means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

'@ Australian Government Cee ee
ahem 8 eporting Home / Business / Core guidance / Reporting As a reporting entity you must report certain transactions and suspicious matters, and
submit compliance reports to AUSTRAC. Everyone, including reporting entities, must
report cross-border movements of physical currency. Ongoing reporting obligations Threshold transaction reports You must submit threshold transaction reports (TTR) for transfers of A$10,000 or more
in cash (or the foreign currency equivalent). TTRs are due within 10 business days after
the date of the transaction. International funds transfer instruction reports (IFTIs) You must submit international funds transfer instruction reports (IFTIs) for transfers of
funds of any value into or out of Australia, made either electronically or under a
designated remittance arrangement. IFTIs are due within 10 business days after the
transfer instruction is sent or received. Suspicious matter reports (SMRs) You must submit suspicious matter reports (SMRs) when you have a suspicion that a
customer or transaction is related to criminal activity.

Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Note: Where a reporting entity is unable to ascertain whether the circumstances in
19.3(17)(a) applies, the reporting entity can assume that the transaction was
carried out by the customer.
19.4 If the threshold transaction arises under a designated service that is of a kind
described in item 3 of table 1 in subsection 6(2) of the AML/CTF Act, the
reference to 'customer' in subparagraphs 19.3(2) to 19.3(14) inclusive will
be taken, in the first instance, to refer only to the holder of the account and
the signatory (if any) conducting the transaction in relation to the account,
provided that:
(1) if there are other signatories to the account, the AUSTRAC CEO may
require the reporting entity to give to the AUSTRAC CEO, in the
form of a supplement to the subsection 43(2)

Explanation: AU_AML_CTF (AUSTRAC-issuing-body view) and AU_FEDREG_AML (FederalRegister-issuing-body view) are two registry-level facets of the *same* Australian AML/CTF regime — the AML/CTF Act 2006, AML/CTF Rules and AUSTRAC operational guidance. They are split in the regime registry because the chunked corpus stores them under different issuing-body directories (AUSTRAC operational guidance vs FederalRegister statutory instruments), not because they are different regimes. No conflict is possible — they are literally the same regime. Trivial hard negative; included to give the trainer an intra-regime alignment example.

AUSTRAC guidance contradicted the binding Act/Rules — pure operational risk, not a regime-level conflict.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

For further information about
these obligations, please go to http://www.oaic.gov.au or call 1300 363 992. Anti-Money Laundering and Counter-Terrorism Financing 221
Rules Instrument 2007 (No. 1) Reporting obligations of registered remittance affiliates CHAPTER 54
CHAPTER 54 Reporting obligations of registered
remittance affiliates
54.1 These Anti-Money Laundering and Counter-Terrorism Financing Rules
(Rules) are made under section 229 of the Anti-Money Laundering and
Counter-Terrorism Financing Act 2006 (AML/CTF Act) for the purpose of
subsections 49A(1) and 49A(2) of that Act and in reliance on section 4 of the
Acts Interpretation Act 1901. These Rules come into effect on the date that
section 49A comes into effect.
54.2 An obligation imposed by subsection 43(2) or 45(2) of the AML/CTF Act
upon a registered remittance affiliate of a registered remittance network
provider to give a report to the AUSTRAC CEO is taken instead to be an
obligation imposed upon, and must be discharged by, the registered
remittance network provider.
54.3 If a suspicious matter reporting obligation imposed by subsection 41(1) of
the AML/CTF Act upon a registered remittance affiliate of a registered
remittance network provider arises, that obligation may be met by the
registered remittance network provider under a written agreement in place
between the registered remittance affiliate and the registered remittance
network provider.

Part 8.9 Reporting obligations
8.9.1 Part A of a reporting entity's AML/CTF program must include:
(1) the obligations that apply to the reporting entity under sections 41, 43,
45 and 47 of the AML/CTF Act (reporting obligations); and
(2) appropriate systems and controls of the reporting entity designed to
ensure compliance with the reporting obligations of the reporting
entity; and
(3) the obligations that apply to the reporting entity under section 51F of
the AML/CTF Act and Chapter 64 of the AML/CTF Rules; and
(4) where the reporting entity is a remittance dealer, the obligations that
apply to the remittance dealer under section 75M of the AML/CTF Act
(as applicable) to advise:
(a) the AUSTRAC CEO of material changes in circumstances and
other specified circumstances under subsections 75M(1) and
75M(3) of the AML/CTF Act; or
(b) the registered remittance network provider of material changes in
circumstances and other specified circumstances under
subsection 75M(2) of the AML/CTF Act.

AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Explanation: AU_AML_CTF (Australia's AML/CTF Act 2006 — primary statute) and AU_FEDREG_AML (Federal Register hosting of the AML/CTF Rules 2007 and related instruments). These are the same domestic AU AML/CTF framework accessed through different layers (Act vs Rules); they operate together and reinforce each other within Australia's coordinated AML architecture. Aligned by design.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The evidence from the Australian Tax Office (AU_ATO_CRYPTO) passage focuses on the tax treatment and adoption of crypto assets in Australia (chunk_id e6bb47e92e88e16c::567::36c4). The evidence from the Monetary Authority of Singapore (SG_MAS_AML_GENERAL) passage discusses the transitional exemption for Digital Payment Token (DPT) service providers operating under the Payment Services Act (chunk_id 321e082bdbe732d3::309::b080). The obligations described in the Australian passage relate to taxation and reporting, while the obligations in the Singaporean passage relate to licensing and regulatory exemptions for payment services. These are distinct regulatory domains with no apparent overlap of obligations that would create a conflict.


2 APRA's prudential framework comprises prudential standards and prudential practice guides (PPGs). APRA is
empowered to issue legally binding prudential standards that set out specific requirements with which APRA-regulated
institutions - authorised deposit-taking institutions (ADIs), general insurers and life companies (collectively,
insurers) and registrable superannuation entity licensees (RSE licensees) - must comply. APRA also issues PPGs,
which clarify APRA's expectations with regard to prudential matters. PPGs frequently discuss legal requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements.

Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: The evidence for APRA focuses on prudential standards, capital requirements, and supervisory frameworks for financial institutions (chunk 9a96d4d1812f257a::2a6::2422). The evidence for MAR focuses on market abuse, insider dealing, and market manipulation (chunk 5cc4a27bc578287a::165::3333). The obligations described in the APRA passage relate to the solvency and stability of regulated institutions, while the obligations in the MAR passage relate to the integrity of financial markets and investor protection. These are distinct regulatory domains with no apparent overlap of specific obligations.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

Explanation: The evidence for Regime A (AU_APRA_CPS230) focuses on operational risk management, business continuity, and service provider management within the Australian financial sector. The evidence for Regime B (EU_EMD2) refers to the 'Digital Operational Resilience for the financial sector' and amending regulations, but the provided chunks do not contain specific operational obligations or requirements. Without specific obligations in Regime B that contradict or impose conflicting requirements on the topics covered in Regime A (such as BCPs or service provider management), the regimes do not conflict. The evidence suggests they address similar domains (operational resilience) but the specific obligations are not grounded in the provided text for Regime B.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The EU MIFID2 passages regulate the conduct of investment firms regarding product governance, suitability assessments, and client communication (e.g., Article 24 and 25). The SG_AML passages regulate AML/CFT compliance, specifically requiring training for officers and employees on AML/CFT laws and CDD measures (Clause 13.14). The obligations in MIFID2 relate to the suitability of financial instruments and the fair presentation of information to clients, whereas the obligations in SG_AML relate to the prevention of money laundering and terrorism financing. These are distinct regulatory domains; the SG AML requirements do not impose specific obligations on the suitability of financial instruments or the disclosure of investment advice independence that would conflict with MIFID2. Therefore, the regimes are non-conflicting.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: AU_TTR_THRESHOLD (AUSTRAC threshold-transaction reports of AUD 10,000+ — mandatory AML data disclosure by AU reporting entities) and SG_PDPA (Singapore Personal Data Protection Act restricting collection/disclosure of personal data without consent or statutory authorisation). When an AU reporting entity has SG-resident customers and submits TTR data to AUSTRAC, the cross-border movement of that personal data engages PDPA restrictions on the SG side. Operationally resolvable via PDPA s.13(b) ('required or authorised under any other written law') for AML compliance. Severity low because the overlap is narrow (most TTRs concern AU residents) and the resolution path is established.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

Explanation: The EU MiCA RTS passages focus on the notification requirements for financial entities providing crypto-asset services and the detailed content of information for assessing acquisitions of qualifying holdings in CASPs (c51ad46265cea4e5::2f5::4513, c51ad46265cea4e5::361::e378). The FATF R16 passages focus on global anti-money laundering (AML) and counter-terrorist financing (CFT) standards, specifically guidance on digital identity and red flag indicators for virtual assets (5d489619a0fb9ecf::377::a91e, d758cb6128239f36::429::2caa). The obligations in MiCA regarding market conduct and licensing do not directly contradict the FATF's AML/CFT risk-based approach obligations; rather, they operate in complementary domains where MiCA establishes the regulatory perimeter for crypto-asset service providers and FATF provides the global AML/CFT framework for them.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: The evidence from APRA (chunk 9a96d4d1812f257a::2a6::2422) describes a prudential framework for traditional financial institutions (ADIs, insurers, RSE licensees) that focuses on capital requirements, licensing, and supervision. The evidence from MiCA (chunk c51ad46265cea4e5::147::6214) establishes a legal framework for crypto-asset service providers (CASPs) requiring authorisation. The obligations and regulated entities are distinct; APRA regulates traditional financial institutions, while MiCA regulates crypto-asset service providers. There is no evidence of a specific obligation in APRA's regime conflicting with MiCA's obligations regarding crypto-asset services.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

(89) Provision of payment services by the payment services providers may entail processing of personal data. Directive
95/46/EC of the European Parliament and of the Council ( 1) , the national rules which transpose Directive 95/46/EC
and Regulation (EC) No 45/2001 of the European Parliament and of the Council ( 2 ) are applicable to the
processing of personal data for the purposes of this Directive. In particular, where personal data is processed
for the purposes of this Directive, the precise purpose should be specified, the relevant legal basis referred to, the
relevant security requirements laid down in Directive 95/46/EC complied with, and the principles of necessity,
proportionality, purpose limitation and proportionate data retention period respected. Also, data protection by
design and data protection by default should be embedded in all data processing systems developed and used
within the framework of this Directive.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU GDPR passages discuss the legal basis for processing, purpose limitation, and security requirements for personal data (chunk_ids bd84e63f5b622b73::6a8::d132, adb1a81b9cecaf8c::3ac::b555). The SG MAS passages discuss the 'same activities, same risk, same regulation' principle and risk-based capital frameworks for Stablecoin Issuers (SCS) and payment service providers (chunk_id 7c04f2a0bd85290a::449::02f2). The SG MAS text explicitly references the Payment Services Act and capital requirements, which are distinct from the data protection obligations described in the EU GDPR passages. There is no specific obligation in the SG MAS text that conflicts with the data protection obligations in the EU GDPR text; rather, the SG MAS text focuses on prudential and capital standards for cryptoasset exposures.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The evidence for Regime A (AU_APRA_CPS234) focuses on APRA's Prudential Practice Guides, specifically CPG 230 (Operational Risk Management) and CPG 234 (Information Security), which provide guidance and views on sound practice for APRA-regulated entities. The evidence for Regime B (EU_EMD2) cites Directive (EU) 2022/2556 regarding digital operational resilience for the financial sector. While both regimes address operational resilience and risk management, the specific obligations and regulatory frameworks are distinct. The passages provided do not contain specific obligations in Regime A that directly conflict with specific obligations in Regime B; rather, they describe separate regulatory domains (Australian prudential practice vs. EU digital operational resilience directives).


Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: SG_MAS_AML_GENERAL and SG_PSA_DPT are both MAS frameworks for AML/CFT supervision of DPT/payment-service providers in Singapore — PSN02 is the AML notice issued under the PSA, and the broader MAS AML framework operates alongside it. They reinforce each other within Singapore's coordinated regulatory architecture.


One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client communication (e.g., Article 1 and Article 25). The MAS TRM passages regulate the conduct of licensees under the Financial Services and Markets Act 2022, focusing on principles-based guidelines, risk assessments, and the application of the Fit and Proper (F&P) Guidelines. The obligations in MIFID2 regarding client suitability and information disclosure do not directly oppose the MAS TRM obligations regarding internal processes and risk assessments. The regimes regulate distinct aspects of financial services conduct, and there is no evidence of a specific obligation in one regime that creates an unavoidable conflict with a specific obligation in the other.


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 234 information security standard and ASIC's crypto-asset INFO 225 / RG 282 guidance operate in disjoint regulatory domains at the obligation level. Information security standard vs market-conduct crypto guidance — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Explanation: SG_AML (MAS Notice 314 AML/CFT framework for life insurers) and SG_MAS_AML_GENERAL (MAS's broader AML/CFT supervisory framework — FSM Sanctions Regulations and SFA04-N02). Both are parts of MAS's coordinated AML/CFT architecture in Singapore.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU regime regulates the solicitation of clients by third-country crypto-asset service providers (specifically prohibiting solicitation in the EU). The Singapore regime discusses the regulatory scope of securities custody services (SCS) and the potential for extending regulatory powers to foreign SCS, noting that extending powers may be better achieved through existing regulatory cooperation agreements. The passages describe distinct regulatory topics (solicitation vs. custody service scope) and do not impose conflicting obligations on the same activity. Therefore, the regimes are in different domains.


CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

MAS seeks comments on the proposed duties of the CEO, directors, and partners
of the licensee. MAS also seeks comments on the audit requirements.
[Confidential]. Question 4. General comments. If you have comments on the measures proposed in parts 5-8,
please set them out in response to this question.
[Confidential]. Question 5. Existing Customers. MAS seeks comments on the requirements for existing
customers that were onboarded by the licensee prior to obtaining its licence. (Please refer to paragraph 6.54 and 6.55 of the draft FSM Notice).
[Confidential]. Question 6. Reliance on Third Party. MAS seeks comments on whether third party reliance is
appropriate for the sector. (Please refer to paragraph 12 of the draft FSM Notice). We do not have further comments. 30 May 2025 | 46
Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices.
[Confidential].

Explanation: The evidence from AU_ASIC_CRYPTO focuses on the classification of digital assets as financial products and the licensing requirements for financial services providers under the Corporations Act (e.g., INFO 225, AFS licences). The evidence from SG_MAS_AML_GENERAL focuses on Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations, specifically regarding the licensing of Digital Payment Token (DPT) service providers and the duties of CEOs and directors. The two regimes regulate distinct aspects of the digital asset ecosystem: one focuses on the financial product classification and licensing of financial services, while the other focuses on AML/CFT compliance and the licensing of payment service providers. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

18 The website address as at 30 June 2025: https://www.police.gov.sg/Advisories/Crime/Commercial-Crimes/Suspicious-
Transaction-Reporting-Office

Explanation: The evidence from Regime A (AU_AML_CTF) outlines obligations for reporting suspicious matters and threshold transactions to the AUSTRAC CEO (chunk 254ca2d92d196180::2ac::a5fe). The evidence from Regime B (SG_PSA_GENERAL) provides a website address for the Suspicious Transaction Reporting Office in Singapore (chunk 7e0886f59d1e36f5::90::5a8f). The obligations in Regime A relate to Australian AML/CTF reporting requirements, while the evidence in Regime B is a reference to a Singaporean reporting body. The regimes regulate different jurisdictions and reporting channels, resulting in no overlap of obligations.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1 and Article 25). The INT_FATF_VASP passages define the scope of Virtual Asset Service Providers (VASPs) and AML/CFT obligations, noting that countries may extend their regimes beyond the minimum FATF standard and that existing licensed financial institutions performing VASP activities are already subject to FATF obligations. The regimes regulate distinct domains: MIFID2 governs investment services and conduct, while FATF governs AML/CFT and the definition of VASPs. There is no evidence of a specific obligation in MIFID2 that conflicts with a specific obligation in FATF; rather, the FATF guidance explicitly acknowledges that licensed financial institutions performing VASP activities are already subject to the full range of applicable obligations under the FATF Recommendations.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

Explanation: The EU MICA Title IV EMT regime regulates the disclosure obligations of issuers of e-money tokens and asset-referenced tokens, including the content of crypto-asset white papers and notification requirements to competent authorities (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The INT FATF General regime provides high-level guidance on anti-money laundering and counter-terrorist financing (AML/CFT) risk assessment principles and the general framework for international standards (chunk_id fe52dd87e13dba41::261::59a4). The obligations in MICA relate to financial product disclosure and issuer liability, whereas FATF guidance relates to national risk assessment and AML/CFT policy. There is no specific obligation in the FATF regime that directly conflicts with or imposes a specific operational burden on the disclosure or liability obligations outlined in MICA. Therefore, the regimes regulate different domains and do not conflict.


5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The SG_MAS_OUTSOURCING regime focuses on the governance and supervision of third-party service providers, specifically requiring institutions to ensure MAS can access information and documents from overseas providers (chunk_id a82833dc0f7ca903::5f1::735d). The SG_PSA_DPT regime focuses on the licensing and AML/CFT obligations of entities providing digital payment token services (chunk_id 4b4c3c417dc293ba::185::f41d). The obligations in the outsourcing guidelines regarding information access and supervision are complementary to the licensing and regulatory oversight described in the DPT notice, rather than conflicting. The passages do not describe opposing rules or a lack of compliant path; instead, they address different aspects of the regulatory framework (governance vs. licensing/AML).


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Binance is supportive of the redemption-related requirements. In general, five business
days should be sufficient to return the par value of the SCS to customers. However, given
that this is ultimately dependent on the availability of the relevant banking services,
Binance would propose that this is aligned to the prevailing turnaround time provided by
the financial institution that the reserve assets are held with. Question 7. MAS seeks comments on whether the prudential requirements outlined in paragraph
4.21 are risk proportionate. MAS welcomes suggestions on alternative approaches to
address the risks. Binance is supportive of the prudential requirements outlined in paragraph 4.21. 15 August 2023 | 23
Question 10. MAS seeks comments on whether the scenario outlined in paragraph 4.22 is a likely
development and whether the approaches outlined in paragraph 4.24 are feasible. MAS
welcomes suggestions on other approaches to address this issue. As per Q1, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction.

Explanation: The EU regime (Regime A) focuses on anti-money laundering (AML) obligations for crypto-asset service providers, specifically requiring them to accompany transfers of funds and crypto-assets with information on the payer and payee to ensure traceability for AML/CFT purposes (chunk_id=c0300673081f7232::279::1918). The Singapore regime (Regime B) focuses on prudential treatment and capital requirements for stablecoin issuers and related entities, aiming to ensure market stability and consumer protection through a risk-based framework (chunk_id=7c04f2a0bd85290a::46d::fd1b). The obligations are distinct: one is a compliance/AML requirement, and the other is a financial stability/prudential requirement. There is no evidence in the provided passages of a specific obligation in one regime pushing against a specific obligation in the other; rather, they regulate different aspects of the crypto-asset ecosystem.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The FATF passages discuss global AML/CFT standards and guidance for Virtual Asset Service Providers (VASPs), specifically regarding digital identity and red flag indicators (chunk 85240528438654b9::396::417b). The MAS passages focus on Singapore's domestic prudential framework for cryptoassets, including capital requirements and stablecoin issuers (chunk 7c04f2a0bd85290a::449::02f2). The obligations are distinct: FATF sets international AML/CFT standards, while MAS sets domestic prudential standards. There is no specific obligation in FATF that pushes against a specific obligation in MAS; rather, they regulate different aspects of the crypto ecosystem (compliance vs. capital adequacy).


Explanation: The EU MICA Title IV EMT passages regulate the content and liability of crypto-asset white papers for issuers of e-money tokens (e.g., Article 51 notification requirements and Article 52 liability for misleading information). The SG MAS Outsourcing passages regulate the conduct of outsourcing arrangements with service providers, specifically regarding information access and supervision (e.g., Clause 5.10.2). The obligations in the EU regime relate to the transparency of the token offering and issuer liability, while the obligations in the SG regime relate to the operational management of third-party service providers. These are distinct regulatory domains; the EU obligations do not impose specific requirements on the SG outsourcing conduct of a service provider, nor do the SG outsourcing requirements impose specific content obligations on the crypto-asset white paper. Therefore, the regimes do not conflict.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: AU_APRA_CPS230 (APRA Prudential Standard CPS 230 — Operational Risk Management) and MAS_TRM (MAS Technology Risk Management Guidelines). Both implement operational-resilience / technology-risk frameworks for regulated financial institutions in their jurisdictions. Reinforcing concerns.


13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The evidence for AU_APRA_CPS230 focuses on operational resilience, business continuity, and the management of service providers to ensure critical operations continue through disruptions (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for SG_AML focuses on training officers and employees on AML/CFT laws, suspicious transaction reporting, and internal policies (chunk_id 3d521e61e49aaf46::38f::e615). These obligations regulate distinct aspects of an entity's operations: one ensures resilience against operational disruptions, while the other ensures compliance with financial crime prevention laws. There is no specific obligation in CPS 230 that conflicts with the AML training requirements in MAS Notice 314.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Explanation: The EU DAC8 regime focuses on the automatic exchange of tax information between Member States and non-Union jurisdictions (e.g., Singapore) regarding crypto-asset users (Recital 19, chunk_id c0300673081f7232::320::7b46). In contrast, the Singapore PSA DPT regime (MAS Notice PSN02) regulates the licensing and Anti-Money Laundering/Counter-Terrorism Financing (AML/CFT) obligations of Digital Payment Token service providers operating in Singapore (Clause 1.1, chunk_id 4b4c3c417dc293ba::185::f41d). The obligations in DAC8 are administrative and tax-reporting in nature, whereas the obligations in PSA DPT are regulatory and compliance-focused for service providers. The regimes regulate different aspects of the crypto-asset ecosystem (tax reporting vs. licensing and AML/CFT controls) and do not impose conflicting obligations on the same specific action.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: SG_FSMA_DTSP (Singapore DTSP licensing under FSM Act — extraterritorial reach on persons providing digital-token services 'in or from Singapore') and AU_AML_CTF (Australian AML/CTF Act — reporting-entity perimeter for businesses providing designated services). Whether an AU-based entity falls within SG DTSP extraterritorial scope turns on FACTS about the entity's place of operation, customer base, and service delivery channels — not resolvable from the rules alone. The two regimes can both apply or only one, depending on those facts.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: The evidence for AU_ATO_CRYPTO focuses on token mapping, tax compliance, and specific regulatory guidance for superannuation and construction contracts (chunk_ids e6bb47e92e88e16c::567::36c4, bab9bcdb09e99b2d::34b::a4e6, bab9bcdb09e99b2d::40b::de13). The evidence for INT_FATF_GENERAL outlines general principles for assessing money laundering and terrorist financing risks at the national level (chunk_ids fe52dd87e13dba41::261::59a4, 75b61beed88910f9::4ad::debc). The passages describe distinct regulatory domains: one focuses on Australian tax and crypto asset regulation, while the other provides international standards for AML/CFT risk assessment. There is no specific obligation in the AU_ATO_CRYPTO passages that conflicts with the general principles in the INT_FATF_GENERAL passages.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

Explanation: Regime A (AU_APRA_CPS234) is a Prudential Practice Guide regarding Operational Risk Management and Information Security for APRA-regulated entities. Regime B (SG_FSMA_DTSP) is a set of guidelines and consultation responses regarding the licensing and regulation of Digital Token Service Providers under the Singapore Financial Services and Markets Act. The obligations in Regime A relate to internal prudential risk management and information security standards for financial institutions. The obligations in Regime B relate to the licensing, conduct, and AML/CFT compliance of digital token service providers. The two regimes regulate distinct domains (general prudential risk management vs. specific digital token sector licensing and conduct), and there is no specific obligation in Regime A that conflicts with a specific obligation in Regime B.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access controls and ICT security measures (chunk 3c9eb3a25c93f394::474::4786). The SG_FSMA_DTSP passage outlines the licensing requirements and definitions for Digital Token Service Providers (DTSPs) under the FSM Act, including the requirement to hold a licence to conduct digital token services in Singapore (chunk cc1be49e9cf8c821::2f4::ea8f). The obligations in the SG regime relate to licensing and operational conduct for service providers, while the EU regime focuses on the technical security standards for access controls. These are distinct regulatory domains; the SG licensing requirements do not impose specific technical access control mandates that conflict with the EU's general framework for ICT security standards.


'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: Regime A (AU_TTR_THRESHOLD) regulates the reporting of physical cash transfers exceeding A$10,000 to AUSTRAC. Regime B (SG_PSA_DPT) regulates the licensing and AML/CFT obligations of entities providing Digital Payment Token (DPT) services in Singapore. The obligations in Regime A relate to physical currency reporting thresholds, while Regime B focuses on the licensing and supervision of digital asset service providers. The passages confirm that these regimes govern distinct transaction types (physical cash vs. digital tokens) and distinct regulatory domains (AUSTRAC reporting vs. MAS licensing), with no evidence of a direct obligation clash between the two.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): AUSTRAC AML/CTF operational guidance and AUSTRAC TTR $10k cash threshold reporting are designed to coexist — obligations apply cumulatively without collision. The TTR regime is a specific reporting duty within the broader AUSTRAC AML/CTF framework — same regime, different granularity. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Binance is supportive of the redemption-related requirements. In general, five business
days should be sufficient to return the par value of the SCS to customers. However, given
that this is ultimately dependent on the availability of the relevant banking services,
Binance would propose that this is aligned to the prevailing turnaround time provided by
the financial institution that the reserve assets are held with. Question 7. MAS seeks comments on whether the prudential requirements outlined in paragraph
4.21 are risk proportionate. MAS welcomes suggestions on alternative approaches to
address the risks. Binance is supportive of the prudential requirements outlined in paragraph 4.21. 15 August 2023 | 23
Question 10. MAS seeks comments on whether the scenario outlined in paragraph 4.22 is a likely
development and whether the approaches outlined in paragraph 4.24 are feasible. MAS
welcomes suggestions on other approaches to address this issue. As per Q1, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: AU_APRA_CPS230 (APRA Prudential Standard CPS 230 — Operational Risk Management for AU-regulated entities) and SG_MAS_PRUDENTIAL_CRYPTO (MAS's risk-based capital framework for SCS issuers). Both prudential frameworks but addressing different specific concerns — CPS 230 is operational-risk and service-provider management; SG's SCS framework is capital adequacy for stablecoin issuers. Different jurisdictions and mechanisms; no direct obligation conflict.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: The EU PSD2 passages regulate the technical security of payment transactions, specifically mandating strong customer authentication (SCA) and the protection of personalised security credentials (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The INT_FATF_VASP passages regulate the AML/CFT obligations of Virtual Asset Service Providers (VASPs) and clarify that countries may extend their regimes beyond the FATF minimum standard (chunk_ids 85240528438654b9::1cd::07d7, ba862e1f095bceac::1a6::1f0e). The regimes regulate distinct domains: one focuses on the technical authentication of payment initiation and security credentials, while the other focuses on the regulatory licensing and AML/CFT obligations of entities providing services for virtual assets. There is no evidence of a specific obligation in PSD2 that directly conflicts with a specific obligation in FATF regarding VASPs.