(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The EU DAC8 regime regulates the automatic exchange of tax information regarding crypto-asset users between Member States and non-Union jurisdictions (c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The SG_PSA_GENERAL regime regulates the licensing and conduct of business for digital payment token service providers in Singapore (321e082bdbe732d3::309::b080). The obligations in DAC8 relate to tax reporting and administrative cooperation, while the obligations in SG_PSA_GENERAL relate to financial services licensing and operational conduct. There is no specific obligation in SG_PSA_GENERAL that pushes against a specific obligation in DAC8, nor is there evidence of a direct regulatory conflict between the two regimes.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: The evidence from Regime A (AU_FEDREG_AML) focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, specifically regarding reporting entities, customer identification, and suspicious transaction reporting (chunk cf7cefacba3f94bc::49a::f39e). The evidence from Regime B (INT_BASEL_CRYPTO) focuses on capital requirements and prudential standards for banks, defining bank exposures and risk-weighting methodologies (chunk 32afd37cade34f84::3a4::1a5b). The obligations in Regime A relate to financial crime prevention and customer due diligence, while the obligations in Regime B relate to banking stability and capital adequacy. These are distinct regulatory domains that do not impose conflicting obligations on the same activity.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

(83) Essential and important entities should ensure the security of the network and information systems which they use
in their activities. Those systems are primarily private network and information systems managed by the essential
and important entities' internal IT staff or the security of which has been outsourced. The cybersecurity risk-
management measures and reporting obligations laid down in this Directive should apply to the relevant essential
and important entities regardless of whether those entities maintain their network and information systems
internally or outsource the maintenance thereof.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU DAC 8 crypto-asset tax-reporting directive and EU NIS 2 horizontal cybersecurity directive operate in disjoint regulatory domains at the obligation level. Crypto-tax reporting vs cybersecurity directive — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU DAC8 regime focuses on tax transparency and administrative cooperation regarding crypto-asset reporting to tax authorities (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The INT IOSCO GENERAL regime focuses on securities regulation, market integrity, and disclosure standards for issuers and securities markets (chunk_id f173909614befd49::455::1a1a). The obligations in DAC8 relate to tax information exchange, while IOSCO's obligations relate to securities market conduct and disclosure. These are distinct regulatory domains with no apparent overlap of obligations.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: The AU Travel Rule passages describe a regulatory gap where Australia has not yet implemented the FATF Travel Rule for digital currency exchanges, noting that the rule would require identifying parties in transactions (chunk_ids cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). The SG AML passages, specifically the infographic on Digital Payment Token Service Providers, state that MAS' AML/CFT requirements and expectations for the DPT sector include key considerations relating to value transfer (chunk_id 018117ef1e757630::428::d321). The SG regime addresses the operational implementation of AML/CFT controls for DPTs, whereas the AU regime discusses the status of implementing the Travel Rule. The regimes are not in conflict; they address different aspects of the same regulatory landscape (implementation status vs. operational requirements).


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The obligations in Prudential Standard CPS 230 (Regime A) focus on operational resilience, business continuity, and the management of service providers to ensure an APRA-regulated entity can maintain critical operations through disruptions. In contrast, the FATF passages (Regime B) address Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards, specifically regarding digital identity and virtual assets. The specific obligations in CPS 230 regarding operational risk and resilience do not impose conflicting requirements on the AML/CFT obligations outlined in the FATF guidance. The regimes regulate distinct domains—prudential resilience versus financial crime prevention—resulting in no operational friction.


15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a) it involves the payer withdrawing cash from the payer's own payment account;
(b) it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member
State;
(c) both the payer and the payee are payment service providers acting on their own behalf;
(d) it is carried out through cheque images exchanges, including truncated cheques. This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a) both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b) the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-
asset service provider. Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-
assets under this Regulation.

Explanation: The evidence for Regime A (AU_APRA_CPS230) focuses on operational resilience, business continuity, and the management of service providers to ensure critical operations continue through disruptions (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for Regime B (EU_AMLR_TFR) addresses the scope of anti-money laundering obligations regarding the transfer of funds and crypto-assets, specifically excluding certain transfers like those between crypto-asset service providers acting on their own behalf (chunk_id d7502c011527b67c::3e7::ae26). The obligations in Regime A relate to the continuity and resilience of operations, while Regime B relates to the traceability and compliance of financial transactions. These are distinct regulatory domains with no specific obligation in one regime pushing against a specific obligation in the other.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The evidence from Regime A (AU_CORPS_ACT) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up (chunk 0fc4f857c226f510::375::66b5). The evidence from Regime B (SG_PSA_DPT) concerns the issuance of a Monetary Authority of Singapore Notice regarding AML/CFT obligations for holders of payment service licences providing digital payment token services (chunk 4b4c3c417dc293ba::185::f41d). The obligations and regulatory frameworks described in the two passages address distinct subject matters—corporate governance and charity regulation versus financial services licensing and AML compliance—and do not impose conflicting requirements on the same entity or transaction type.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The evidence for the Australian regime (Regime A) focuses on the requirement for a platform provider to hold an Australian Financial Services Licence (AFSL) to issue and deal in digital asset facilities, and the specific financial requirements (e.g., NTA) associated with that licence. The evidence for the Singapore regime (Regime B) discusses the definition of 'safeguarding institution' and the nature of a Payment Services (PS) license, specifically whether it is a blanket license for all digital payment token services or specific to certain activities. The obligations in Regime A (holding an AFSL and meeting financial requirements) do not directly oppose the obligations or scope definitions in Regime B (PS license types and safeguarding definitions). The regimes regulate the licensing and conduct of digital asset intermediaries in their respective jurisdictions, but the specific obligations cited do not create a conflict.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: INT_BASEL_CRYPTO (Basel prudential treatment of crypto exposures by banks) and INT_FATF_GENERAL (FATF AML/CFT general standards). Both are international standards bodies that develop coordinated frameworks for global financial regulation — Basel on prudential and FATF on AML. They are structurally complementary pillars of international financial regulation; the cited passages confirm distinct but coordinated concerns.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules — AUSTRAC reporting entity framework) and EU_AMLR_TFR (EU's AMLR + TFR framework — Regulation 2023/1113). Both jurisdictions implement comparable AML/CFT obligations on regulated entities consistent with FATF standards. Entities operating across both face complementary (not contradictory) duties. The cited B passage notes specific scope exclusions in the EU TFR that are jurisdiction-specific but don't conflict with the AU framework.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

SECTION III
DUE DILIGENCE PROCEDURES
A Crypto-Asset User is treated as a Reportable User beginning as of the date when it is identified as such pursuant to the due
diligence procedures described in this Section. A. Due diligence procedures for Individual Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Individual Crypto-Asset User is a
Reportable User.
1. When establishing the relationship with the Individual Crypto-Asset User, or with respect to Pre-existing Individual
Crypto-Asset Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-certification
that allows the Reporting Crypto-Asset Service Provider to determine the Individual Crypto-Asset User's residence(s)
for tax purposes and confirm the reasonableness of such self-certification based on the information obtained by the
Reporting Crypto-Asset Service Provider, including any documentation collected pursuant to Customer Due
Diligence Procedures.
2. If at any point there is a change of circumstances with respect to an Individual Crypto-Asset User that causes the
Reporting Crypto-Asset Service Provider to know, or have reason to know, that the original self-certification is
incorrect or unreliable, the Reporting Crypto-Asset Service Provider cannot rely on the original self-certification
and shall obtain a valid self-certification, or a reasonable explanation and, where appropriate, documentation
supporting the validity of the original self-certification.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 46
Transfers subject to appropriate safeguards
1. In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a
third country or an international organisation only if the controller or processor has provided appropriate safeguards,
and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authoris
ation from a supervisory authority, by:
(a) a legally binding and enforceable instrument between public authorities or bodies;
(b) binding corporate rules in accordance with Article 47;
(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred
to in Article 93(2);
(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to
the examination procedure referred to in Article 93(2);
(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the
controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects'
rights; or
(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of
the controller or processor in the third country to apply the appropriate safeguards, including as regards data
subjects' rights.
3.

Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Explanation: DAC8 imposes ongoing reporting and due-diligence obligations on Reporting Crypto-Asset Service Providers (Annex III): collection and exchange of identifying personal information on Reportable Users — both individuals and entity controlling persons — and onward administrative exchange between Member State tax authorities (and, under Recital 19, to non-Union jurisdictions in defined cases). GDPR Articles 5(1)(b)-(c) and 44-49 push toward data minimisation, purpose limitation and tight controls on third-country transfers. The lawful-basis question is resolved (Article 6(1)(c) — legal obligation), so this is not structural_unresolved; but the cost recurs every reporting cycle as new personal data is collected and transmitted. Practitioners must continuously calibrate retention windows, data-protection-by-design for the reporting infrastructure, and transfer-impact assessments when administrative cooperation reaches non-EEA jurisdictions.

Operate DAC8 reporting on Art. 6(1)(c) (legal obligation) as the lawful basis; document Art. 5(1)(e) retention windows tied to the DAC8 retention requirement.

For onward transfer to non-Union jurisdictions, rely on Art. 96 (administrative cooperation under Union law) or Art. 49 derogations as appropriate.

Reporting CASP is established in or operates a Branch in a Member State.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: FATF_R16 (FATF Recommendation 16 — VA travel rule requiring sharing of originator/beneficiary personal data) and SG_PDPA (Singapore Personal Data Protection Act). FATF R16 implementations (including SG's via MAS PSN02) require sharing personal data of senders/recipients; PDPA's consent and disclosure restrictions engage. Operationally resolvable via PDPA s.13(b) ('required or authorised by law') for AML compliance. Same cross-jurisdictional AML-privacy shape.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Part 5 AML/CTF programs
Division 2 AML/CTF policies related to ML/TF risk mitigation
Section 5-2
Division 2-AML/CTF policies related to ML/TF risk mitigation
5-2 Carrying out customer due diligence
(1) For the purposes of paragraph 26F(7)(a) of the Act, this section specifies
requirements in relation to the matter mentioned in paragraph 26F(3)(b) of the
Act (carrying out customer due diligence in accordance with Part 2 of the Act). (2) The AML/CTF policies of the reporting entity must set out the circumstances in
which the reporting entity will, for the purposes of undertaking initial customer
due diligence in accordance with section 28 of the Act:
(a) collect kinds of KYC information relating to a customer; or
(b) both collect and verify kinds of KYC information relating to a customer;
including but not limited to the circumstances in which the reporting entity will
collect, or collect and verify, information on the customer's source of wealth and
source of funds.

EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 37
Specific enhanced due diligence measures for cross-border correspondent relationships for crypto-asset service
providers
1. By way of derogation from Article 36, with respect to cross-border correspondent relationships involving the
execution of crypto-asset services, with a respondent entity not established in the Union and providing similar services,
including transfers of crypto-assets, crypto-asset service providers shall, in addition to the customer due diligence measures
laid down in Article 20, when entering into a business relationship, be required to:
(a) determine if the respondent entity is licensed or registered;
68/111 ELI: http://data.europa.eu/eli/reg/2024/1624/oj EN
(b) gather sufficient information about the respondent entity to understand fully the nature of the respondent's business
and to determine from publicly available information the reputation of the entity and the quality of supervision;
(c) assess the respondent entity's AML/CFT controls;
(d) obtain approval from senior management before establishing the new correspondent relationship;
(e) document the respective responsibilities of each party to the correspondent relationship;
(f) with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of,
and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity,
and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

Explanation: The AUSTRAC AML/CTF regime and the EU AMLR/TFR are parallel national/regional AML/CFT regimes implementing FATF standards. They apply to non-overlapping regulated populations (AUSTRAC-registered reporting entities vs EU obliged entities and CASPs). A firm operating in both jurisdictions complies with both independently. Although a labeller could imagine a transmission-of-information case where an AU reporting entity transfers personal data of a customer to an EU CASP — that case is GDPR/Privacy-Act territory, not an AU-AML vs EU-AML conflict. This pair is best characterised as an equivalence rather than a conflict and is so labelled in the equivalences file.

Both regimes ever attempted extraterritorial assertion of the same VASP that produced contradictory obligations — current text scopes each to its jurisdiction's obliged entities.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a) it involves the payer withdrawing cash from the payer's own payment account;
(b) it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member
State;
(c) both the payer and the payee are payment service providers acting on their own behalf;
(d) it is carried out through cheque images exchanges, including truncated cheques. This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a) both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b) the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-
asset service provider. Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-
assets under this Regulation.

Explanation: AU_AML_CTF (Australian AML/CTF Act — AUSTRAC reporting entity framework) and EU_AMLR_TFR (EU AML regulation + Transfer of Funds Regulation 2023/1113). Both jurisdictions implement comparable AML/CFT obligations on regulated entities consistent with FATF standards. Entities operating across both face complementary (not contradictory) duties. The B passage notes specific EU TFR scope exclusions that don't conflict with the AU framework.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU_MICA_RTS passage (c51ad46265cea4e5::2f5::4513) discusses the notification obligations for financial entities providing crypto-asset services under MiCA. The SG_MAS_PRUDENTIAL_CRYPTO passage (7c04f2a0bd85290a::449::02f2) discusses the risk-based capital framework for Stablecoin Issuers (SCS) and the principle of 'same activities, same risk, same regulation'. The obligations are distinct: one concerns the notification of services to authorities, while the other concerns capital adequacy for issuers. There is no specific obligation in MiCA that pushes against the MAS prudential capital requirements for SCS issuers. Therefore, the regimes are in different domains.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Explanation: The AU_FEDREG_AML regime focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, specifically regarding the identification of customers, reporting suspicious transactions, and the collection of information for electronic funds transfers (chunk cf7cefacba3f94bc::49a::f39e). The EU_PSD2 regime focuses on payment services, specifically the technical requirements for strong customer authentication and security measures for payment accounts (chunk adb1a81b9cecaf8c::64f::f5ad). While both regimes regulate electronic payments, they address distinct regulatory objectives: AML/CTF compliance versus payment security and authentication standards. There is no evidence in the provided passages of a direct obligation in one regime that conflicts with a specific obligation in the other.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The evidence from Regime A (AU_ATO_CRYPTO) focuses on token mapping, tax compliance, and the crypto ecosystem in Australia (chunk_id e6bb47e92e88e16c::567::36c4). The evidence from Regime B (SG_FOUNDATIONAL_LEGISLATION) discusses MAS enforcement actions against ICO issuers and exchanges in Singapore, as well as the Payment Services Act (chunk_id b49627bb889ef1d9::3ef::7168). The passages describe distinct regulatory environments and enforcement actions in different jurisdictions (Australia vs. Singapore) and do not contain specific obligations that push against one another. Therefore, the regimes are in different domains.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

28. Third-country firms should be able to provide records tracking the relationship with the
client and, in particular, whether the client has taken the initiative to receive crypto asset
services with respect to a new product.

5.4 When is a crypto-asset or a crypto-asset service of the same
type as another one (Guideline 4)

29. The reverse solicitation regime leaves open the possibility for a third-country firm to
market crypto-assets or crypto-asset services or activities of the same type in the context
of the relationship started at the own exclusive initiative of a given client, subject to the
third-country firm also complying with Guideline 3 above.

2020Ed. Act 2012 20
(2) An organisation must not -
(a) as a condition of providing a product or service, require an
individual to consent to the collection, use or disclosure of
personal data about the individual beyond what is
reasonable to provide the product or service to that
individual; or
(b) obtain or attempt to obtain consent for collecting, using or
disclosing personal data by providing false or misleading
informationwithrespecttothecollection,useordisclosure
of the personal data, or using deceptive or misleading
practices. (3) Anyconsentgiveninanyofthecircumstancesinsubsection(2)
is not validly given for the purposes of this Act. (4) InthisAct,referencestoconsentgiven,ordeemedtohavebeen
given, by an individual for the collection, use or disclosure of
personal data about the individual include consent given, or deemed
to have been given, by any person validly acting on that individual's
behalf for the collection, use or disclosure of such personal data.

Explanation: The EU regime regulates the solicitation of clients by third-country crypto-asset firms (reverse solicitation) and the conditions under which they may market services. The SG PDPA regulates the collection, use, and disclosure of personal data, specifically focusing on the requirement for consent and the limitations on consent as a condition for service provision. The obligations in the EU regime concern the initiation of business relationships and marketing activities, whereas the SG PDPA obligations concern the privacy and data protection aspects of those relationships. There is no specific obligation in the EU regime that pushes against a specific obligation in the SG PDPA; rather, they regulate distinct aspects of a business relationship. Therefore, the regimes are in different domains.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

Powers of Authority to ensure interoperability between
payment systems
26.-(1) The Authority may, by written notice, direct a payment
service provider (being a major payment institution, an exempt
payment service provider or a person exempt under section 100) that
operates a payment system to adopt any common standard, on such
terms and conditions as the Authority may consider appropriate, in
order to ensure interoperability between different payment systems
operated by different payment service providers. 2020Ed. Payment Services Act 2019 66
(2) In considering whether to issue a written notice under
subsection (1), the Authority must have regard to the following
matters:
(a) whether ensuring interoperability between different
payment systems would be in the interests of the public;
(b) theinterestsofeverypaymentserviceproviderthatwill be
directed to adopt the common standard;
(c) theinterestsofpersonswho,inthefuture,mayberequired,
or may desire, to adopt the common standard;
(d) such other matters as the Authority may consider to be
relevant.

Explanation: The evidence for AU_CORPS_ACT (chunk 0fc4f857c226f510::375::66b5) outlines the interaction between the Corporations Act and the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions and director duties. The evidence for AU_PAYMENT_SYSTEMS (chunk 6644db515eb0e280::423::b3f1) concerns the Authority's powers to ensure interoperability between payment systems. The obligations in the Corporations Act relate to corporate governance and director responsibilities, while the obligations in the Payment Systems Act relate to technical infrastructure and interoperability. These are distinct regulatory domains with no apparent overlap or conflict.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU MiCA Title V crypto-asset service provider regime are designed to coexist — obligations apply cumulatively without collision. AMLA supervises CASPs as AMLR-obliged entities — aligned by design. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

23 FATF (2013-2017), Anti-money laundering and terrorist financing measures and financial
inclusion - With a supplement on customer due diligence, FATF, Paris www.fatf-
gafi.org/media/fatf/content/images/Updated-2017-FATF-2013-Guidance.pdf

30  GUIDANCE ON DIGITAL IDENTITY
Non face-to-face business relationships and transactions

Explanation: EU_PSD2 (Article 97 strong customer authentication for payment account access and electronic transactions) and FATF_R16 (FATF travel rule for VAs/VASPs — originator/beneficiary information for transfers). Both broadly relate to payments/transfers but address different specific concerns — PSD2 is about authenticating the payer at account access/transaction-initiation; FATF R16 is about identifying parties in cross-border VA transfers. The cited passages don't impose conflicting obligations on the same action.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

The competent authorities shall grant an authorisation only if, taking into account the need to ensure the sound
and prudent management of a payment institution, the payment institution has robust governance arrangements for its
payment services business, which include a clear organisational structure with well-defined, transparent and consistent 23.12.2015 EN Official Journal of the European Union L 337/67
lines of responsibility, effective procedures to identify, manage, monitor and report the risks to which it is or might be
exposed, and adequate internal control mechanisms, including sound administrative and accounting procedures; those
arrangements, procedures and mechanisms shall be comprehensive and proportionate to the nature, scale and complexity
of the payment services provided by the payment institution.
5. Where a payment institution provides any of the payment services as referred to in points (1) to (7) of Annex I and,
at the same time, is engaged in other business activities, the competent authorities may require the establishment of a
separate entity for the payment services business, where the non-payment services activities of the payment institution
impair or are likely to impair either the financial soundness of the payment institution or the ability of the competent
authorities to monitor the payment institution's compliance with all obligations laid down by this Directive.
6.

Explanation: The evidence for AU_APRA_CPS230 focuses on operational risk management, resilience, and the management of service providers (chunk_ids f296a7e0bead93df::4a5::9828 and 4b6fab404e7acfca::3d7::737c). The evidence for EU_PSD2 focuses on strong customer authentication, security credentials, and governance for payment institutions (chunk_ids adb1a81b9cecaf8c::64f::f5ad and adb1a81b9cecaf8c::58c::2a32). While both regimes require robust governance and internal controls, the specific obligations—operational resilience and service provider risk management under APRA versus strong customer authentication and security credential protection under PSD2—regulate distinct aspects of a financial institution's operations. There is no specific obligation in one regime that directly contradicts or invalidates a specific obligation in the other.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: AU_CORPS_ACT (Australia's Corporations Act 2001 — broad corporate-law framework including financial-services regulation) and EU_MAR (EU Market Abuse Regulation 596/2014 — insider dealing, market manipulation, and information-disclosure framework). Both regulate market conduct and corporate behaviour in their jurisdictions but with different specific obligations — AU Corps Act is broad corporate law, EU MAR is specifically market-abuse-focused. Distinct jurisdictional perimeters; no direct obligation conflict.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

4. This guidance is based on the same general principles that govern both the interpretation and
assessment of the FATF standards. As noted in the introduction to the 2012 FATF
"Countries have diverse legal, administrative and operational frameworks and different
Recommendations:
financial systems, and so cannot all take identical measures to counter these threats. The FATF
Recommendations, therefore, set an international standard, which countries should implement
through measures adapted to their particular circumstances."
how

Explanation: EU_AMLA (EU's new AML Authority under AMLD6 — supervisory cooperation framework) and INT_FATF_GENERAL (FATF general AML/CFT standards). The EU AMLA framework is the EU's institutional implementation of FATF AML/CFT standards; cooperation between AMLA, national FIUs, and international AML bodies is explicitly contemplated. Aligned by design — EU implements FATF.


Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU MiFID II investment-firm conduct directive are designed to coexist — obligations apply cumulatively without collision. Investment firms are AMLR/AMLD6 obliged entities — supervisory regime applies cumulatively with MiFID II. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules) and FATF_R16 (FATF Recommendation 16 — travel rule). Australia is implementing FATF R16 standards through the AML/CTF framework (currently consulting on full DCE travel-rule extension). Aligned direction.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Explanation: The obligations in Prudential Standard CPS 230 (Regime A) focus on operational risk management, resilience, and the management of service providers to ensure critical operations continue through disruptions. In contrast, the EU DAC8 Directive (Regime B) regulates the reporting and exchange of information regarding crypto-asset users to tax authorities. The passages confirm that these regimes regulate distinct domains: one governs operational resilience and risk management for APRA-regulated entities, while the other establishes tax transparency rules for crypto-asset operators. There is no specific obligation in CPS 230 that pushes against a specific obligation in DAC8, nor is there evidence of overlap in their application.


Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

94. The FATF Standards, including the definitions of virtual assets and VASPs, represent
a minimum standard for countries to introduce. In line with the RBA, countries may
choose to extend their AML/CFT regimes to include other digital assets and entities,
beyond the FATF definition of virtual asset and VASP. Such a determination should
be made on the basis of a ML/TF risk assessment, with consideration of the
challenges associated with regulatory divergence.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  37
PART THREE:
APPLICATION OF FATF STANDARDS TO COUNTRIES AND
COMPETENT AUTHORITIES

Explanation: The AU_TREASURY_DAP passages describe a domestic policy agenda focused on 'token mapping' and the development of a future licensing framework for crypto asset service providers (chunk_ids d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). The INT_FATF_VASP passages define the scope of the FATF Standards regarding Virtual Asset Service Providers (VASPs) and note that countries may choose to extend their regimes beyond the minimum standard (chunk_ids 85240528438654b9::1cd::07d7, 85240528438654b9::284::b4a8). The FATF text explicitly states that countries may extend their AML/CFT regimes to include other digital assets and entities beyond the FATF definition of VASP, which aligns with the Australian government's intent to develop a specific regulatory framework. There is no evidence of a specific obligation in one regime that directly contradicts or invalidates the other; rather, the FATF provides a minimum global standard that Australia intends to implement and potentially expand upon through its domestic reforms.