legislative instruments. The NTA obligation is
to address the costs of orderly wind-up in the event the provider fails.51
A key issue with digital assets is concentration risk (see Info Box 11 Additional Standards for token
holders). The proposed financial requirements balance the need to avoid concentration of digital
assets among a small number of custodians with the need to ensure robust NTA. It sets the
required level of NTA at the greater of $5 million or 0.5% of the value of the assets held by the
facility.52 This arrangement ensures that as a facility expands, and the operational risk exposure of
the platform provider grows, the provider will maintain a corresponding level of financial
resources.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

3.1 This Notice is based on the following principles, which shall serve as a guide for all banks
in the conduct of their operations and business activities:
(a) A bank shall exercise due diligence when dealing with customers, natural persons
appointed to act on the customer's behalf, connected parties of the customer and
beneficial owners of the customer.
(b) A bank shall conduct its business in conformity with high ethical standards, and
guard against establishing any business relations or undertaking any transaction,
including a digital token transaction, that is or may be connected with, or facilitates
or may facilitate money laundering or terrorism financing.
(c) A bank shall, to the fullest extent possible, assist and cooperate with the relevant
law enforcement authorities in Singapore to prevent money laundering and
terrorism financing.

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers (specifically platform providers and intermediaries) dealing in digital asset facilities, including financial requirements and AFSL obligations (chunk_ids 550958b067dc6726::41f::546c, 550958b067dc6726::74a::7ef1). The SG_AML regime regulates AML/CFT obligations for financial institutions, including banks and insurers, focusing on customer due diligence, suspicious transaction reporting, and training (chunk_ids 3d521e61e49aaf46::38f::e615, 39886a6842407c92::356::ee53). While both regimes apply to entities dealing with digital assets, they regulate distinct aspects: one governs the financial services license and operational conduct, while the other governs anti-money laundering compliance and risk management. There is no specific obligation in the AFSL regime that directly conflicts with or negates the AML obligations in the SG_AML regime; rather, they are complementary requirements for operating in the digital asset space.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Part 1-Consideration of personal information
privacy
1 Australian Privacy Principle 1-open and transparent
management of personal information
1.1 The object of this principle is to ensure that APP entities manage
personal information in an open and transparent way. Compliance with the Australian Privacy Principles etc.
1.2 An APP entity must take such steps as are reasonable in the
circumstances to implement practices, procedures and systems
relating to the entity's functions or activities that:
(a) will ensure that the entity complies with the Australian
Privacy Principles and a registered APP code (if any) that
binds the entity; and
(b) will enable the entity to deal with inquiries or complaints
from individuals about the entity's compliance with the
Australian Privacy Principles or such a code. APP Privacy policy
1.3 An APP entity must have a clearly expressed and up-to-date policy
(the APP privacy policy) about the management of personal
information by the entity.
1.4 Without limiting subclause 1.3, the APP privacy policy of the APP
entity must contain the following information:
(a) the kinds of personal information that the entity collects and
holds;
(b) how the entity collects and holds personal information;
(c) the purposes for which the entity collects, holds, uses and
discloses personal information;
358 Privacy Act 1988

Explanation: CPS 230 is APRA's prudential operational-risk management standard (critical operations, BCP, service-provider risk). The Privacy Act / APPs govern personal-information handling. The two regimes apply to APRA-regulated APP entities but operate in disjoint domains. APP 11 (security of personal information) is incidentally informed by CPS 230 controls, but the obligations are cumulative, not conflicting.

CPS 230 third-party reporting required disclosure of personal information that APP 6 would prohibit — outsourcing arrangements typically already include APP-compatible data-handling clauses.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Explanation: The evidence for AU_CORPS_ACT (chunk 0fc4f857c226f510::375::66b5) outlines the interaction between the Corporations Act and the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up. The evidence for SG_MAS_AML_GENERAL (chunk 6d8a84a9f3d6e9e4::480::ac46) discusses the FSM Sanctions Regulations and the role of the AML/CFT compliance function within a financial institution. The obligations in the Corporations Act regarding corporate governance and winding up do not overlap with the obligations in the Singapore AML/CFT regime regarding sanctions compliance and internal audit functions. Therefore, the regimes regulate different domains and do not conflict.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: The AU_PRIVACY regime regulates the cross-border disclosure of personal information, requiring entities to ensure overseas recipients comply with Australian Privacy Principles (APPs) and providing exceptions for consent or permitted general situations (e.g., safety threats) [e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3]. The EU_MAR regime regulates market abuse, including insider dealing and market manipulation, to ensure financial market integrity [5cc4a27bc578287a::165::3333]. The obligations are distinct: one governs data protection and privacy flows, while the other governs financial market conduct and integrity. There is no specific obligation in AU_PRIVACY that pushes against a specific obligation in EU_MAR, nor is there evidence of overlap in the cited passages. Therefore, the regimes are in different domains.