Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: The obligations in Prudential Standard CPS 230 (Regime A) focus on operational risk management, business continuity, and the resilience of critical operations for APRA-regulated entities (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). In contrast, the obligations in Regulation (EU) 2023/1114 (Regime B) address the content and liability of crypto-asset white papers for issuers of e-money tokens (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The two regimes regulate distinct aspects of financial services—operational resilience versus disclosure and liability for token issuers—and do not impose conflicting obligations on the same activity.


This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a) it involves the payer withdrawing cash from the payer's own payment account;
(b) it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member
State;
(c) both the payer and the payee are payment service providers acting on their own behalf;
(d) it is carried out through cheque images exchanges, including truncated cheques. This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a) both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b) the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-
asset service provider. Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-
assets under this Regulation.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The EU AMLR TFR passage (c7502c011527b67c::3e7::ae26) establishes an exemption for transfers of funds to public authorities for taxes, fines, or levies. The SG IRAS TFR passage (abc2247bc6415d1d::41e::b184) confirms that digital payment tokens are exempt from GST. These obligations operate in different domains: one regulates the information accompanying transfers to prevent money laundering, while the other regulates the tax treatment of the tokens themselves. There is no specific obligation in the EU regime that conflicts with the SG tax treatment of digital payment tokens.


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: EU_AMLR_TFR (EU regulation extending AML/CFT to CASPs and mandating information accompanying crypto-asset transfers — Regulation 2023/1113 with originator/beneficiary personal-data sharing requirements) and SG_PDPA (Singapore PDPA restricting collection, use and disclosure of personal data without consent or statutory authorisation). When EU CASPs send crypto value to SG counterparties, the TFR's mandated personal-data disclosure engages PDPA's restrictions on the SG side. Operationally resolvable via PDPA s.13(b) ('required or authorised under any other written law') in combination with MAS's AML/CFT notice framework establishing the SG-side legal basis. Same conflict shape as the labelled EU TFR ↔ EU GDPR conflict in the careful cohort, scaled to the SG-cross-jurisdiction framing.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The evidence for Regime A (AU_CORPS_ACT) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up (chunk 0fc4f857c226f510::375::66b5). The evidence for Regime B (SG_PSA_GENERAL) discusses the regulatory scope of Payment Services Act licenses, specifically regarding Digital Payment Token Services (DPT) and whether a PSA license covers all activities like custody or requires specific licensing (chunk 14cb9eb911d15322::42b::fe23). The obligations in Regime A relate to corporate governance and internal company affairs, while the obligations in Regime B relate to financial services licensing and digital asset custody. These are distinct regulatory domains with no apparent overlap of specific obligations that would create a conflict.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU_MICA passages describe the internal legal framework, supervisory practices, and authorisation requirements for crypto-asset service providers (e.g., Article 92(1) requiring effective arrangements for market abuse prevention, and Article 62(5) regarding application for authorisation). The SG_FOUNDATIONAL_LEGISLATION passages discuss MAS enforcement actions against ICO issuers and exchanges, and a consultation paper regarding the regulatory scope of securities contracts (SCS) and potential alignment with international standards like EU MiCA. The SG passage explicitly acknowledges EU MiCA as a regulatory standard for foreign SCS operating in Singapore (evidence_b_chunk_ids), indicating that the regimes are treated as distinct but potentially aligned frameworks rather than conflicting obligations. Therefore, the regimes are in different domains with no evidence of a direct conflict.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

1. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

2. MiCA sets out a new legal framework applicable to legal persons or other undertakings
intending to provide crypto-asset services, requiring such entities to submit an
application for authorisation containing all the information set out in Article 62(2) of MiCA,
as specified by the RTS on the information for authorisation as a CASP.

3. The next paragraphs present the cost-benefit analysis of the main policy options included
in this final report on the requirements for the application for authorisation as a CASP
under Article 62 of MiCA.
Problem identification

Explanation: The obligations in Regime A (AU_APRA_CPS230) focus on operational risk management, resilience, and the management of service providers for APRA-regulated entities. The obligations in Regime B (EU_MICA_TITLE_V_CASP) focus on the authorisation requirements for Crypto-Asset Service Providers (CASP) under the Markets in Crypto-Assets Regulation (MiCA). The passages describe distinct regulatory frameworks governing different sectors (general financial services vs. crypto-asset services) and different objectives (operational resilience vs. market integrity and investor protection). There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they regulate separate domains.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

1.2 These Guidelines1 on Outsourcing ("Guidelines") set out the Monetary Authority of
Singapore's ("MAS") expectations of an institution that has entered into any outsourcing
arrangement or is planning to outsource its business activities2 to a service provider. An
institution should conduct a self-assessment of all existing outsourcing arrangements against
these Guidelines3.

Explanation: The evidence from AU_TREASURY_DAP discusses the Australian government's 'token mapping' exercise to identify how crypto assets fit into the financial services framework and outlines plans for future licensing reforms (chunk_id=d75262e404517e0c::47b::7c9f). The evidence from SG_MAS_OUTSOURCING outlines the Monetary Authority of Singapore's general expectations for institutions entering into outsourcing arrangements (chunk_id=a82833dc0f7ca903::17a::c743). The passages describe distinct policy agendas and regulatory frameworks for different jurisdictions (Australia and Singapore) and do not contain specific obligations that push against one another. Therefore, the regimes are in different domains.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): AUSTRAC AML/CTF operational guidance and AUSTRAC IFTI / EFTI travel-rule reporting are designed to coexist — obligations apply cumulatively without collision. The AUSTRAC Travel Rule guidance is a narrowed view of the broader AML/CTF regime — same regime, different granularity. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


19. Article 62(4) of MiCA sets out that NCAs must not require an applicant CASP to provide
any information referred to in Article 62(2) of MiCA that they have already received under
the respective authorisation procedures in accordance with Directive 2009/110/EC4,
2014/65/EU5 or (EU) 2015/23666, or pursuant to national law applicable to crypto-asset
services prior to the date of entry into force of MiCA, provided that such previously
submitted information or documents are still up-to-date.

3.2 Feedback statement
Q2: Do you agree with the list of information to be provided with an application for
authorisation as a crypto-asset service provider? Please also state the reasons for your
answer.

RG 1.187 AFS licensees have obligations under s912A requiring them to:
(a) operate their business efficiently, honestly and fairly;
(b) maintain the organisational competence to provide the financial services
covered by their licence;
(c) ensure their representatives are competent and adequately trained to
provide the financial services;
(d) have adequate financial, technological and human resources to provide
the financial services;
(e) have risk management systems;
(f) have arrangements in place for managing conflicts of interest;
(g) comply with the financial services laws and ensure their representatives
comply with those laws;
(h) comply with the conditions on their licence; and
(i) if they are the operator of an Australian passport fund or a person with
responsibilities in relation to an Australian passport fund-comply with
the law of each host economy for the fund.
Note 1: If you are an eligible body under ASIC Corporations (Foreign Financial Services
Providers-Foreign AFS Licensees) Instrument 2020/198 you may be exempt from some
of these obligations.
Note 2: If you are providing financial services to retail clients, you will have additional
dispute resolution and compensation obligations. Please see s912B for more information.
© Australian Securities and Investments Commission June 2025 Page 38

RG 1.193 If we grant you an AFS licence, your licensee obligations include your
statutory obligations including those in s912A, the licence conditions imposed
under the Corporations Regulations including reg 7.6.04, and the licence
conditions imposed by ASIC in PF 209, as well as any tailored licence
conditions that apply specifically to you.
© Australian Securities and Investments Commission June 2025 Page 39

Efficiently, honestly and fairly

RG 1.194 Section 912A(1)(a) requires that a financial services licensee do all things
necessary to ensure that the financial services covered by the licence are
provided efficiently, honestly and fairly.

Explanation: EU_MICA_TITLE_V_CASP (EU CASP authorisation framework — applies to any entity providing ten enumerated crypto-asset services to EU clients) and AU_ASIC_AFSL (Australian Financial Services Licence — extended by ASIC INFO 225 to crypto activities WHEN the underlying crypto-asset qualifies as a 'financial product' under the Corporations Act). When an entity operates crypto-asset services across both jurisdictions, whether AFSL is engaged at all turns on FACTS about the specific crypto-asset's characteristics (financial-product status determination per INFO 225 criteria). The interaction with MiCA CASP authorisation depends on whether AFSL applies — fact-sensitive determination yielding materially different combined obligations.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Such a warning may be
provided in a standardised format;
(d) the investment firm complies with its obligations under Article 23.
5. The investment firm shall establish a record that includes the document or documents agreed between the
investment firm and the client that set out the rights and obligations of the parties, and the other terms on which
the investment firm will provide services to the client. The rights and duties of the parties to the contract may be
incorporated by reference to other documents or legal texts.
6. The investment firm shall provide the client with adequate reports on the service provided in a durable medium. Those reports shall include periodic communications to clients, taking into account the type and the complexity of
financial instruments involved and the nature of the service provided to the client and shall include, where applicable, the
costs associated with the transactions and services undertaken on behalf of the client. When providing investment advice, the investment firm shall, before the transaction is made, provide the client with a
statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences,
objectives and other characteristics of the retail client.

Explanation: The evidence for APRA CPS 230 focuses on operational risk management, resilience, and the management of service providers (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for EU MIFID II focuses on product governance, suitability, and information disclosure obligations for investment firms (chunk_ids 28dfda0f6a6539b6::620::92ed, 28dfda0f6a6539b6::4f2::95d6). The obligations in MIFID II regarding product approval and client suitability do not impose conflicting requirements on the operational resilience or service provider management obligations outlined in CPS 230. Therefore, the regimes regulate different domains and do not conflict.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The evidence for AU_TRAVEL_RULE indicates that Australia has not yet implemented the FATF 'Travel Rule' for digital currency exchanges and is currently consulting on extending these requirements (cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). In contrast, the evidence for SG_PSA_DPT confirms that AML/CFT requirements, including the Travel Rule, are already applicable to Digital Payment Token (DPT) service providers in Singapore (018117ef1e757630::4b5::9ef5). The regimes are not in conflict because one is actively implementing a rule that the other is still considering; they operate in different stages of regulatory maturity regarding the same topic.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Member States shall ensure that supervisors have the power to disassociate persons convicted of money laundering,
its relevant predicate offences or terrorist financing, who are beneficial owners of obliged entities as referred to in
paragraphs 1 and 2, from obliged entities, including by granting supervisors the power to request the divestment of the
holding by those beneficial owners in obliged entities.
6. For the purposes of this Article, Member States shall ensure that, in accordance with national law, supervisors or any
other authority competent at national level for assessing the requirements applicable to persons referred to in paragraphs 1
and 2 of this Article, check the central AML/CFT database under Article 11 of Regulation (EU) 2024/1620 and whether
a relevant conviction exists in the criminal record of the person concerned. Any exchange of information for those
purposes shall be carried out in accordance with Framework Decision 2009/315/JHA and Decision 2009/316/JHA as
implemented in national law.
7.

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Explanation: AMLD6 builds on the existing AML/CFT framework's interaction with GDPR — the AMLD framework has long included data-protection language (cross-referenced earlier in AMLD6 Recital 59 etc., which we cite in the recurring-friction pair AU_FEDREG_AML :: AU_PRIVACY's evidence pool). The lawful-basis chain (GDPR Art. 6(1)(c)) carries AMLD6 supervisory measures forward without colliding with GDPR's minimisation and purpose-limitation principles. Hard negative — these regimes have been designed to coexist for a decade.

A specific AMLD6 transposition extended supervisory disclosure beyond a GDPR Art. 6(1)(c) carve-out — unlikely under the Directive's harmonisation regime.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

Explanation: The EU MiCA regime establishes a specific licensing and authorisation framework for Crypto-Asset Service Providers (CASP) within the EU (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::34a::74e3). The FATF regime, conversely, defines VASPs as a minimum standard for countries to introduce and explicitly states that countries may choose to extend their AML/CFT regimes to include other digital assets and entities beyond the FATF definition (85240528438654b9::1cd::07d7, 85240528438654b9::3c5::d461). Furthermore, FATF guidance notes that countries need not impose a separate licensing system for entities already licensed as financial institutions (ba862e1f095bceac::1a6::1f0e). The passages describe distinct regulatory objectives: MiCA focuses on market conduct and authorisation requirements for EU entities, while FATF focuses on AML/CFT minimum standards and risk-based approaches. There is no evidence of a direct obligation in MiCA that conflicts with a specific obligation in FATF; rather, they operate in complementary domains (aligned_complementary).


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The EU MICA Title IV EMT regime regulates the disclosure and liability obligations of issuers of e-money tokens and asset-referenced tokens, specifically regarding the content of crypto-asset white papers and notification to competent authorities (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). In contrast, the Singapore AML regime (MAS Notice 314) focuses on the training and compliance obligations of officers, employees, and agents regarding money laundering and terrorism financing (chunk_id 3d521e61e49aaf46::38f::e615). The obligations in the EU regime relate to financial product disclosure and issuer liability, while the Singapore obligations relate to internal controls and staff training for AML purposes. These are distinct regulatory domains that do not impose conflicting requirements on the same operational activity.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: FATF_R16 (FATF Recommendation 16 travel rule for VAs/VASPs) and SG_PSA_DPT (MAS's PSN02 AML notice for DPT licensees, which Singapore uses to implement the FATF travel rule). The B passage describes MAS's AML/CFT supervisory framework for DPT providers — directly implementing the FATF standards. Reinforcing relationship.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: The AU_AML_CTF regime regulates Anti-Money Laundering and Counter-Terrorism Financing reporting obligations, specifically requiring reporting entities to give reports about suspicious matters, threshold transactions, and international funds transfer instructions (chunk_id 254ca2d92d196180::2ac::a5fe). The EU_MAR regime regulates market abuse, including insider dealing and market manipulation, to ensure the integrity of financial markets (chunk_id 5cc4a27bc578287a::165::3333). The obligations and subject matter of the two regimes are distinct; one focuses on financial crime prevention and reporting, while the other focuses on market integrity and trading conduct. There is no evidence of a specific obligation in AU_AML_CTF that conflicts with a specific obligation in EU_MAR.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical currency transactions exceeding A$10,000 to AUSTRAC. The EU_EMD2 regime regulates digital operational resilience for the financial sector. The cited passages for EU_EMD2 refer to Directive (EU) 2022/2556 regarding digital operational resilience and do not contain any obligations related to physical currency reporting or transaction thresholds. Therefore, the obligations of the two regimes do not overlap, and there is no conflict.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

Explanation: AU_ASIC_AFSL (Australian Financial Services Licence framework — proposed digital-asset facility licensing) and EU_MAR (EU Market Abuse Regulation 596/2014 — insider dealing / market manipulation). Both touch on market-conduct regulation but at different layers — AU AFSL is entity-licensing; EU MAR is market-abuse rules. Different jurisdictional perimeters and specific obligations; no direct conflict on cited passages.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

Explanation: The evidence for AU_TREASURY_DAP focuses on the Australian government's 'token mapping' exercise to identify how crypto assets fit into existing financial services laws and the subsequent development of a licensing framework for crypto asset service providers (chunks 4905, 6bb9, 7c9f). The evidence for EU_DORA establishes a regulatory framework for the 'digital operational resilience' of financial entities, specifically regarding the security of network and information systems and ICT risk management (chunks 974e, 3d7, 2b9). The two regimes address distinct regulatory domains: one is a jurisdictional and product classification exercise for crypto assets (AU), while the other is a technical operational resilience standard for financial entities (EU). There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: AU_TREASURY_DAP (Australia's proposed Digital Asset Platforms regime — Treasury consultation) and SG_PSA_GENERAL (Singapore Payment Services Act). Both regulate digital-asset / payment services in their respective jurisdictions, but with materially different mechanisms and licensing perimeters. No conflicting obligation on the cited passages.


2 APRA's prudential framework comprises prudential standards and prudential practice guides (PPGs). APRA is
empowered to issue legally binding prudential standards that set out specific requirements with which APRA-regulated
institutions - authorised deposit-taking institutions (ADIs), general insurers and life companies (collectively,
insurers) and registrable superannuation entity licensees (RSE licensees) - must comply. APRA also issues PPGs,
which clarify APRA's expectations with regard to prudential matters. PPGs frequently discuss legal requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements.

1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

Explanation: The evidence for AU_APRA_PRUDENTIAL focuses on the Australian prudential framework, specifically APRA's role in issuing prudential standards for banking, insurance, and superannuation entities, and the review of capital requirements and securitisation risks (chunk_ids 9a96d4d1812f257a::2a6::2422, 66d049e24f0863da::3f7::aec8). The evidence for EU_MICA describes the European legal framework for crypto-assets, including the provision of crypto-asset services and the requirements for authorisation as a crypto-asset service provider (chunk_ids f9082873c5d9ba9d::302::bbe0, c51ad46265cea4e5::462::80d8). The obligations and regulated entities in the Australian prudential regime (banks, insurers, superannuation) are distinct from the crypto-asset service providers regulated under the EU MiCA framework. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other, nor is there evidence of overlap in the regulated activities or entities. Therefore, the regimes are in different domains.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Member States shall ensure that supervisors have the power to disassociate persons convicted of money laundering,
its relevant predicate offences or terrorist financing, who are beneficial owners of obliged entities as referred to in
paragraphs 1 and 2, from obliged entities, including by granting supervisors the power to request the divestment of the
holding by those beneficial owners in obliged entities.
6. For the purposes of this Article, Member States shall ensure that, in accordance with national law, supervisors or any
other authority competent at national level for assessing the requirements applicable to persons referred to in paragraphs 1
and 2 of this Article, check the central AML/CFT database under Article 11 of Regulation (EU) 2024/1620 and whether
a relevant conviction exists in the criminal record of the person concerned. Any exchange of information for those
purposes shall be carried out in accordance with Framework Decision 2009/315/JHA and Decision 2009/316/JHA as
implemented in national law.
7.

(5) Since the adoption of Directive (EU) 2015/849, recent developments in the Union's criminal law framework have
contributed to strengthening the prevention of and fight against money laundering, its predicate offences and
terrorist financing. Directive (EU) 2018/1673 of the European Parliament and of the Council (9) has led to
a common understanding of the money laundering crime and its predicate offences. Directive (EU) 2017/1371 of
the European Parliament and of the Council (10) defined financial crimes affecting the Union's financial interest,
which should also be considered predicate offences to money laundering. Directive (EU) 2017/541 of the European
Parliament and of the Council (11) has achieved a common understanding of the crime of terrorist financing. As
those concepts are now clarified in Union criminal law, it is no longer necessary for the Union's AML/CFT rules to
define money laundering, its predicate offences or terrorist financing. Instead, the Union's AML/CFT framework
should be fully coherent with the Union's criminal law framework.

(6) Harmonisation in the relevant area of criminal law enables a strong and coherent approach at Union level to the
prevention of and fight against money laundering and its predicate offences, including corruption. At the same time,
such an approach ensures that Member States that have adopted a broader approach to the definition of criminal
activities which constitute predicate offences for money laundering can continue to apply such an approach. For that
reason, in line with Directive (EU) 2018/1673, any kind of punishable involvement in the commission of a predicate
offence for money laundering as criminalised in accordance with national law should also be considered as
a criminal activity for the purposes of that Directive and of this Regulation.

Explanation: AMLD6 and AMLR are explicitly designed as two pieces of the same EU AML/CFT package — together with the TFR (Reg 2023/1113) and AMLA (Reg 2024/1620), they form the new framework governing AML/CFT in the Union. AMLD6 Recital 4 states 'this Directive is part of a comprehensive package'. AMLR contains the directly-applicable operational rules on obliged entities; AMLD6 covers supervisory and Member-State implementation matters. They are designed to dovetail, with no obligation in one pushing against any obligation in the other. Hard negative.

AMLD6 transposition created a Member-State carve-out incompatible with AMLR's directly-applicable rules — the package design forecloses this by allocating subject-matter cleanly.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

2020Ed. Act 2012 20
(2) An organisation must not -
(a) as a condition of providing a product or service, require an
individual to consent to the collection, use or disclosure of
personal data about the individual beyond what is
reasonable to provide the product or service to that
individual; or
(b) obtain or attempt to obtain consent for collecting, using or
disclosing personal data by providing false or misleading
informationwithrespecttothecollection,useordisclosure
of the personal data, or using deceptive or misleading
practices. (3) Anyconsentgiveninanyofthecircumstancesinsubsection(2)
is not validly given for the purposes of this Act. (4) InthisAct,referencestoconsentgiven,ordeemedtohavebeen
given, by an individual for the collection, use or disclosure of
personal data about the individual include consent given, or deemed
to have been given, by any person validly acting on that individual's
behalf for the collection, use or disclosure of such personal data.

Explanation: EU_MICA_TITLE_IV_EMT (EU MiCA Title IV — e-money token issuer framework, including issuer KYC obligations under Articles 51-52 white-paper requirements and AML/CFT under linked Regulation 2023/1113) and SG_PDPA (Singapore PDPA). EMT issuers conducting cross-border issuance to SG clients face the same KYC×privacy tension as MiCA CASPs — they must collect/transmit personal data of customers; PDPA restricts the SG-side flow. Operationally resolvable via PDPA s.13(b) carve-out. Same conflict family as MiCA Title V ↔ SG_PDPA.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: The EU_MAR regime regulates market integrity, specifically insider dealing and market manipulation (chunks 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The INT_FATF_GENERAL regime regulates anti-money laundering (AML) and counter-terrorist financing (CFT) standards (chunks fe52dd87e13dba41::261::59a4, 08b3db1cc7362f25::3bb::5dba). The obligations in MAR relate to the conduct of trading and the prevention of market abuse, while FATF obligations relate to the reporting of suspicious transactions and the integrity of the financial system against money laundering and terrorist financing. These are distinct regulatory domains with no specific obligation in MAR that directly conflicts with a specific obligation in FATF.


Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise and the development of a licensing framework for crypto asset service providers (chunk_ids d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). In contrast, the INT_BASEL_GENERAL passages address the Basel III framework's treatment of leverage ratios, general provisions, and expected losses for banks (chunk_ids 32afd37cade34f84::34b::8d30, ffa7a3de1e0fc7f0::7bc::38ba). The obligations and subject matter of the two regimes are distinct; one regulates crypto asset service providers in Australia, while the other regulates capital adequacy and leverage for banks globally. Therefore, there is no specific obligation in one regime that pushes against a specific obligation in the other.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

Explanation: The AU_TRAVEL_RULE passages discuss Australia's regulatory framework for digital currency exchanges and the implementation of FATF's 'Travel Rule' for identifying parties in transactions. The EU_EMD2 passages refer to the Digital Operational Resilience Act (DORA) and financial sector operational resilience. The obligations in the AU passages (AML/CTF compliance and Travel Rule implementation) do not conflict with the obligations in the EU passages (digital operational resilience and financial rules). The regimes regulate different aspects of the financial sector—AML/CTF compliance versus operational resilience—resulting in a non-conflict relationship.


On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The EU AMLD6 passage (chunk 85307f9e2a040982::14a::134d) discusses the scope of the Directive, specifically mentioning its application to the financial sector and digital operational resilience. The SG FSMA DTSP passages (chunks 20d526d712753652::404::80be and cc1be49e9cf8c821::2f4::ea8f) regulate Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022, defining their licensing requirements and operational obligations. While both regimes address the digital token sector and AML/CFT standards, the EU passage does not impose specific obligations that conflict with the Singaporean licensing and operational requirements for DTSPs. The SG passages focus on local licensing, exemptions, and FATF alignment, which are complementary rather than conflicting with the general scope of the EU Directive. Therefore, the regimes are in different domains regarding specific operational obligations.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_AML_CTF regime regulates reporting obligations for suspicious matters, threshold transactions, and international funds transfer instructions (chunk 254ca2d92d196180::2ac::a5fe). The EU_REVERSE_SOLICITATION regime regulates the exemption from authorisation requirements for third-country crypto-asset firms when a client initiates the relationship (reverse solicitation) (chunk 25cbbd878a1b21d3::4f8::561c). The obligations in the EU regime relate to the initiation of a business relationship and marketing activities, whereas the AU regime focuses on reporting specific transactions and suspicious activities. There is no specific obligation in the AU regime that pushes against the reverse solicitation exemption in the EU regime; they regulate distinct aspects of financial services compliance.


2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: EU_MICA (EU Markets in Crypto-Assets Regulation — comprehensive framework including CASP AML obligations and crypto-asset transfer information requirements) and SG_PDPA (Singapore PDPA — consent and cross-border disclosure restrictions). EU CASPs operating across to SG must transmit personal data of senders/recipients for AML compliance; SG PDPA restricts the SG-side collection/disclosure absent the 'required by law' carve-out. Operationally resolvable via PDPA s.13(b) + SG MAS AML notices providing the SG legal basis. Same shape as labelled EU TFR ↔ EU GDPR conflict, in EU↔SG cross-jur framing.