Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

Explanation: The EU_MICA passages describe specific obligations regarding crypto-asset service provision, market abuse prevention, and licensing requirements (e.g., Article 92(1) and Article 81(15)(a)). The INT_FATF_GENERAL passages provide high-level guidance on general principles for assessing money laundering and terrorist financing (ML/TF) risks at the national level and do not contain specific obligations applicable to crypto-asset service providers or market abuse. The regimes regulate distinct domains: MiCA establishes a detailed regulatory framework for crypto-assets, while FATF provides international standards for AML/CFT. There is no specific obligation in MiCA that pushes against a specific obligation in FATF in the provided text.


(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The obligations in EU_DORA focus on digital operational resilience, ICT risk management, and contractual arrangements with ICT third-party service providers (chunk_ids 85307f9e2a040982::3d7::f935, 85307f9e2a040982::5f2::974e). In contrast, the obligations in INT_BASEL_CRYPTO address capital requirements, risk-weighting of bank exposures, and prudential standards for financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The regimes regulate distinct aspects of financial stability—digital resilience versus capital adequacy—and do not impose conflicting obligations on the same activity.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

Explanation: INT_FATF_VASP (FATF VASP definition and AML obligations) and AU_ATO_CRYPTO (ATO crypto-asset tax framework). Whether a particular AU crypto-asset operator falls within the FATF VASP definition (vs a non-VASP financial intermediary) turns on FACTS about the services provided — distinct downstream AML obligations. Low severity because the AU tax framework applies regardless of the VASP classification.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLR/TFR AML/CFT + travel-rule and EU MiCA Title V crypto-asset service provider regime are designed to coexist — obligations apply cumulatively without collision. CASPs under MiCA Title V are explicitly covered by AMLR and the TFR travel-rule regime — aligned. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Article 67
Rules on access to and use of payment account information in the case of account information services
1. Member States shall ensure that a payment service user has the right to make use of services enabling access to
account information as referred to in point (8) of Annex I. That right shall not apply where the payment account is not
accessible online.
2. The account information service provider shall:
(a) provide services only where based on the payment service user's explicit consent;
(b) ensure that the personalised security credentials of the payment service user are not, with the exception of the user
and the issuer of the personalised security credentials, accessible to other parties and that when they are transmitted
by the account information service provider, this is done through safe and efficient channels;
(c) for each communication session, identify itself towards the account servicing payment service provider(s) of the
payment service user and securely communicate with the account servicing payment service provider(s) and the
payment service user, in accordance with point (d) of Article 98(1);
(d) access only the information from designated payment accounts and associated payment transactions;
(e) not request sensitive payment data linked to the payment accounts;
(f) not use, access or store any data for purposes other than for performing the account information service explicitly
requested by the payment service user, in accordance with data protection rules.
3.

Article 66
Rules on access to payment account in the case of payment initiation services
1. Member States shall ensure that a payer has the right to make use of a payment initiation service provider to obtain
payment services as referred to in point (7) of Annex I. The right to make use of a payment initiation service provider
shall not apply where the payment account is not accessible online.
2. When the payer gives its explicit consent for a payment to be executed in accordance with Article 64, the account
servicing payment service provider shall perform the actions specified in paragraph 4 of this Article in order to ensure the
payer's right to use the payment initiation service.
3.

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Explanation: PSD2's open-banking architecture (Articles 66-67 on payment initiation services and account information services, Article 97 on strong customer authentication) requires mandatory third-party access to payment-account personal data on the customer's instruction. GDPR Articles 5-7 demand minimisation, purpose limitation and explicit lawful basis. PSD2 Recital 30 explicitly references data protection law as applicable. The tension is real: PSD2 pushes for mandated disclosure of personal payment data to AISPs/PISPs, while GDPR demands controllable scope. EDPB Guidelines 06/2020 on the interplay of PSD2 and GDPR resolve the tension by requiring AISP/PISP access on the basis of GDPR Art. 6(1)(b) (contract) — the customer's own request creates the lawful basis. Practitioners must design consent flows that distinguish the PSD2 'explicit consent' (Art 94(2)) from the GDPR 'consent' lawful basis (Art 6(1)(a)).

AIS/PIS access by AISPs/PISPs operates on GDPR Art 6(1)(b) (contract performance triggered by customer request), not Art 6(1)(a) (consent).

Document PSD2 Art 94(2) 'explicit consent' as a sector-specific procedural requirement, not as the GDPR lawful basis.

Build dynamic consent flows that allow per-account, per-AISP-PISP scope control per EDPB Guidelines 06/2020.

PSP and AISP/PISP are EU-authorised; third-country open-banking arrangements have a different Chapter V transfer analysis.


1.4 The revised MAS Technology Risk Management Guidelines set out technology
risk management principles and best practices for the financial sector, to guide FIs in the
following:
(a) Establish Sound and Robust Technology Risk Governance and Oversight
The board of directors and senior management at an FI play an integral part in
the oversight and management of technology risk. The board of directors and
senior management should cultivate a strong risk culture, and ensure the
establishment of a sound and robust technology risk management framework.
(b) Maintain Cyber Resilience
Strong cyber resilience is critical for sustaining trust and confidence in financial
services. FIs should adopt a defence-in-depth approach to strengthening cyber
resilience. It is also important that FIs establish and continuously improve their
IT processes and controls to preserve confidentiality, integrity and availability of
data and IT systems.
Monetary Authority of Singapore 5

4.1.4 The framework should also encompass the following components:
risk identification - identify threats and vulnerabilities to the FI and
information assets;
risk assessment - assess the potential impact and likelihood of threats
and vulnerabilities to the FI and information assets;
risk treatment - implement processes and controls to manage technology
risks posed to the FI and protect the confidentiality, integrity and
availability of information assets; and
risk monitoring, review and reporting - monitor and review technology
risks, which include risks that customers are exposed to, changes in
business strategy, IT systems, environmental or operating conditions; and
report key risks to the board of directors and senior management.

4.1.5 As business and IT environments, as well as the cyber threat landscape, tend to
evolve over time, the FI should review the adequacy and effectiveness of its risk
management framework regularly.
Monetary Authority of Singapore 12

Transfer of personal data outside Singapore
26.-(1) An organisation must not transfer any personal data to a
country or territory outside Singapore except in accordance with
requirements prescribed under this Act to ensure that organisations
provideastandardofprotectiontopersonaldatasotransferredthatis
comparable to the protection under this Act. (2) The Commission may, on the application of any organisation,
by written notice exempt the organisation from any requirement 33 Act 2012 2020Ed.
prescribed pursuant to subsection (1) in respect of any transfer of
personal data by that organisation. (3) An exemption under subsection (2) -
(a) may be granted subject to such conditions as the
Commission may specify in writing; and
(b) neednotbepublishedintheGazetteandmayberevokedat
any time by the Commission. (4) The Commission may at any time add to, vary or revoke any
condition imposed under this section.

PART 6
CARE OF PERSONAL DATA
23. Accuracy of personal data
24. Protection of personal data
25. Retention of personal data
26. Transfer of personal data outside Singapore
PART 6A
NOTIFICATION OF DATA BREACHES
26A. Interpretation of this Part
26B. Notifiable data breaches
26C. Duty to conduct assessment of data breach
26D. Duty to notify occurrence of notifiable data breach
26E. Obligations of data intermediary of public agency

3 Act 2012 2020Ed.

PART 7
Section
27. to 32. [Repealed]

PART 8
33. [Repealed]
34. [Repealed]
35. [Repealed]

Explanation: MAS TRM Guidelines regulate technology risk management at MAS-supervised FIs (governance, ICT, outsourcing, cybersecurity). PDPA regulates personal data handling. The two regimes co-apply to MAS-supervised FIs that are also PDPA-bound organisations, but operate in disjoint domains. TRM's data confidentiality controls satisfy PDPA Part 6 (care of personal data) as a side effect, but the obligations are cumulative not conflicting. Easy hard negative.

TRM Guidelines required cross-border ICT-incident data sharing that PDPA s 26 would prohibit — TRM expressly contemplates PDPA compliance.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

MAS Notice PSN02
5 December 2019
NOTICE TO HOLDERS OF PAYMENT SERVICE LICENCE (DIGITAL PAYMENT TOKEN
SERVICE)
MONETARY AUTHORITY OF SINGAPORE ACT, CAP. 186
PREVENTION OF MONEY LAUNDERING AND COUNTERING THE FINANCING OF
TERRORISM - HOLDERS OF PAYMENT SERVICE LICENCE (DIGITAL PAYMENT TOKEN
SERVICE)
______________________________________________________________________

Explanation: AU_ASIC_CRYPTO (financial-product classification of digital assets under the Corporations Act) and SG_PSA_DPT (Singapore's DPT-licence AML notice under the Payment Services Act 2019) both regulate crypto-asset service provision but apply distinct perimeters. A focuses on whether the asset is a financial product; B focuses on DPT-licensee AML obligations. The cited passages don't show overlapping obligations on the same entity.


Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): ASIC's crypto-asset INFO 225 / RG 282 guidance and Australian AML/CTF Act + Rules (binding instruments) operate in disjoint regulatory domains at the obligation level. ASIC crypto-asset guidance addresses securities-law treatment; AML/CTF Act addresses AML — disjoint. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 234 information security standard and AUSTRAC IFTI / EFTI travel-rule reporting operate in disjoint regulatory domains at the obligation level. Info-sec vs AML travel rule — disjoint obligation surfaces. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU_PSD2 passages regulate the technical authentication requirements for payment services, specifically strong customer authentication and security credentials (chunks 64f, 31a). The INT_IOSCO_GENERAL passages discuss the 'Objectives and Principles of Securities Regulation' and general disclosure standards for securities markets (chunk 455). The obligations in the EU regime relate to payment initiation and security, while the IOSCO regime relates to securities regulation and disclosure. There is no specific obligation in the EU payment regulation that conflicts with a specific obligation in the IOSCO securities regulation; they regulate distinct domains of financial activity.


Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Explanation: MiFID II and MAR are companion EU market-conduct instruments: MiFID II provides authorisation and conduct rules for investment firms; MAR overlays market-abuse prohibitions on the same population. MiFID II Article 16 organisational requirements explicitly include systems and controls designed to detect market abuse — the MAR / MiFID II interaction is by design. Hard negative.

MAR Art 16 STOR (suspicious transaction or order report) confidentiality rules contradicted MiFID II Art 24 client-information rules — designed to be cumulative, not conflicting.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: The AU_ATO_CRYPTO passage discusses the Australian tax treatment and regulation of crypto assets, specifically noting the government's reform agenda and the tax reporting of crypto assets by Australians. The INT_IOSCO_GENERAL passage outlines the methodology and objectives of the International Organization of Securities Commissions (IOSCO), focusing on international standards for securities regulation and cooperation among securities authorities. The two regimes regulate distinct domains: one is a domestic tax and regulatory framework for crypto assets, while the other is an international standard-setting body's methodology for securities regulation. There is no specific obligation in the AU_ATO_CRYPTO regime that conflicts with a specific obligation in the INT_IOSCO_GENERAL regime, nor do the passages indicate an overlap of obligations.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: EU_REVERSE_SOLICITATION (EU MiCA reverse-solicitation exemption — third-country firms may provide crypto-asset services without MiCA authorisation when EU client takes the initiative) and SG_PSA_DPT (Singapore PSA DPT-service licence). Whether a Singapore DPT-licensee serving EU clients can rely on the reverse-solicitation exemption turns on FACTS not pinned down in the regulations themselves: the firm's marketing reach, solicitation history, and channel of customer acquisition. ESMA's guidance treats this as a fact-specific inquiry that must be documented and may be challenged.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

However, to ensure market integrity and public trust, it is critical that all
single-labelled SCS meet the same regulatory requirements. As a result, we support the
MAS's proposal for single-labelled SCS, but only under the condition that non-banks would
be also subject the same regulatory requirements for their SCS issuance services. Moreover, we would recommend that MAS adopts the term "regulated stablecoins" as we
find that it reflects MAS's aspiration to develop a digital assets ecosystem by introducing a
robust regulatory framework for SCS. In parallel, we believe that it would be beneficial if
SCS issuers would be able to add on the single label of SCS, e.g. "regulated stablecoin -
Company A". This could help customers differentiate their SCS offerings, encourage
competition and consequently attract more issuers and contribute to the development of
the digital asset ecosystem. Question 5. MAS seeks comments on whether the proposed reserve asset requirements are
appropriate, and whether there may be unintended consequences that may affect the
development of Singapore's digital asset ecosystem.

We believe that a single label for bank and non-bank issued SCS is sufficient as the
purpose of the label is to highlight to customers that a given issuer is adequately
regulated and a single label serves that purpose. We believe the term 'regulated 15 August 2023 | 50
stablecoin' is likely the clearest option for the purpose of achieving the aforementioned
purpose. Perhaps 'locally regulated stablecoin' might also be applied to distinguish a
stablecoin regulated by MAS from stablecoins which are regulated elsewhere using
different standards. Question 5. MAS seeks comments on whether the proposed reserve asset requirements are
appropriate, and whether there may be unintended consequences that may affect the
development of Singapore's digital asset ecosystem. We believe that the proposed reserve asset requirements are appropriate, however
limiting the pegs to the Singaporean dollar and Group of Ten Currencies, seems short
sighted as it precludes SCS projects backed by other important currencies like CNH from
being regulated.

Explanation: The Basel Crypto regime (Regime A) focuses on capital requirements, risk-weighting exposures to financial institutions, and supervisory equivalence for securities firms and other entities (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The Singapore Stablecoin regime (Regime B) focuses on the issuance, reserve requirements, and regulatory perimeter of Single-Currency Stablecoins (SCS) under the Payment Services Act (chunk_ids 7c04f2a0bd85290a::45b::7c2f, 7c04f2a0bd85290a::40f::805d). The obligations in Regime A relate to the prudential treatment of bank exposures and capital adequacy, while Regime B addresses the consumer protection and market integrity of specific tokenized products. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they regulate distinct aspects of the financial system (banking capital vs. stablecoin issuance). Therefore, the regimes are non-conflicting.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The evidence for AU_APRA_CPS230 focuses on operational resilience, business continuity, and the management of service providers to ensure critical operations continue through disruptions (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for EU_AMLD6 (chunk_id 85307f9e2a040982::14a::134d) references a directive amending financial sector regulations regarding digital operational resilience. While both regimes address operational resilience, the specific obligations and contexts differ. AU_APRA_CPS230 mandates internal management of operational risks and service providers, whereas EU_AMLD6 appears to address broader digital resilience frameworks for the financial sector. There is no specific obligation in one regime that directly conflicts with a specific obligation in the other; rather, they regulate similar domains (operational resilience) with potentially complementary or distinct requirements.


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The EU regime (Regulation (EU) 2023/1113) imposes obligations on payment service providers to accompany transfers of funds with information on the payer and payee to ensure traceability for AML/CFT purposes (c0300673081f7232::279::1918). The Singapore regime (MAS Notice PSN02) establishes AML/CFT requirements for Digital Payment Token (DPT) service providers, requiring them to comply with MAS Notice PSN02 and Guidelines (018117ef1e757630::4b5::9ef5). The passages describe distinct regulatory frameworks for different jurisdictions (EU vs. Singapore) that apply to different asset classes (transfers of funds/crypto-assets vs. DPT services). There is no specific obligation in the EU regime that pushes against a specific obligation in the Singapore regime; rather, they are separate national implementations of AML/CFT standards. Therefore, the regimes are non-conflicting.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: EU_GDPR (cross-border data transfer principles) and INT_FATF_GENERAL (FATF AML/CFT general standards requiring customer-identification and cross-border information sharing). FATF Recommendation 16 (travel rule) and CBDR transmission requirements mandate sharing of personal data across borders; GDPR Chapter V restricts. Operationally resolvable via Art. 6(1)(c) and Chapter V mechanisms. Same conflict shape as EU TFR ↔ GDPR in the careful cohort.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU MICA Title IV EMT passages regulate the content and liability of crypto-asset white papers for issuers of e-money tokens and asset-referenced tokens (e.g., Article 51, Article 52, Recital 69). The SG PSA GENERAL passages discuss the regulatory scope of Payment Services licenses in Singapore, specifically regarding Digital Payment Token Services (DPT) and the licensing of entities like Binance (e.g., 'MAS seeks comments on the regulatory scope', 'MAS may wish to provide recognition for foreign SCS operating in SG'). The obligations in the EU regime relate to the disclosure of information in white papers, while the obligations in the SG regime relate to the licensing and supervision of entities providing DPT services. These are distinct regulatory domains; the EU rules do not impose obligations on Singaporean entities, nor do the SG rules impose obligations on EU issuers in a way that creates a conflict with the EU's internal requirements.


Notabene commend's the Monetary Authority of Singapore (MAS) for proposing a
comprehensive and detailed regulatory approach for Digital Token Service Providers
(DTSPs) under the Financial Services and Markets Act 2022. Our comments focus on
the alignment of these notices and guidelines with international standards,
particularly in light of Financial Action Task Force (FATF) Recommendations,
including the Travel Rule.

Explanation: SG_FSMA_DTSP (extraterritorial DTSP scope) and EU_AMLR_TFR (EU AML regulation and TFR for crypto-asset transfers). Whether an EU-licensed CASP also falls within SG DTSP scope when transmitting crypto value to SG counterparties depends on facts about the service-delivery channel and target market — fact-sensitive determination.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU_PSD2 passages regulate the technical authentication requirements for payment service providers, specifically defining 'strong customer authentication' and the use of 'personalised security credentials' (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The MAS_TRM passages discuss the application of principles-based guidelines to licensees, including the TRM Guidelines and Fit and Proper criteria, and do not contain any obligations regarding authentication methods or security credentials (chunk_id 20d526d712753652::401::f956). The regimes regulate distinct aspects of financial services—technical payment security standards versus general licensing and governance principles—resulting in no overlap of obligations.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

46 For information on ASIC's interpretation of this obligation, see ASIC PF 209 Australian financial services
licence conditions
Licensing digital asset intermediaries | 23

(vi) having the financial,47 technological, and human resources to carry out and supervise the
financial service covered by the AFSL,
(vii) having a dispute resolution system48 and compensation arrangements for retail clients for
loss or damage suffered due to breaches of obligations, and
(viii) maintaining a risk management system.
Financial requirements
(g) A platform provider must meet:
(i) the standard solvency and positive net asset requirements,49
(ii) the standard cash needs requirement, and
(iii) a net tangible assets (NTA) requirement for holding cash or cash equivalents and holding
liquid assets of at least:
• 0.5 per cent of the value of the facility (if using a sub-custodian digital asset facility that
has $5m NTA),50 or
• $5 million (if performing the custody function).
Info Box 6 Financial requirements
AFSL holders have obligations to meet 'financial requirements'. These requirements are typically
tailored for different financial products through ASIC legislative instruments. The NTA obligation is
to address the costs of orderly wind-up in the event the provider fails.51
A key issue with digital assets is concentration risk (see Info Box 11 Additional Standards for token
holders). The proposed financial requirements balance the need to avoid concentration of digital
assets among a small number of custodians with the need to ensure robust NTA. It sets the
required level of NTA at the greater of $5 million or 0.5% of the value of the assets held by the
facility.52 This arrangement ensures that as a facility expands, and the operational risk exposure of
the platform provider grows, the provider will maintain a corresponding level of financial
resources.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers (specifically platform providers and intermediaries) in Australia, focusing on financial product definitions, AFSL requirements, and financial obligations (chunk_ids 550958b067dc6726::41f::546c, 550958b067dc6726::74a::7ef1). The FATF_R16 regime regulates Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards globally, focusing on customer due diligence, digital identity, and red flag indicators for money laundering (chunk_ids 5d489619a0fb9ecf::377::a91e, 85240528438654b9::396::417b). The obligations in the AU_ASIC_AFSL passage relate to the operational and financial requirements of holding an Australian Financial Services Licence, while the FATF_R16 passages relate to the global AML/CFT framework and digital identity. These are distinct regulatory domains; the AU_ASIC_AFSL obligations do not impose specific AML/CFT requirements that conflict with the FATF R16 standards, nor do the FATF R16 standards impose specific financial licensing requirements that conflict with the AU_ASIC_AFSL regime. Therefore, the regimes are non-conflicting.


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_APRA_PRUDENTIAL passages describe APRA's regulatory framework for Australian financial institutions, including licensing, supervision, and prudential standards for banks, insurers, and superannuation entities (chunk 66d049e24f0863da::3f7::aec8). The EU_REVERSE_SOLICITATION passages describe the conditions under which third-country crypto-asset service providers can operate in the EU without authorisation, specifically focusing on 'reverse solicitation' where the client initiates the relationship (chunk 25cbbd878a1b21d3::4f8::561c). The obligations and regulated entities in the two regimes are distinct; APRA regulates Australian financial institutions, while the EU regime regulates third-country crypto-asset service providers targeting EU clients. There is no specific obligation in APRA's prudential framework that conflicts with the EU's reverse solicitation exemption for crypto-assets.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: The evidence from APRA CPS 230 focuses on operational risk management, resilience, and the management of service providers (chunk_ids f296a7e0bead93df::4a5::9828, f296a7e0bead93df::5e9::d5f4). The evidence from the EU AMLA Directive focuses on the institutional framework for anti-money laundering and countering the financing of terrorism (chunk_id df546f2364aaf9e2::25a::6ab3). The obligations in the AMLA regime relate to supervisory cooperation and information exchange regarding financial crime, whereas the APRA regime relates to the resilience of critical operations and internal risk management. These are distinct regulatory domains with no apparent overlap of obligations.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Explanation: The EU_NIS2 passage discusses the technical and methodological requirements for access control policies and ICT security measures (chunk 3c9eb3a25c93f394::474::4786). The FATF_R16 passage introduces the FATF as an inter-governmental body developing policies to protect the global financial system against money laundering and terrorist financing (chunk 5d489619a0fb9ecf::377::a91e). The regimes regulate distinct domains: EU_NIS2 focuses on cybersecurity and network resilience for operators of essential services, while FATF_R16 focuses on AML/CFT standards. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 230 operational-risk management standard and AU Treasury Digital Asset Platforms framework operate in disjoint regulatory domains at the obligation level. APRA prudential standard vs Treasury platform-regulation proposal — disjoint frames. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

Explanation: EU_AMLR_TFR (EU's AML framework extending AML/CFT to CASPs and mandating originator/beneficiary information for crypto transfers) and INT_FATF_VASP (FATF VASP guidance — AML/CFT standards for VAs and VASPs). The EU's TFR is the EU's binding implementation of FATF VASP/R16 standards; reinforcing relationship.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The regimes regulate distinct domains. Regime A (AU_ASIC_CRYPTO) governs the licensing and classification of crypto-assets and digital asset service providers under Australian financial services law (Corporations Act 2001). Regime B (INT_BASEL_CRYPTO) establishes prudential capital requirements and risk-weighting methodologies for banks' exposures to financial institutions. The evidence shows no specific obligation in the Basel framework that conflicts with ASIC's guidance on crypto-assets; rather, they address separate regulatory objectives—consumer protection and market integrity versus bank solvency and capital adequacy.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The evidence for the Australian regime (AU_ATO_CRYPTO) focuses on the taxation of crypto assets and the token mapping process (chunk_id e6bb47e92e88e16c::567::36c4). The evidence for the European regime (EU_EMD2) concerns digital operational resilience for the financial sector (chunk_id 85307f9e2a040982::14a::134d). The obligations and subject matter of the two regimes are distinct; one regulates tax treatment and ecosystem mapping, while the other regulates operational resilience in the financial sector. Therefore, there is no overlap of obligations or conflict between the two.