For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's regulatory reform agenda for crypto assets, specifically 'token mapping' and licensing frameworks for financial services (chunk_ids d75262e404517e0c::47b::7c9f, e6bb47e92e88e16c::37a::29f6). In contrast, the SG_PDPA passages regulate the collection, use, and disclosure of personal data under Singapore's Personal Data Protection Act, focusing on consent requirements and data handling (chunk_id 0e996ae99839f19e::37b::85a8). The obligations in the Australian crypto asset reform do not impose specific data protection requirements that conflict with the Singapore PDPA's consent and data handling rules. Therefore, the regimes regulate different domains.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The EU MiCA passages focus on the licensing requirements, application procedures, and public register obligations for Crypto-Asset Service Providers (CASPs) under Article 62 and 109. The FATF passages focus on global AML/CFT standards, specifically regarding Digital Identity and Virtual Assets. While MiCA requires CASPs to be licensed and FATF provides guidance on customer due diligence and red flags for virtual assets, the specific obligations cited in the passages do not create a direct legal conflict. MiCA establishes the licensing framework, while FATF provides international standards for AML/CFT compliance that generally reinforce the need for regulated entities to adhere to due diligence requirements. The regimes regulate different aspects of the same activity (licensing vs. AML/CFT standards) and do not appear to push against one another in a way that creates an unresolved conflict.


Authorisation as a crypto-asset service provider pursuant to Article 59 is not required for providing custody and
administration of crypto-assets on behalf of clients or for providing transfer services for crypto-assets in relation to
crypto-assets whose offers to the public are exempt pursuant to paragraph 3 of this Article, unless:
(a) there exists another offer to the public of the same crypto-asset and that offer does not benefit from the exemption;
or
(b) the crypto-asset offered is admitted to a trading platform.
6. Where the offer to the public of the crypto-asset other than an asset-referenced token or e-money token concerns
a utility token providing access to goods and services that do not yet exist or are not yet in operation, the duration of
the offer to the public as described in the crypto-asset white paper shall not exceed 12 months from the date of
publication of the crypto-asset white paper.
7. Any subsequent offer to the public of the crypto-asset other than an asset-referenced token or e-money token shall
be deemed a separate offer to the public to which the requirements of paragraph 1 apply, without prejudice to the
possible application of paragraph 2 or 3 to the subsequent offer to the public.

Article 65
Cross-border provision of crypto-asset services
1.
A crypto-asset service provider that intends to provide crypto-asset services in more than one Member State shall
submit the following information to the competent authority of the home Member State:
(a) a list of the Member States in which the crypto-asset service provider intends to provide crypto-asset services;
(b) the crypto-asset services that the crypto-asset service provider intends to provide on a cross-border basis;
(c) the starting date of the intended provision of the crypto-asset services;
(d) a list of all other activities provided by the crypto-asset service provider not covered by this Regulation.
2.
The competent authority of the home Member State shall, within 10 working days of receipt of the information
referred to in paragraph 1, communicate that information to the single points of contact of the host Member States, to
ESMA and to EBA.
3.
The competent authority of the Member State that granted authorisation shall inform the crypto-asset service
provider concerned of the communication referred to in paragraph 2 without delay.
4.
The crypto-asset service provider may begin to provide crypto-asset services in a Member State other than its
home Member State from the date of receipt of the communication referred to in paragraph 3 or at the latest from the
15th calendar day after having submitted the information referred to in paragraph 1.
CHAPTER 2
Obligations for all crypto-asset service providers

11.8 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

11.9 Where the ordering institution is unable to comply with the requirements in paragraphs
11.3 to 11.8, it shall not execute the wire transfer.
Responsibility of the Beneficiary Institution

11.10 A bank that is a beneficiary institution shall take reasonable measures, including post-
event monitoring or real-time monitoring where feasible, to identify cross-border wire
transfers that lack the required wire transfer originator or required wire transfer beneficiary
information.

11.11 For cross-border wire transfers, a beneficiary institution shall identify and verify the
identity of the wire transfer beneficiary if the identity has not been previously verified.

15.10 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

15.11 Where the ordering institution is unable to comply with the requirements in paragraphs
15.3 to 15.10, it shall not execute or arrange for the wire transfer.

Responsibility of the Beneficiary Institution

15.12 A payment service provider that is a beneficiary institution shall take reasonable
measures, including post-event monitoring or real-time monitoring where feasible, to
identify cross-border wire transfers that lack the required wire transfer originator or
required wire transfer beneficiary information.

15.13 For cross-border wire transfers where the beneficiary institution pays out funds in cash or
cash equivalent to the wire transfer beneficiary in Singapore, a beneficiary institution shall
identify and verify the identity of the wire transfer beneficiary if the identity has not been
previously verified.

Explanation: MiCA is an EU authorisation and conduct regime for issuers and CASPs operating in the EU; the MAS AML/CFT Notices are Singapore-law obligations on MAS-regulated FIs (banks, merchant banks, finance companies, PSPs). They operate on different regulated populations in different jurisdictions and on different subject matters: market authorisation/conduct vs AML/CFT operational controls. A firm that is both a MiCA-authorised CASP and a MAS-regulated FI must comply with both, but there is no obligation in one that pushes against any obligation in the other. A labeller might think they conflict because both touch crypto-finance, but on inspection the domains are disjoint at the obligation level.

MiCA contained a provision purporting to authorise conduct that MAS AML/CFT Notices would prohibit for a Singapore-regulated entity (it does not).


2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: The EU_MICA passages describe the regulatory framework for crypto-asset service providers, including the provision of advice on crypto-assets and the issuance of guidelines on competence (chunk_id f9082873c5d9ba9d::302::bbe0). The SG_AML passages focus on AML/CFT controls for the Digital Payment Token (DPT) sector, specifically supervisory expectations and requirements for DPT service providers (chunk_id 018117ef1e757630::428::d321). While both regimes regulate the crypto-asset sector, they address distinct regulatory domains: MiCA establishes the licensing and conduct standards for crypto-asset service providers, whereas the Singapore AML/CFT guidelines focus on the prevention of money laundering and terrorism financing for DPT service providers. There is no specific obligation in MiCA that directly conflicts with the AML/CFT obligations in the Singapore guidelines; rather, they operate in complementary domains to ensure the integrity of the crypto-asset market.


Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

Explanation: The EU_MICA passages discuss crypto-asset service provision, market abuse prevention, and MiCA's regulatory framework for digital assets. The INT_BASEL_GENERAL passages discuss banking regulation, leverage ratios, and capital adequacy for traditional financial institutions. The obligations and subject matter are distinct; there is no specific obligation in MiCA that pushes against a specific obligation in Basel III. Therefore, the regimes are in different domains.


57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

Explanation: AU_TREASURY_DAP (Australia's proposed DAP framework — Treasury consultation, token-mapping context) and EU_MICA_RTS (EU MiCA regulatory technical standards for CASP authorisation, qualifying-holding acquisitions). Both are crypto-asset service licensing regimes in different jurisdictions with different mechanisms. Distinct perimeters; no obligation conflict.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

1.2 These Guidelines1 on Outsourcing ("Guidelines") set out the Monetary Authority of
Singapore's ("MAS") expectations of an institution that has entered into any outsourcing
arrangement or is planning to outsource its business activities2 to a service provider. An
institution should conduct a self-assessment of all existing outsourcing arrangements against
these Guidelines3.

Explanation: The evidence for the Australian regime (AU_ATO_CRYPTO) focuses on the taxation of crypto assets and the government's reform agenda (chunk_id e6bb47e92e88e16c::567::36c4). The evidence for the Singaporean regime (SG_MAS_OUTSOURCING) outlines the Monetary Authority of Singapore's (MAS) expectations for institutions managing outsourcing arrangements (chunk_id a82833dc0f7ca903::17a::c743). The obligations in the Australian passage relate to tax compliance and reporting, while the obligations in the Singaporean passage relate to supervisory access and information rights regarding service providers. These are distinct regulatory domains with no apparent overlap of obligations.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The EU_NIS2 passage discusses the technical and methodological requirements for access control policies and ICT security measures under Directive (EU) 2022/2555 (NIS2) and Directive (EU) 2022/2557 (Critical Entities Regulation). The SG_STABLECOIN passage outlines the scope of Singapore's stablecoin regulatory regime, specifically focusing on Single-Currency Stablecoins (SCS) issued in Singapore and their treatment under the Payment Services Act 2019. The obligations in the EU_NIS2 passage relate to cybersecurity and access controls for operators of essential and important services, while the obligations in the SG_STABLECOIN passage relate to the issuance and regulation of stablecoins. These are distinct regulatory domains with no apparent overlap of obligations. Therefore, the regimes are in non-conflict.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Explanation: The evidence for AU_APRA_CPS230 focuses on operational resilience, business continuity, and the management of service providers to ensure critical operations continue through disruptions (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for EU_GDPR focuses on the lawful transfer of personal data to third countries and the general principles governing such transfers (chunk_ids bd84e63f5b622b73::6a8::d132, bd84e63f5b622b73::304::fe8e). The obligations in CPS 230 regarding maintaining critical operations and managing service providers do not directly oppose the GDPR's requirements regarding data transfers. Therefore, the regimes regulate distinct domains and do not conflict.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_ASIC_AFSL regime regulates the licensing requirements for Australian financial services providers (AFSLs) dealing in digital asset facilities, focusing on the provider's status and financial resources (chunk 550958b067dc6726::709::b159). The EU_REVERSE_SOLICITATION regime addresses the conditions under which third-country crypto-asset service providers can offer services to clients in the EU without authorisation, specifically when the client initiates the relationship (chunk 25cbbd878a1b21d3::4f8::561c). The obligations in Regime A relate to the provider's licensing and financial standing, while Regime B relates to the client's initiative and the provider's solicitation activities. These are distinct regulatory domains; one governs the provider's eligibility to operate, and the other governs the permissible marketing and service provision methods to EU clients. Therefore, there is no direct conflict between the regimes.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: EU_AMLA (EU's Anti-Money Laundering Authority — Articles 62-63 of AMLD6, cooperation with national supervisors) and SG_MAS_AML_GENERAL (MAS's AML/CFT supervisory framework). Both implement AML/CFT supervisory architecture in their jurisdictions consistent with FATF standards. Reinforcing — no obligation conflict.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: Regime A (AU_TTR_THRESHOLD) regulates the reporting of physical cash transactions exceeding A$10,000 to AUSTRAC. Regime B (INT_BASEL_CRYPTO) regulates the capital requirements and risk weighting of bank exposures to financial institutions. The obligations in Regime A relate to anti-money laundering reporting thresholds for cash, while Regime B addresses prudential capital adequacy for banking institutions. The specific obligations in Regime A do not impose requirements on the capital treatment of exposures or the risk weighting of counterparties, nor do they interact with the Basel framework's definitions of bank exposures or supervisory equivalence. Therefore, the regimes regulate distinct domains and do not conflict.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: The regimes regulate distinct aspects of the digital asset ecosystem. Regime A (AU_TRAVEL_RULE) focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, specifically the identification of parties in value transfers and the registration of Virtual Asset Service Providers (VASPs) and remittance entities. Evidence A confirms Australia is consulting on extending the FATF 'Travel Rule' to digital currency transactions to improve visibility of beneficial ownership (chunk_ids c4a92930a8caf822::380::0a18, cf7cefacba3f94bc::383::7d9d). Regime B (EU_MICA_TITLE_IV_EMT) focuses on the marketing and disclosure requirements for issuers of e-money tokens, specifically the content and liability associated with crypto-asset white papers. Evidence B outlines the obligation for issuers to notify their crypto-asset white paper to competent authorities and the liability for providing misleading information (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other; rather, they address separate compliance pillars (AML/CTF vs. Consumer Disclosure).


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access control policies and resilience measures (chunk_id 3c9eb3a25c93f394::474::4786). The SG_PSA_GENERAL passage discusses the definition of 'safeguarding' for customer assets and the licensing of digital payment token services (chunk_id 14cb9eb911d15322::42b::fe23). The obligations regarding ICT security and access controls under NIS2 do not overlap with the obligations regarding customer asset safeguarding and licensing under the Singapore Payment Services Act. Therefore, the regimes regulate different domains and do not conflict.


On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The EU AMLA regime focuses on the institutional framework for AML/CFT cooperation, information exchange, and supervisory powers (e.g., Article 63 cooperation with AMLA, Article 62 communication of competent authority lists). The Singapore FSMA DTSP regime focuses on the licensing and operational requirements for Digital Token Service Providers (DTSPs), including the definition of DTSPs and the suspension of services outside Singapore by 30 June 2025. The passages describe distinct regulatory domains: one governing the EU AML/CFT institutional structure and the other governing Singaporean licensing for digital token services. There is no specific obligation in the EU AMLA text that creates a conflict with the specific obligations in the Singapore FSMA DTSP text.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: The evidence for the Australian regime (AU_ATO_CRYPTO) focuses on the tax treatment and adoption of crypto assets, specifically noting that over 1 million Australians are expected to include crypto assets on their tax returns (chunk_id e6bb47e92e88e16c::567::36c4). The evidence for the EU regime (EU_MICA_TITLE_V_CASP) focuses on the licensing and authorisation requirements for Crypto-Asset Service Providers (CASPs) under the Markets in Crypto-Assets (MiCA) regulation, specifically detailing the application process for authorisation (chunk_id c51ad46265cea4e5::147::6214). The obligations in these passages regulate distinct aspects of the crypto ecosystem—tax compliance versus licensing requirements—and do not impose conflicting mandates on the same entity or transaction.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

28. Third-country firms should be able to provide records tracking the relationship with the
client and, in particular, whether the client has taken the initiative to receive crypto asset
services with respect to a new product.

5.4 When is a crypto-asset or a crypto-asset service of the same
type as another one (Guideline 4)

29. The reverse solicitation regime leaves open the possibility for a third-country firm to
market crypto-assets or crypto-asset services or activities of the same type in the context
of the relationship started at the own exclusive initiative of a given client, subject to the
third-country firm also complying with Guideline 3 above.

Explanation: The AU_PRIVACY regime regulates the cross-border disclosure of personal information, requiring entities to take reasonable steps to ensure overseas recipients comply with Australian Privacy Principles (APPs) and making the entity accountable for breaches (chunk_ids e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3). The EU_REVERSE_SOLICITATION regime regulates the provision of crypto-asset services by third-country firms to clients in the EU, specifically defining when authorisation requirements under MiCA do not apply (reverse solicitation) and prohibiting solicitation by the firm (chunk_ids 25cbbd878a1b21d3::4f8::561c, 25cbbd878a1b21d3::298::6f7d). The obligations in these regimes address distinct subject matters—data protection and cross-border information flow versus financial services authorisation and client solicitation. There is no specific obligation in AU_PRIVACY that pushes against a specific obligation in EU_REVERSE_SOLICITATION. Therefore, the regimes are in different domains.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU GDPR passages discuss data protection principles, lawful processing, and the transfer of personal data to third countries (e.g., Article 6, Article 44, Recital 89). The SG Foundational Legislation passages discuss the Payment Services Act, MAS enforcement actions regarding digital tokens and securities, and the regulatory scope of securities credit schemes (SCS) issued outside Singapore. The obligations in the EU GDPR relate to the protection of personal data, whereas the obligations in the SG legislation relate to the regulation of payment services and financial market conduct. The passages do not describe a specific obligation in one regime that pushes against a specific obligation in the other; rather, they regulate distinct domains. Therefore, the regimes are in non-conflict.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

4. This guidance is based on the same general principles that govern both the interpretation and
assessment of the FATF standards. As noted in the introduction to the 2012 FATF
"Countries have diverse legal, administrative and operational frameworks and different
Recommendations:
financial systems, and so cannot all take identical measures to counter these threats. The FATF
Recommendations, therefore, set an international standard, which countries should implement
through measures adapted to their particular circumstances."
how

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules) and INT_FATF_GENERAL (FATF AML/CFT principles and guidance). Australia explicitly implements FATF standards through its AML/CTF framework. Reinforcing.


Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

(89) Provision of payment services by the payment services providers may entail processing of personal data. Directive
95/46/EC of the European Parliament and of the Council ( 1) , the national rules which transpose Directive 95/46/EC
and Regulation (EC) No 45/2001 of the European Parliament and of the Council ( 2 ) are applicable to the
processing of personal data for the purposes of this Directive. In particular, where personal data is processed
for the purposes of this Directive, the precise purpose should be specified, the relevant legal basis referred to, the
relevant security requirements laid down in Directive 95/46/EC complied with, and the principles of necessity,
proportionality, purpose limitation and proportionate data retention period respected. Also, data protection by
design and data protection by default should be embedded in all data processing systems developed and used
within the framework of this Directive.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Specific disclosure requirements should be augmented by a general disclosure
requirement.
111 See Principles for Periodic Disclosure by Listed Entities, Final Report, Report of the Technical Committee
of IOSCO, February 2010, pp. 16-17, available at
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD317.pdf; see also Protection of Minority
Shareholders in Listed Issuers, Final Report, Report of the Technical Committee of IOSCO in consultation
with the OECD, June 2009, pp.10-14, available at
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD295.pdf; see also International Disclosure Standards
for Cross-Border Offerings and Initial Listings by Foreign Issuers, supra, Item VII at pp. 18-19;
Disclosure Principles for Public Offerings and Listings of Asset-backed Securities, supra, Principle III at
pp. 10-12; and International Disclosure Principles for Cross-Border Offerings and Listing of Debt
Securities by Foreign Issuers, Final Report, Report of the Technical Committee of IOSCO, March 2007,
Item XI at pp. 23-24, available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD242.pdf.
112 If there are classes of shares or other structural features that would affect share price, these should be
disclosed.

Explanation: The EU GDPR passages regulate the processing of personal data, including legal bases, purpose limitation, and transfers to third countries (chunk_ids bd84e63f5b622b73::6a8::d132, bd84e63f5b622b73::304::fe8e, adb1a81b9cecaf8c::3ac::b555). The INT_IOSCO_GENERAL passages regulate securities regulation, disclosure standards, and methodology for issuers (chunk_ids f173909614befd49::455::1a1a, f173909614befd49::4bf::1d9e). The obligations in the GDPR relate to data protection and privacy, while the obligations in IOSCO relate to financial market integrity and disclosure. There is no specific obligation in the GDPR that pushes against a specific obligation in IOSCO; rather, they govern distinct domains of regulation.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU MICA Title IV EMT passages regulate the specific disclosure obligations of issuers of e-money tokens, including the requirement to notify a crypto-asset white paper to a competent authority and the liability for misleading information (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The MAS TRM passages discuss general feedback on the application of guidelines to licensees, the principles-based nature of the TRM Guidelines, and the Fit and Proper criteria (chunk_ids 20d526d712753652::403::be97, 20d526d712753652::401::f956). The obligations in the EU regime are specific to the content and notification of a white paper, whereas the MAS regime addresses general licensing, governance principles, and risk management. There is no specific obligation in the MAS regime that directly conflicts with the EU's white paper notification or liability requirements. Therefore, the regimes regulate different domains and do not conflict.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The EU_MAR regime regulates market abuse, insider dealing, and market manipulation in financial markets (chunk 5cc4a27bc578287a::165::3333). The SG_PSA_DPT regime regulates the licensing and AML/CFT obligations of Digital Payment Token (DPT) service providers under the Payment Services Act (chunk 4b4c3c417dc293ba::185::f41d). The obligations in the EU_MAR passage relate to the integrity of financial markets and the prevention of market abuse, while the obligations in the SG_PSA_DPT passage relate to the licensing and anti-money laundering controls of payment service providers. These are distinct regulatory domains with no apparent overlap of obligations.


Explanation: Regime A (INT_IOSCO_GENERAL) is a high-level methodology and principles document regarding securities regulation and disclosure standards. Regime B (SG_PSA_DPT) is a Singaporean regulatory notice (MAS Notice PSN02) specifically governing Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations for Digital Payment Token (DPT) service providers. The cited passages from Regime A discuss the general objectives of IOSCO and the importance of disclosure standards, while the cited passages from Regime B establish the legal basis and scope of AML/CFT licensing requirements for DPT providers in Singapore. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they regulate distinct aspects of the financial system (general securities regulation vs. specific AML/CFT licensing for digital assets). Therefore, the regimes are in different domains.


Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

or
(b) means an FX counterparty;
"relevant FX counterparty" is a FX counterparty that is not ⎯
(a) a financial institution as defined in section 2 of the FSM Act; or
(b) a financial institution incorporated or established outside Singapore that is subject
to, and supervised for compliance with, AML/CFT requirements consistent with
standards set by the FATF;
"SFA" means the Securities and Futures Act 2001;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"transaction" means any transaction accepted, processed, or executed by the payment
service provider in the course of carrying on its business of providing a digital payment
token service;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
[MAS Notice PSN02 (Amendment) 202

27 These offences typically relate to cybersecurity issues such as unauthorised access. addition, MAS' off-site monitoring will also enable us to identify and target specific
key risks and initiate supervisory follow-up actions including for-cause inspections
as necessary. Payment Services Act 2019
II-3-2 ML/TF risks have been identified as the primary risk concerns posed by virtual
assets, given the anonymity, speed and cross-border nature of transactions
facilitated by virtual asset providers. Under the Payment Services Act 2019 (PS
Act), MAS will impose AML/CFT requirements on the intermediaries that buy, sell
or exchange virtual assets in Singapore - these are the VASP business models
identified to be operating in Singapore. II-3-3 Under the PS Act, aligned with the FATF standards, DPT service providers are
required to conduct customer due diligence and transaction monitoring measures,
as well as to report suspicious transactions to the authorities. They are also
required to screen and submit information on their customers when transferring
DPTs to one another on behalf of their customers, and make this information
available on request to appropriate authorities in Singapore.

Explanation: SG_IRAS_TAX (Singapore tax framework) and SG_MAS_AML_GENERAL (MAS's broader AML/CFT supervisory framework including FSM Sanctions Regulations and PSN02 AML notice for DPT providers). Same recurring-friction shape: every transaction at a regulated entity generates parallel obligations under both regimes — IRAS tax recordkeeping/reporting AND MAS AML supervision. Severity low; the regimes are designed to coexist but each imposes per-transaction overhead independently.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

Explanation: The obligations in APRA CPS 230 relate to operational risk management, business continuity, and the resilience of critical operations for APRA-regulated entities (chunk_ids f296a7e0bead93df::4a5::9828, f296a7e0bead93df::5e9::d5f4). In contrast, the obligations in EU MAR relate to the prevention and detection of market abuse, insider dealing, and market manipulation (chunk_id 5cc4a27bc578287a::165::3333). The regimes regulate distinct domains—prudential operational resilience versus market integrity and conduct—resulting in no overlap of obligations.


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

A Reporting Crypto-Asset Service Provider is subject to the reporting and due diligence requirements set out in Sections
II and III, respectively, in a Member State with respect to Reportable Transactions effectuated through a Branch based in
a Member State. C. A Reporting Crypto-Asset Service Provider that is an Entity is not required to complete the reporting and due diligence
requirements set out in Sections II and III, respectively, in a Member State it is subject to pursuant to subparagraph A(2),
point (b), (c) or (d), if those requirements are completed by such Reporting Crypto-Asset Service Provider in any other
Member State or in a Qualified Non-Union Jurisdiction by virtue of it being resident for tax purposes in such Member
State or Qualified Non-Union Jurisdiction. D. A Reporting Crypto-Asset Service Provider that is an Entity is not required to complete the reporting and due diligence
requirements set out in Sections II and III, respectively, in a Member State it is subject to pursuant to subparagraph A(2),
point (c) or (d), if those requirements are completed by such Reporting Crypto-Asset Service Provider in any other
Member State or in a Qualified Non-Union Jurisdiction by virtue of it being an Entity that (a) is incorporated or
organised under the laws of such Member State or Qualified Non-Union Jurisdiction and (b) either has legal personality
in the other Member State or Qualified Non-Union Jurisdiction or has an obligation to file tax returns or tax
information returns to the tax authorities in the other Member State or Qualified Non-Union Jurisdiction with respect
to the income of the Entity.

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

27.12.2022 EN Official Journal of the European Union L 333/39
(h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from
post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT
security awareness programmes and digital operational resilience training for staff and management.
2. The ICT risk management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented
and reviewed periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory
instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A
report on the review of the ICT risk management framework shall be submitted to the competent authority upon its
request.
3.

Explanation: DAC8 is a tax-reporting directive; DORA is an ICT-resilience regulation. The two apply to overlapping populations (an EU CASP is in scope of both) but address completely different subject matters: customer / transaction tax data exchange vs ICT risk management framework. No collision possible at the obligation level. Hard negative.

DORA ICT incident-reporting timelines forced disclosure of personal data that DAC8 confidentiality rules limited — current text gives each regime its own confidentiality framework.