means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Customer identification and verification.pdf

'@ Australian Government
" AUSTRAC Customer identification
and verification Home / Business / Core guidance / Customer identification and verification As a reporting entity, you must identify and know your customers. Your customer identification procedures - know your customer (KYC) procedures -
must be documented in Part B of your AML/CTF program. All AML/CTF programs must
include a Part B program. To identify, mitigate and manage money laundering and terrorism financing (ML/TF) risk,
you need ongoing customer due diligence processes. This includes developing and
documenting an enhanced customer due diligence program and a transaction
monitoring program in Part A of your AML/CTF program. Holders of an Australian Financial Services Licence (AFSL) who arrange for their
customers to receive a designated service, and do not provide any other designated
services, do not have to have a Part A program. Customer identification and ongoing customer due diligence processes will help you
identify unusual transactions and behaviour, to identify and manage high-risk customers
and report suspicious matters when appropriate.

11.8 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

11.9 Where the ordering institution is unable to comply with the requirements in paragraphs
11.3 to 11.8, it shall not execute the wire transfer.
Responsibility of the Beneficiary Institution

11.10 A bank that is a beneficiary institution shall take reasonable measures, including post-
event monitoring or real-time monitoring where feasible, to identify cross-border wire
transfers that lack the required wire transfer originator or required wire transfer beneficiary
information.

11.11 For cross-border wire transfers, a beneficiary institution shall identify and verify the
identity of the wire transfer beneficiary if the identity has not been previously verified.

11.7 In a domestic wire transfer, every finance company that is an ordering institution shall
either -
(a) include in the message or payment instruction that accompanies or relates to the
wire transfer the following:
(i) the name of the wire transfer originator;
(ii) the wire transfer originator's account number (or unique transaction
reference number where no account number exists); and
(iii) any of the following
(A) the wire transfer originator's:
(1) residential address; or
(2) registered or business address, and if different, principal place
of business,
as may be appropriate;
(B) the wire transfer originator's unique national identification number
(such as an identity card number, birth certificate number or passport
number, or where the wire transfer originator is not a natural person,
the incorporation number or business registration number);
(C) the date and place of birth, incorporation or registration of the wire
transfer originator (as may be appropriate); or
(b) include only the wire transfer originator's account number (or unique transaction
reference number where no account number exists), provided -
(i) that these details will permit the transaction to be traced back to the wire
transfer originator and wire transfer beneficiary;
(ii) the ordering institution shall provide the wire transfer originator information
set out in paragraph 11.7(a) within 3 business days of a request for such
information by the beneficiary institution, by the Authority or other relevant
authorities in Singapore; and
(iii) the ordering institution shall provide the wire transfer originator information
set out in paragraph 11.7(a) immediately upon request for such information
by law enforcement authorities in Singapore.

Explanation: AUSTRAC AML/CTF and MAS AML/CFT Notices are parallel implementations of FATF standards in two distinct jurisdictions, with separate regulated populations and separate reporting channels. A firm operating in both jurisdictions complies with both. The two regimes are equivalence candidates (and labelled as such in equivalences.jsonl) rather than conflicting. No obligation in one points against any obligation in the other.

Two regulators asserted jurisdiction over the same firm with contradictory record-retention or reporting demands — outside the conflict-detection scope here.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The EU PSD2 passages regulate the technical and operational requirements for payment services, specifically strong customer authentication (SCA) and security credentials (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The SG Foundational Legislation passages discuss the regulation of digital tokens, ICOs, and the Payment Services Act (PS Act) in the context of securities and AML/CFT compliance (chunk_ids b49627bb889ef1d9::3ef::7168, d6f4be6b9d136778::467::12af). The obligations in the EU regime relate to the authentication of payment transactions, while the SG regime addresses the authorisation and conduct of digital token issuers and exchanges. These are distinct regulatory domains; there is no specific obligation in the EU PSD2 that directly conflicts with the obligations in the Singapore Payment Services Act or MAS directives regarding digital tokens.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: Regime A (INT_BASEL_CRYPTO) regulates capital requirements and risk-weighting for bank exposures to financial institutions, including securities firms and central counterparties. Regime B (SG_FSMA_DTSP) regulates the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022. The obligations in Regime A relate to prudential supervision and capital adequacy for banks, while the obligations in Regime B relate to the licensing and operational conduct of DTSPs. The passages confirm that these regimes govern distinct entities and activities (banks vs. DTSPs) and do not impose conflicting obligations on the same subject matter. Therefore, the regimes are in different domains.


ASIC crypto-asset guidance (INFO 225 / RG 282)

AU Treasury Digital Asset Platforms proposals

A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

An update in 2018 introduced the term 'crypto-asset' into INFO 225.
4 INFO 225 was updated in 2019, adding further information and broader
consideration of when crypto-assets and related products may be financial
products, and can interact with the existing financial services laws.
5 It was further updated in 2021 to add good practice guidance for investment
products providing exposure to crypto-assets. This followed Consultation
© Australian Securities and Investments Commission December 2024 Page 6 Paper 343 Crypto-assets as underlying assets for ETPs and other investment
products (CP 343) and Report 705 Response to submissions on CP 343
Crypto-assets as underlying assets for ETPs and other investment products
(REP 705). The title was changed at that time to Information Sheet 225
Crypto-assets to more accurately reflect the scope of the guidance already
included. The need to update INFO 225
6 The digital asset market has continued to develop significantly in recent
years, with new digital asset products and services being offered.

RG 282.139 For crypto-assets that are also financial products, market operators should be
satisfied that there is a pricing mechanism for those crypto-assets which is as
robust and transparent as those used by non-crypto-assets of that class of
financial product.
Admission and monitoring standards

RG 282.140 For all crypto-asset ETPs, we expect market operators to be satisfied that the
structure and operation of the product appropriately account for the unique
characteristics and risks of crypto-assets. We expect market operators to
consider the good practices for crypto-asset investment products set out in
INFO 225 and verify, as part of the admission process, that the structure and
operation of the product seeking admission are consistent with the good
practices outlined in INFO 225. It is also good practice for market operators
to periodically assess whether admitted crypto-asset ETPs are maintaining an
appropriate structure and operation.
Disclosure of portfolio holdings

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

117. The token mapping framework defines the concepts of 'tokens', 'token systems' and 'functions'.
A crypto token performs the record keeping role. It is analogous to a physical token or an entry
in a registry. A token system is the business or social protocol, or mechanism. It is the steps
taken to perform a function in relation to crypto tokens. A function is the product or benefit
provided by a token system.
Insights

118. The crypto ecosystem is not a homogenous industry sector and crypto assets are not a
homogenous asset class. The process of assessing crypto related products against the functional
perimeter is no different than the process for assessing any other product.

5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

Explanation: ASIC's INFO 225 / RG 282 architecture turns on whether a given crypto-asset is a 'financial product' under the Corporations Act. Treasury's Token Mapping consultation and the DAP Proposal are explicitly designed around resolving that classification question — Treasury notes (DAP Proposal page 3) that 'digital asset platforms that do not deal in financial products are not subject to financial services laws'. Whether any particular token falls inside ASIC's licensing perimeter, or outside it (and within Treasury's proposed parallel DAP regime), depends on facts about the token's function — consumptive vs investment, pooled vs direct, payment-token-like vs security-like — that are themselves the subject of the Token Mapping framework. This is interpretive_fact_sensitive in the strict sense: the typology is the conflict.

Apply ASIC's existing financial-product tests case-by-case until Token Mapping + DAP legislation crystallises a clear taxonomy.

Treasury DAP framework is at consultation/proposal stage and may evolve before enactment.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure of personal information) and EU_AMLR_TFR (EU AML regulation extending AML/CFT to CASPs and mandating originator/beneficiary information for crypto transfers — Regulation 2023/1113). When EU CASPs send crypto value to AU counterparties, the TFR's mandated personal-data sharing engages APP 8 restrictions on the AU side (and vice versa). Operationally resolvable via APP 6.2(b) (use/disclosure required or authorised by law) plus APP 8.2(d) permitted general situation, layered with GDPR Chapter V mechanisms for the EU side. Same cross-jurisdictional AML-privacy shape.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU DAC 8 crypto-asset tax-reporting directive and EU Market Abuse Regulation operate in disjoint regulatory domains at the obligation level. Crypto-tax reporting vs market abuse regulation — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

Explanation: AU_ATO_CRYPTO (ATO crypto-asset tax framework — reporting and recordkeeping on AU taxpayers' crypto-asset disposals and holdings, including those involving EU counterparties or operators) and EU_GDPR (Article 44+ cross-border data transfer restrictions). When AU exchanges and crypto-asset operators serve EU-resident customers or hold EU-side data, ATO reporting can require transmitting personal data from the EU to AU. GDPR Chapter V restrictions engage. Operationally resolvable via GDPR Art. 6(1)(c) + Chapter V mechanism (adequacy, SCCs, or Art. 49 derogation). Same conflict shape as DAC8 × PDPA, applied to AU-EU tax-reporting framework.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: AU_TREASURY_DAP (Australia's proposed crypto-asset platform licensing) and SG_PSA_DPT (Singapore's Payment Services Act Digital Payment Token service licensing, under MAS PSN02). Both establish jurisdiction-specific licensing for entities providing crypto-asset / DPT services. Neither contains a transit pathway recognising the other's authorisation. Same structural-non-transit pattern as AU_DAP ↔ EU_MICA.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The EU MIFID2 passages regulate investment firms' obligations regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1, Article 24, Article 25). The SG_FSMA_DTSP passages regulate the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022, including the requirement to hold a licence and the definition of DTSPs. The obligations in MIFID2 relate to the suitability of financial instruments for clients, whereas the obligations in the SG regime relate to the licensing and risk management of digital token service providers. The two regimes regulate distinct domains of financial services conduct and licensing, with no specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are in non-conflict.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

Explanation: EU_EMD2 (E-Money Directive 2 — EMI customer KYC for issuance and redemption, including AML/CFT obligations on EMI issuers) and SG_PDPA. EU EMIs serving SG-resident customers must collect identification data for issuance and may transmit to SG counterparties; PDPA restricts. Operationally resolvable via PDPA s.13(b) carve-out + SG MAS AML notice framework. Same KYC×privacy cross-jur conflict shape as the labelled EU TFR ↔ EU GDPR conflict.


Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU_EMD2 passages discuss the Digital Operational Resilience Act (DORA) and financial rules for the European Union Authority, focusing on digital resilience and financial administration. The MAS_TRM passages discuss the Monetary Authority of Singapore's (MAS) response to feedback on guidelines for licensees, specifically the TRM Guidelines, Fit and Proper Criteria, and Business Continuity Management. The obligations in EU_EMD2 regarding digital operational resilience and financial rules do not overlap with the obligations in MAS_TRM regarding internal processes for inaccurate representations, sector-specific competencies, and principles-based risk assessments. Therefore, the regimes regulate different domains and do not conflict.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Explanation: The Australian regime (AU_ATO_CRYPTO) focuses on the taxation and regulatory mapping of crypto assets, specifically regarding their adoption and classification (chunk_id e6bb47e92e88e16c::567::36c4). The EU regime (EU_NIS2) addresses cybersecurity measures for operators of essential services and digital operational resilience in the financial sector, specifically regarding access controls and cryptography policies (chunk_id 3c9eb3a25c93f394::474::4786). The obligations in these regimes regulate distinct domains—taxation and classification versus cybersecurity and resilience—resulting in no overlap or conflict.


1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The Australian regime (AU_ATO_CRYPTO) focuses on tax compliance and the mapping of crypto assets, specifically noting the tax treatment of over 1 million Australians holding crypto (chunk_id e6bb47e92e88e16c::567::36c4). The Singapore regime (SG_PSA_GENERAL) focuses on the licensing and regulatory scope of Digital Payment Token (DPT) services under the Payment Services Act, including transitional exemptions for entities currently operating DPT services (chunk_id 321e082bdbe732d3::309::b080). The passages describe distinct regulatory domains: one governing tax obligations and the other governing financial services licensing and conduct. There is no evidence of a specific obligation in one regime that directly conflicts with a specific obligation in the other.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: AU_APRA_CPS230 (APRA Prudential Standard CPS 230 — Operational Risk Management including service-provider arrangements) and SG_MAS_OUTSOURCING (MAS Outsourcing Guidelines — material outsourcing arrangements with third-party service providers). Both address third-party / outsourcing risk for regulated financial entities in their respective jurisdictions. Reinforcing concerns — entities operating across both face complementary outsourcing-management duties.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Explanation: AMLR/TFR addresses AML/CFT — customer due diligence, information accompanying transfers, suspicious-transaction reporting. The Market Abuse Regulation addresses market abuse — insider dealing, unlawful disclosure of inside information, market manipulation. The two regimes apply to overlapping populations (some EU obliged entities are also in-scope of MAR), but the subject matters are disjoint. No AMLR/TFR obligation pushes against any MAR obligation. Hard negative.

MAR Art 16 STOR (suspicious transaction or order report) regime conflicted with AMLR SMR confidentiality — in practice both regimes have parallel reporting channels and confidentiality protections.


Article 37
Specific enhanced due diligence measures for cross-border correspondent relationships for crypto-asset service
providers
1. By way of derogation from Article 36, with respect to cross-border correspondent relationships involving the
execution of crypto-asset services, with a respondent entity not established in the Union and providing similar services,
including transfers of crypto-assets, crypto-asset service providers shall, in addition to the customer due diligence measures
laid down in Article 20, when entering into a business relationship, be required to:
(a) determine if the respondent entity is licensed or registered;
68/111 ELI: http://data.europa.eu/eli/reg/2024/1624/oj EN
(b) gather sufficient information about the respondent entity to understand fully the nature of the respondent's business
and to determine from publicly available information the reputation of the entity and the quality of supervision;
(c) assess the respondent entity's AML/CFT controls;
(d) obtain approval from senior management before establishing the new correspondent relationship;
(e) document the respective responsibilities of each party to the correspondent relationship;
(f) with respect to payable-through crypto-asset accounts, be satisfied that the respondent entity has verified the identity of,
and performed ongoing due diligence on, the customers having direct access to accounts of the correspondent entity,
and that it is able to provide relevant customer due diligence data to the correspondent entity, upon request.

Authorisation as a crypto-asset service provider pursuant to Article 59 is not required for providing custody and
administration of crypto-assets on behalf of clients or for providing transfer services for crypto-assets in relation to
crypto-assets whose offers to the public are exempt pursuant to paragraph 3 of this Article, unless:
(a) there exists another offer to the public of the same crypto-asset and that offer does not benefit from the exemption;
or
(b) the crypto-asset offered is admitted to a trading platform.
6. Where the offer to the public of the crypto-asset other than an asset-referenced token or e-money token concerns
a utility token providing access to goods and services that do not yet exist or are not yet in operation, the duration of
the offer to the public as described in the crypto-asset white paper shall not exceed 12 months from the date of
publication of the crypto-asset white paper.
7. Any subsequent offer to the public of the crypto-asset other than an asset-referenced token or e-money token shall
be deemed a separate offer to the public to which the requirements of paragraph 1 apply, without prejudice to the
possible application of paragraph 2 or 3 to the subsequent offer to the public.

Article 65
Cross-border provision of crypto-asset services
1.
A crypto-asset service provider that intends to provide crypto-asset services in more than one Member State shall
submit the following information to the competent authority of the home Member State:
(a) a list of the Member States in which the crypto-asset service provider intends to provide crypto-asset services;
(b) the crypto-asset services that the crypto-asset service provider intends to provide on a cross-border basis;
(c) the starting date of the intended provision of the crypto-asset services;
(d) a list of all other activities provided by the crypto-asset service provider not covered by this Regulation.
2.
The competent authority of the home Member State shall, within 10 working days of receipt of the information
referred to in paragraph 1, communicate that information to the single points of contact of the host Member States, to
ESMA and to EBA.
3.
The competent authority of the Member State that granted authorisation shall inform the crypto-asset service
provider concerned of the communication referred to in paragraph 2 without delay.
4.
The crypto-asset service provider may begin to provide crypto-asset services in a Member State other than its
home Member State from the date of receipt of the communication referred to in paragraph 3 or at the latest from the
15th calendar day after having submitted the information referred to in paragraph 1.
CHAPTER 2
Obligations for all crypto-asset service providers

Explanation: Both regulations apply to EU crypto-asset service providers but on non-overlapping obligation surfaces. MiCA is the market-conduct and authorisation regime (CASP authorisation, white papers for ART/EMT, cross-border passporting under Art. 65). The AMLR/TFR adds AML/CFT obligations on the same CASPs: enhanced CDD for cross-border crypto relationships (AMLR Art. 37) and travel-rule information transmission (TFR Arts. 14–21). A CASP must comply with both, and the requirements are layered rather than opposing — MiCA tells you who can operate, AMLR/TFR tells you what AML controls you must apply once you do.

MiCA Title V exemptions ever contradicted AMLR scope (e.g. exempted a service that AMLR captures as an 'obliged entity'); current text aligns the scopes via cross-referencing.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

Explanation: The EU_MICA passages discuss the prevention of market abuse involving crypto-assets and the licensing requirements for crypto-asset service providers (chunk_id a0d157539d5c8040::2fc::beb4). The FATF_R16 passages focus on global anti-money laundering (AML) and counter-terrorist financing (CFT) standards, specifically guidance on digital identity and red flag indicators for virtual assets (chunk_id 5d489619a0fb9ecf::377::a91e). The obligations in MiCA regarding market abuse prevention and licensing do not directly oppose the FATF's AML/CFT obligations; rather, they operate in complementary domains to ensure the integrity and security of crypto-asset markets.


Initial views from consultation paper
• Consultation paper focussed on • Stakeholders noted the complexity
market licensing, custody and token of introducing new regulation
mapping
• Most stakeholders agreed that
• Divergent views among many issues there is a need for custody
regulation
• Most agree that self-regulation is
not appropriate - Hard to implement detailed standards
as each custodian operates differently
• Differing views about creating
- Capital requirements, insurance and
bespoke regime or using the Corps
liability for loss needs to be quite
Act
specific
- Sophisticated or larger stakeholders
- No meaningful support for a domestic
prefer more rigorous regulation (Corps
location requirement. Act). Key terms and concepts
• Blockchain • Crypto assets
- A digital ledger comprised of - A useful blanket term that covers on-
unchangeable, digitally recorded data chain assets: cryptocurrencies, NFTs,
in packages called blocks. and other, still emerging, products.
- Each block is 'chained' to the next
block using a cryptographic signature.
• Web3 / Web 3.0
- Ethereum is a public blockchain, open
- Web3, or Web 3.0, are terms used
to the world; its digital ledger is
synonymously with "the decentralized
distributed, or synced, between many
web" and are often used to refer,
nodes; these nodes arrive at
broadly, to the blockchain and
consensus regarding whether a
decentralized technology ecosystems
transaction is valid before encrypting a
as a whole.
number of transactions into a block

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The evidence from AU_CORPS_ACT focuses on the interaction of the Corporations Act with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up (chunk_ids 0fc4f857c226f510::375::66b5, c2e00b4f25de0d0c::371::2e15). It also contains a consultation paper discussing market licensing and custody regulation for crypto assets (chunk_id d75262e404517e0c::5e6::a0b1). The evidence from SG_FSMA_DTSP focuses on the regulatory framework for Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022, including definitions, licensing requirements, and FATF-aligned AML/CFT standards (chunk_ids 20d526d712753652::404::80be, cc1be49e9cf8c821::2f4::ea8f). While both regimes address digital assets, the specific obligations cited in the SG_FSMA_DTSP passages (licensing, FATF alignment) do not directly contradict or override the specific provisions or interaction rules cited in the AU_CORPS_ACT passages. The regimes regulate different aspects of corporate governance and digital asset service provision without creating a specific, actionable conflict between the cited obligations.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: INT_BASEL_CRYPTO (regime A) and SG_MAS_PRUDENTIAL_CRYPTO (regime B) both regulate prudential treatment of crypto-asset exposures. SG MAS is explicitly considering a risk-based capital framework for SCS issuers (B's passage) consistent with the Basel approach to bank exposures (A's passage). SG implements Basel as part of its prudential framework; the regimes reinforce each other.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The EU regime regulates the solicitation of clients by third-country crypto-asset firms (reverse solicitation exemption), while the Singapore regime mandates AML/CFT training for life insurers and general AML/CFT due diligence for banks. The obligations in Regime A (marketing crypto-assets to clients who initiated the relationship) do not impose a specific negative constraint on the obligations in Regime B (training and due diligence). The Singapore obligations apply to life insurers and banks, whereas the EU obligations apply to crypto-asset service providers. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The EU MICA Title IV EMT regime regulates the disclosure obligations of issuers of e-money tokens, specifically requiring the notification of crypto-asset white papers to competent authorities and ensuring the information provided is complete, fair, and clear (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The FATF R16 regime focuses on anti-money laundering and counter-terrorist financing (AML/CFT) standards and guidance, including digital identity and virtual assets (chunk_ids 5d489619a0fb9ecf::377::a91e, 85240528438654b9::396::417b). The obligations in the EU regime relate to the transparency and accuracy of marketing disclosures for token issuance, while the FATF regime addresses the systemic risks of money laundering and terrorist financing. These are distinct regulatory domains; the EU disclosure requirements do not impose specific AML/CFT obligations that conflict with FATF standards, nor do the FATF standards prescribe specific disclosure formats that would contradict the EU's detailed white paper requirements. Therefore, the regimes are non-conflicting.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

Article 3
Definitions
For the purposes of this Regulation, the following definitions shall apply:
(1) 'digital operational resilience' means the ability of a financial entity to build, assure and review its operational integrity
and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service
providers, the full range of ICT-related capabilities needed to address the security of the network and information
systems which a financial entity uses, and which support the continued provision of financial services and their
quality, including throughout disruptions;
(2) 'network and information system' means a network and information system as defined in Article 6, point 1, of
Directive (EU) 2022/2555;
(3) 'legacy ICT system' means an ICT system that has reached the end of its lifecycle (end-of-life), that is not suitable for
upgrades or fixes, for technological or commercial reasons, or is no longer supported by its supplier or by an ICT
third-party service provider, but that is still in use and supports the functions of the financial entity;
(4) 'security of network and information systems' means security of network and information systems as defined in

Explanation: The AU Travel Rule passages discuss the implementation of FATF's 'Travel Rule' for digital currency exchanges and remittance providers, focusing on customer identification and transaction transparency obligations. The EU DORA passages define 'digital operational resilience' and 'ICT third-party risk management' requirements for financial entities. The obligations are distinct: one relates to AML/CTF transaction monitoring and beneficial ownership visibility, while the other relates to the security and resilience of ICT systems and third-party service providers. There is no specific obligation in AU Travel Rule that pushes against a specific obligation in EU DORA. Therefore, the regimes are in different domains.


Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

(Please refer to paragraph 12 of the draft FSM Notice). The proposed requirements for Correspondent Account Services (CAS) in paragraph
5.6 of the draft FSM Notice are both applicable and appropriate for the digital token
service provider (DTSP) sector. Given the inherent cross-border nature and rapid
transactions within digital token services, the FATF-aligned risk mitigation measures
ensure that DTSPs are aligned with global AML/CFT standards, providing a secure
framework for correspondent services while addressing potential ML/TF risks. Applicability of Risk Mitigation Measures
The requirement for DTSPs to assess the suitability of financial institutions when
providing or receiving CAS, including evaluating their AML/CFT controls, is essential
for preventing potential misuse of these services. The dynamic and often cross-
jurisdictional interactions in digital token services make these standards particularly
relevant to ensuring consistent risk management. MAS could consider offering
guidance on specific factors DTSPs should evaluate, such as transaction monitoring
capabilities and the jurisdiction's regulatory reputation, to better equip licensees in
applying a comprehensive assessment.

Explanation: The EU DORA regime regulates the digital operational resilience and ICT risk management of financial entities and their third-party service providers (chunk_ids 85307f9e2a040982::3d7::f935, 85307f9e2a040982::5f2::974e). In contrast, the SG_FSMA_DTSP regime regulates the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022 (chunk_ids cc1be49e9cf8c821::2f4::ea8f, 20d526d712753652::404::80be). While both regimes involve third-party risk and cross-border considerations, the SG regime focuses on licensing, AML/CFT compliance, and FATF alignment (chunk_ids cc1be49e9cf8c821::2f4::ea8f, 20d526d712753652::4b9::b812), whereas DORA focuses on ICT resilience and incident reporting. The obligations do not push against one another; they regulate distinct aspects of the financial ecosystem. Therefore, the relationship is non_conflict / different_domains.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The regimes regulate distinct domains. Regime A (AU_ATO_CRYPTO) concerns the taxation and regulation of crypto assets in Australia, including token mapping and consumer interest. Regime B (INT_BASEL_GENERAL) concerns the Basel III framework for banking regulation, specifically the leverage ratio and treatment of fiduciary assets. The cited passages from Regime A discuss crypto adoption and tax compliance, while the cited passages from Regime B discuss accounting frameworks for banks and leverage ratio exposure measures. There is no specific obligation in one regime that pushes against a specific obligation in the other.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical cash transactions exceeding A$10,000 to AUSTRAC (chunk_ids 6dfe4e63b9fb3c74::3bc::1a3f, 254ca2d92d196180::377::d0c6). The EU_PSD2 regime regulates the authentication of payment transactions, specifically strong customer authentication (SCA) for online and remote payments (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The obligations are distinct: one is a financial crime reporting requirement for cash thresholds, while the other is a security and authentication standard for electronic payment initiation. There is no specific obligation in PSD2 that conflicts with the AUSTRAC TTR reporting obligation. Therefore, the regimes are in different domains.