Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.3, October 2025
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take such steps as are reasonable in the circumstances to ensure that the overseas recipient
does not breach the APPs (other than APP 1) in relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, to facilitate the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take such steps as are reasonable in the
circumstances to ensure that the recipient does not breach the APPs in relation to that
information.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure restrictions) and FATF_R16 (FATF Recommendation 16 — travel rule requiring originator/beneficiary information for VA transfers). FATF R16 implementations require sharing personal data of senders/recipients across borders; APP 8 restricts overseas disclosure. Operationally resolvable via APP 6.2(b) (required by law) when AU implements R16 via AML/CTF framework. Same cross-jurisdictional AML-privacy shape.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU MiCA RTS passages describe the development of technical standards for crypto-asset service providers (CASP) and notification requirements (chunk_ids c51ad46265cea4e5::2f5::4513 and c51ad46265cea4e5::361::e378). The Singapore foundational legislation passage discusses MAS's intention to align with international standards and considers the regulatory scope of securities-based crypto tokens (SCS), specifically mentioning that SCS issued under EU MiCA regulation may warrant recognition (chunk_id 7c04f2a0bd85290a::413::fc6a). The regimes regulate the same general topic (crypto-assets) but the EU passage outlines internal EU technical standards development, while the Singapore passage discusses the application of Singaporean regulatory powers to foreign tokens and international alignment. There is no evidence of a specific obligation in MiCA RTS that conflicts with a specific obligation in Singaporean foundational legislation; rather, the Singapore passage acknowledges the EU framework as a potential basis for recognition. Therefore, the regimes are non-conflicting.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise to identify how crypto assets fit into the financial services framework and the subsequent development of licensing and custody reforms. The EU_MIFID2 passages describe obligations for investment firms regarding the product approval process, suitability assessments, and information disclosure for financial instruments. The obligations in the EU regime apply to investment firms and financial instruments, whereas the Australian regime addresses the regulatory perimeter for crypto assets and service providers. The passages describe different regulatory domains and do not contain specific obligations that push against one another.


Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

GUIDANCE FOR A RISK-BASED APPROACH
MONEY OR VALUE TRANSFER
SERVICES
FEBRUARY 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance for a Risk-Based Approach for Money or Value Transfer Services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/rba-money-or-value-transfer.html
© 2016 FATF/OECD.

Explanation: EU_GDPR (Article 44+ cross-border data transfer principles) and FATF_R16 (FATF Recommendation 16 — travel rule for VAs requiring sharing of originator/beneficiary personal data across borders for VA transfers). FATF R16 implementations in EU (TFR) mandate the data sharing; GDPR Chapter V restricts. Operationally resolvable via GDPR Art. 6(1)(c) plus Chapter V mechanism. Same conflict shape as the labelled EU TFR ↔ EU GDPR conflict in the careful cohort.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical cash transactions exceeding A$10,000 to AUSTRAC (chunk_ids 6dfe4e63b9fb3c74::3bc::1a3f, 254ca2d92d196180::377::d0c6). The EU_MICA regime regulates the provision of crypto-asset services and the authorisation of crypto-asset service providers (chunk_ids f9082873c5d9ba9d::302::bbe0, c51ad46265cea4e5::462::80d8). The obligations in the Australian regime relate to physical currency reporting thresholds, while the obligations in the EU regime relate to the licensing and conduct of crypto-asset service providers. There is no specific obligation in MiCA that conflicts with the AUSTRAC reporting requirement for physical cash transfers, nor do the regimes regulate the same subject matter in a way that creates a friction point.


It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

(69)
The crypto-asset white paper drawn up by an issuer of e-money tokens should contain all information concerning
that issuer and the offer of e-money tokens or their admission to trading that is necessary to enable prospective
buyers to make an informed purchase decision and understand the risks relating to the offer of e-money tokens.
The crypto-asset white paper should also expressly refer to the right of holders of e-money tokens to redeem their
e-money tokens for funds denominated in the official currency that the e-money tokens reference at par value
and at any time.

(70)
Where an issuer of e-money tokens invests the funds received in exchange for e-money tokens, such funds should
be invested in assets denominated in the same official currency as the one that the e-money token is referencing
in order to avoid cross-currency risks.

Explanation: The obligations in the Australian Privacy Principle 8 (AU_PRIVACY) govern the cross-border disclosure of personal information to overseas recipients, requiring reasonable steps to ensure compliance and accountability for mishandling (chunk_ids e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3). In contrast, the EU MICA Title IV EMT provisions regulate the liability of issuers of e-money tokens for information provided in crypto-asset white papers and the content of those white papers (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::353::debc). The two regimes regulate distinct subject matter—data protection and cross-border data flows versus financial product disclosure and liability for token issuers—and do not impose conflicting obligations on the same entity or transaction type.


Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

27.12.2022 EN Official Journal of the European Union L 333/39
(h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from
post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT
security awareness programmes and digital operational resilience training for staff and management.
2. The ICT risk management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented
and reviewed periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory
instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A
report on the review of the ICT risk management framework shall be submitted to the competent authority upon its
request.
3.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Explanation: DORA applies to payment service providers (PSPs) as a class of EU financial entity; PSD2 authorises and supervises those same PSPs. DORA Art. 6 imposes ICT risk-management framework duties; PSD2 Art. 97 imposes Strong Customer Authentication duties. The two regimes are aligned by design — PSD2 supplies the payments-specific overlay, DORA supplies the horizontal ICT-resilience overlay. No DORA obligation pushes against any PSD2 obligation. Easy hard negative.

DORA's ICT third-party register obligation prevented PSPs from using outsourced SCA providers — DORA's framework is designed to permit such arrangements with documentation, not prohibit them.


Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Part 2
Identification procedures for certain low-risk services Division 3
Section 30
Division 3-Identification procedures for certain low-risk
services
30 Identification procedures for certain low-risk services
Scope
(1) This section applies to the provision by a reporting entity of a
designated service to a customer if, under the AML/CTF Rules, the
service is taken to be a low-risk designated service. (2) Sections 32 and 34 do not apply to the provision by the reporting
entity of the designated service to the customer. Note: For special rules about verification of identity etc., see section 31.
31 Verification of identity of low-risk service customer etc. Scope
(1) This section applies to a reporting entity if:
(a) at a particular time (the relevant time), the reporting entity
commences to provide a designated service to a customer;
and
(b) under the AML/CTF Rules, the service is taken to be a
low-risk designated service; and
(c) at the relevant time or a later time, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer.

Reporting structuring Related legislation Part 3, Division 3 (Sections 43 and 44) of the AML/CTF Act (latest version) - Threshold
transactions Chapter 19 of the AML/CTF Rules (latest version) - Reportable details for threshold
transactions The content on this website is general and is not legal advice. Before you make a decision or
take a particular action based on the content on this website, you should check its accuracy,
completeness, currency and relevance for your purposes. You may wish to seek independent
professional advice. https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 2/3 https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 3/3

https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 1/3 Exemptions from TTR obligations You don't have to submit a TTR if the designated service involving a threshold
transaction is provided: e ator through your permanent establishment in a foreign country e by an authorised deposit-taking institution (ADI) to a customer that is also an ADI e by the Reserve Bank of Australia to a customer that holds an exchange settlement
account (ESA) (that is, an account held at the Reserve Bank for settlement of
obligations between ESA holders) e by an ESA holder to a customer that holds an exchange settlement account. Additionally, if you hold an Australian Financial Services Licence (AFSL) and only
arrange for a person to receive a designated service rather than providing it yourself,
you do not have to submit a TTR. Related pages How to submit a threshold transaction report (TTR)
Reporting multiple cash transactions

Explanation: The AML/CTF Act Part 3 Division 3 (operationalised by AML/CTF Rules Chapter 19) imposes a Threshold Transaction Report obligation for cash transactions of A$10,000 or more, establishing a fixed numerical threshold. The same Act contains structuring offences (sections 142–143) that criminalise designing a transaction or pattern of transactions to fall below the TTR threshold. This is the textbook recurring_friction pair: the threshold itself creates the attractor for structuring behaviour, and the structuring offence exists *because of* the threshold. There is no compliant alternative design — the threshold is the regulatory device — but the cost of having chosen it persists indefinitely: reporting entities must continually monitor transaction patterns for structuring indicators, and AUSTRAC must continually invest in detection and enforcement. The friction is structural to the regime's design rather than a transitional artefact.

Maintain transaction monitoring systems calibrated for sub-threshold patterns; train staff to recognise and SMR-report structuring.

Apply documented TTR exemptions (per AUSTRAC guidance) for genuinely exempt designated services.

Recurring_friction is being labelled here as a property of the regime, not a violation by any individual entity.


Initial views from consultation paper
• Consultation paper focussed on • Stakeholders noted the complexity
market licensing, custody and token of introducing new regulation
mapping
• Most stakeholders agreed that
• Divergent views among many issues there is a need for custody
regulation
• Most agree that self-regulation is
not appropriate - Hard to implement detailed standards
as each custodian operates differently
• Differing views about creating
- Capital requirements, insurance and
bespoke regime or using the Corps
liability for loss needs to be quite
Act
specific
- Sophisticated or larger stakeholders
- No meaningful support for a domestic
prefer more rigorous regulation (Corps
location requirement. Act). Key terms and concepts
• Blockchain • Crypto assets
- A digital ledger comprised of - A useful blanket term that covers on-
unchangeable, digitally recorded data chain assets: cryptocurrencies, NFTs,
in packages called blocks. and other, still emerging, products.
- Each block is 'chained' to the next
block using a cryptographic signature.
• Web3 / Web 3.0
- Ethereum is a public blockchain, open
- Web3, or Web 3.0, are terms used
to the world; its digital ledger is
synonymously with "the decentralized
distributed, or synced, between many
web" and are often used to refer,
nodes; these nodes arrive at
broadly, to the blockchain and
consensus regarding whether a
decentralized technology ecosystems
transaction is valid before encrypting a
as a whole.
number of transactions into a block

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: The evidence from Regime A (AU_CORPS_ACT) focuses on the interaction of the Corporations Act with the Australian Charities and Not-for-profits Commission Act and discusses market licensing, custody, and token regulation in a consultation context (chunk_id d75262e404517e0c::5e6::a0b1). The evidence from Regime B (INT_BASEL_CRYPTO) defines bank exposures for capital requirements, focusing on financial institutions and prudential standards (chunk_id 32afd37cade34f84::3a4::1a5b). The obligations described in the Basel crypto framework relate to capital adequacy for banks, whereas the Corporations Act evidence discusses corporate governance and market licensing. There is no specific obligation in the Basel crypto framework that pushes against a specific obligation in the Corporations Act; they regulate different domains (banking capital vs. corporate governance/licensing).


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

Explanation: EU_AMLA (EU's Anti-Money Laundering Authority under AMLD6 — comprehensive AML/CFT framework) and INT_FATF_VASP (FATF VASP guidance — international AML/CFT standards for VAs and VASPs). EU's AMLA framework explicitly implements FATF AML standards including R16 (via TFR) and VASP-related obligations. Aligned by design.


94. The FATF Standards, including the definitions of virtual assets and VASPs, represent
a minimum standard for countries to introduce. In line with the RBA, countries may
choose to extend their AML/CFT regimes to include other digital assets and entities,
beyond the FATF definition of virtual asset and VASP. Such a determination should
be made on the basis of a ML/TF risk assessment, with consideration of the
challenges associated with regulatory divergence.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  37
PART THREE:
APPLICATION OF FATF STANDARDS TO COUNTRIES AND
COMPETENT AUTHORITIES

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: INT_FATF_VASP (FATF VASP standards as a minimum international AML/CFT framework) and SG_PSA_DPT (Singapore's DPT licensee AML obligations under MAS PSN02). Singapore explicitly implements FATF VASP guidance through MAS's PSA framework; the B passages describe MAS surveillance and licensing of VASPs operating in Singapore consistent with FATF guidance. Reinforcing.


(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Explanation: The EU AMLR TFR passages focus on anti-money laundering obligations, specifically the traceability of crypto-asset transfers and the definition of 'self-hosted addresses' (c4024f4c4c1616cc::23d::700a, c0300673081f7232::279::1918). The INT_BASEL_CRYPTO passages focus on prudential capital requirements and risk-weighting for bank exposures to financial institutions (32afd37cade34f84::3a4::1a5b). The obligations in Regime A (AML/CFT reporting and identification) do not impose a direct conflict with the obligations in Regime B (capital adequacy and risk weighting). The regimes regulate distinct aspects of financial activity—compliance and transparency versus solvency and risk management—and do not overlap in a way that creates a mutually exclusive obligation.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

Explanation: Regime A (AU_APRA_CPS234) is a Prudential Practice Guide regarding Operational Risk Management and Information Security for APRA-regulated entities. Regime B (SG_PSA_DPT) is a MAS Notice regarding AML/CFT obligations for holders of payment service licences providing Digital Payment Token services. The obligations in Regime A relate to internal risk management frameworks and information security practices, while the obligations in Regime B relate to anti-money laundering and counter-terrorism financing compliance. The regimes regulate distinct domains of compliance—prudential risk management versus financial crime prevention—and do not impose conflicting obligations on the same specific activity.


The crisis has shown that collateralised debt obligations comprised of
asset-backed securities (i.e. CDOs of ABS or so-called 'resecuritisations') are more
highly correlated with risk than are traditional securitisations. APRA reviewed its
prudential standard for securitisation and assessed that the current requirements do not
capture the risks associated with these resecuritisation structures. The BCBS also formed the view that increased disclosure requirements should
provide timely, relevant, reliable and useful decision-making information that
promotes institutional transparency. APRA also identified that its prudential
requirements for disclosure did not cover certain elements relating to an ADI's
securitisation exposures. Therefore, based on APRA's experience as the prudential supervisor during the crisis
and analysis of its prudential framework for ADIs, APRA believes that the
deficiencies that the Basel II enhancements are seeking to address exist in the
Australian prudential framework and present risks that require addressing.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: AU_APRA_PRUDENTIAL (APRA's broader prudential framework — Basel-aligned standards) and INT_BASEL_GENERAL (Basel III framework). APRA implements Basel standards in Australia; the cited A passage is a Basel II Enhancements RIS document confirming the implementation relationship. Aligned by design.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

Explanation: The EU MiCA passages (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::34a::74e3) regulate the licensing and registration of Crypto-Asset Service Providers (CASPs) within the EU. The FATF passages (fe52dd87e13dba41::261::59a4, 75b61beed88910f9::4ad::debc) provide general principles for assessing Money Laundering and Terrorist Financing (ML/TF) risks. While MiCA CASPs will be subject to FATF AML/CFT standards, the provided passages do not describe a specific regulatory obligation in MiCA that conflicts with a specific obligation in FATF. Instead, they address distinct regulatory domains: MiCA focuses on the operational authorization of crypto firms, whereas FATF focuses on the general risk assessment framework for AML/CFT compliance.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The EU MICA Title IV EMT regime regulates the disclosure and liability obligations for issuers of e-money tokens and asset-referenced tokens (e.g., Article 51 and 52 regarding white paper notifications and liability for misleading information). In contrast, the SG IRAS Tax regime addresses the Goods and Services Tax (GST) treatment of digital payment tokens, specifically exempting their supply from GST and outlining record-keeping requirements for businesses trading in them. The obligations in the EU regime relate to financial disclosure and issuer liability, while the obligations in the SG regime relate to tax treatment and record-keeping for GST purposes. These are distinct regulatory domains with no apparent overlap or conflict regarding the specific obligations described in the provided passages.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The evidence from Regime A (AU_ASIC_CRYPTO) focuses on the interpretation of the Corporations Act 2001 regarding crypto-assets as financial products and the licensing requirements for financial services (e.g., AFS licences). The evidence from Regime B (SG_FOUNDATIONAL_LEGISLATION) discusses MAS's enforcement actions against ICO issuers and exchanges, as well as its intention to expand legislation to align with FATF standards. The obligations in Regime A relate to the definition of financial products and licensing under Australian law, while the obligations in Regime B relate to MAS's regulatory scope and enforcement in Singapore. These are distinct regulatory domains with no specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are in non_conflict.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: AU_APRA_CPS234 (APRA Information Security prudential standard) and INT_BASEL_CRYPTO (Basel d424 prudential treatment of crypto exposures — bank capital calculation). Both touch on prudential / risk frameworks for financial entities but address materially different concerns — APRA infosec is about cybersecurity controls; Basel crypto is about capital requirements for crypto exposures. Distinct mechanisms; no direct conflict.


Initial views from consultation paper
• Consultation paper focussed on • Stakeholders noted the complexity
market licensing, custody and token of introducing new regulation
mapping
• Most stakeholders agreed that
• Divergent views among many issues there is a need for custody
regulation
• Most agree that self-regulation is
not appropriate - Hard to implement detailed standards
as each custodian operates differently
• Differing views about creating
- Capital requirements, insurance and
bespoke regime or using the Corps
liability for loss needs to be quite
Act
specific
- Sophisticated or larger stakeholders
- No meaningful support for a domestic
prefer more rigorous regulation (Corps
location requirement. Act). Key terms and concepts
• Blockchain • Crypto assets
- A digital ledger comprised of - A useful blanket term that covers on-
unchangeable, digitally recorded data chain assets: cryptocurrencies, NFTs,
in packages called blocks. and other, still emerging, products.
- Each block is 'chained' to the next
block using a cryptographic signature.
• Web3 / Web 3.0
- Ethereum is a public blockchain, open
- Web3, or Web 3.0, are terms used
to the world; its digital ledger is
synonymously with "the decentralized
distributed, or synced, between many
web" and are often used to refer,
nodes; these nodes arrive at
broadly, to the blockchain and
consensus regarding whether a
decentralized technology ecosystems
transaction is valid before encrypting a
as a whole.
number of transactions into a block

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Explanation: The evidence for Regime A (AU_CORPS_ACT) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act and general provisions regarding corporate governance, civil liability, and token custody regulation (chunk_id d75262e404517e0c::5e6::a0b1). The evidence for Regime B (EU_AMLR_TFR) concerns the European Union's Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework, specifically extending obligations to crypto-asset service providers and the traceability of crypto-asset transfers (chunk_id c0300673081f7232::279::1918). The obligations in Regime B relate to the reporting and monitoring of financial transactions for AML/CFT purposes, whereas the obligations in Regime A relate to corporate governance and the regulation of crypto-asset custody. These are distinct regulatory domains that do not impose conflicting obligations on the same specific activity.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

mentioned in item 2 (ii) tracing information
do not apply
4 the transfer of value is a merchant payment card number of the card the payer used in
relation to the merchant payment
5 the transfer of value is a refund of a card number of the card the payer used in
merchant payment relation to the merchant payment that is
refunded
6 the instruction for the transfer of value is card number of the card the payer used in
given by the use of an ATM relation to the withdrawal
7 (a) the value being transferred is money; and tracing information
(b) the money is in a foreign country and, as
a result of the provision of an
international value transfer service, the
money will be in Australia; and
(c) the beneficiary institution receives the
transfer message for the transfer of value
through BECS
8 the value is transferred from a self-hosted (a) payer information; and
virtual asset wallet (b) the

AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

40.32 The derivatives should be converted into positions in the relevant underlying and become subject
to specific and general market risk charges as described above. In order to calculate the standard
formula described above, the amounts reported should be the market value of the principal
amount of the underlying or of the notional underlying resulting from the prudent valuation
guidance set out in paragraphs 690 to 701 in Basel II.[8]
Footnote
[8] For instruments where the apparent notional amount differs from the effective notional
amount, banks must use the effective notional amount.

Explanation: The regimes regulate distinct domains. Regime A (AU_TRAVEL_RULE) pertains to Australian financial services regulation, specifically the registration of remittance network providers and virtual asset service providers, and the implementation of the FATF 'Travel Rule' for digital currency transactions. Regime B (INT_BASEL_GENERAL) pertains to international banking regulation, specifically the Basel III framework for capital adequacy, leverage ratios, and risk-weighted assets. The cited passages for Regime A discuss AML/CTF obligations and the Travel Rule, while the cited passages for Regime B discuss accounting frameworks, leverage ratios, and expected losses. There is no overlap of obligations between the two regimes.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The AU_FEDREG_AML passages describe the scope and obligations of Australia's AML/CTF regime, specifically regarding reporting entities, customer identification, and suspicious transaction reporting (chunk cf7cefacba3f94bc::49a::f39e). The MAS_TRM passages discuss the application of the TRM Guidelines to licensees, emphasizing that these guidelines are principles-based statements of industry best practices rather than prescriptive obligations (chunk 20d526d712753652::401::f956). The regimes regulate different aspects of financial services compliance—Australia's AML/CTF obligations versus Singapore's TRM principles-based guidelines—and do not impose conflicting requirements on the same specific obligation.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: INT_BASEL_CRYPTO (Basel d424 — prudential capital treatment of bank crypto-asset exposures, with high risk weights for unbacked crypto and conditional treatments for tokenised traditional assets) and EU_MICA (EU framework allowing bank participation in the crypto market as CASPs / EMT issuers). For bank-affiliated MiCA participants, every crypto exposure generates ongoing Basel capital charges; every operational decision is shaped by the interaction between MiCA's authorisation perimeter and Basel's capital framework. The friction is structural to the design — banks bear the cost of running crypto activities under a non-crypto-native capital framework.


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: INT_FATF_VASP (regime A) and SG_FSMA_DTSP (regime B) — FATF sets minimum standards for VASP regulation; SG's FSM Act DTSP licensing is Singapore's specific implementation of those standards. The B passages describe MAS issuing the consultation paper and licensing requirements for digital token service providers under the FSM Act, which is the local instantiation of the FATF Recommendations. Reinforcing relationship.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: The AU Travel Rule passage (chunk cf7cefacba3f94bc::383::7d9d) discusses the *absence* of the Travel Rule for digital currency exchanges in Australia and the *consultation* on extending it. The SG MAS Outsourcing passage (chunk a82833dc0f7ca903::5f1::735d) outlines general supervisory expectations for material outsourcing arrangements with service providers located outside Singapore, specifically regarding timely access to information. The two regimes regulate distinct aspects of the digital asset ecosystem: one addresses the specific regulatory status of the Travel Rule in Australia, while the other addresses general supervisory expectations for outsourcing in Singapore. There is no specific obligation in the SG MAS Outsourcing guidelines that conflicts with the specific obligation or lack thereof in the AU Travel Rule regarding the Travel Rule's implementation.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Preface | 4
1.6 MAS invites comments from banks and other interested parties. Please refer to Annex A for the list of
questions.
1.7 Please note that all submissions received will be published and attributed to the respective respondent
unless they expressly request MAS not to do so. As such, if respondents would like
(a) their whole submission or part of it (but not their identity), or
(b) their identity along with their whole submission,
to be kept confidential, please expressly state so in the submission to MAS. MAS will only publish
non-anonymous submissions. In addition, MAS reserves the right not to publish any submission
received where MAS considers it not in the public interest to do so, such as where the submission
appears to be libelous or offensive.
1.8 Please submit written comments via email to prudential_policy_dept@mas.gov.sg using the suggested
template by 28 April 2025. Prudential Treatment & Disclosures of Cryptoasset Exposures | 5
2.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). In contrast, the SG MAS Prudential Crypto regime addresses the prudential treatment, capital requirements, and operational standards for cryptoasset exposures and stablecoins (chunk_ids 3d9b3d4849297e91::3c6::7b85, 7c04f2a0bd85290a::449::02f2). The obligations in DAC8 relate to reporting to tax authorities, while the obligations in MAS relate to financial stability and risk management. These are distinct regulatory domains that do not impose conflicting obligations on the same entity.


Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

Explanation: EU_DAC8 (EU crypto-asset tax reporting directive) and EU_MICA (broad EU crypto-asset regulation). Recurring friction: MiCA-regulated activities generate DAC8 reporting obligations on every relevant transaction; the combined ongoing cost is a function of design choice rather than a one-time issue.