(89) Provision of payment services by the payment services providers may entail processing of personal data. Directive
95/46/EC of the European Parliament and of the Council ( 1) , the national rules which transpose Directive 95/46/EC
and Regulation (EC) No 45/2001 of the European Parliament and of the Council ( 2 ) are applicable to the
processing of personal data for the purposes of this Directive. In particular, where personal data is processed
for the purposes of this Directive, the precise purpose should be specified, the relevant legal basis referred to, the
relevant security requirements laid down in Directive 95/46/EC complied with, and the principles of necessity,
proportionality, purpose limitation and proportionate data retention period respected. Also, data protection by
design and data protection by default should be embedded in all data processing systems developed and used
within the framework of this Directive.

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU GDPR passages discuss data protection principles, lawful processing, and international data transfers (e.g., Article 6, Article 44, Recital 89). The MAS TRM passages discuss internal processes for inaccurate representations, the application of guidelines (F&P, TRM, Business Continuity), and principles-based risk assessments. The obligations in the GDPR passages relate to the protection of personal data, whereas the obligations in the MAS TRM passages relate to the conduct of regulated entities and risk management. There is no specific obligation in the GDPR that pushes against a specific obligation in the MAS TRM; rather, they regulate distinct domains of compliance. Therefore, the regimes are in non_conflict.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Explanation: The evidence from AU_TREASURY_DAP discusses the Australian government's 'token mapping' exercise and the development of a licensing framework for crypto asset service providers (chunk_id d75262e404517e0c::47b::7c9f). The evidence from MAS_TRM discusses the application of the 'TRM Guidelines' (Treasury Management Guidelines) to licensees, describing them as principles-based statements of industry best practices (chunk_id 20d526d712753652::401::f956). The two regimes regulate different domains: one is a national regulatory reform agenda for crypto assets in Australia, while the other is a set of operational guidelines for financial institutions in Singapore. There is no specific obligation in one regime that pushes against a specific obligation in the other.


(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The EU regime (Regulation (EU) 2023/1113) establishes obligations for crypto-asset service providers to accompany transfers of funds with information on the payer and payee to ensure traceability for AML/CFT purposes. The Singapore regime (MAS communications and legislative intent) focuses on the authorisation of digital token exchanges and issuers, specifically targeting activities involving securities or futures contracts, and aims to align with international AML/CFT standards. The obligations in the EU regulation relate to the technical traceability of crypto-asset transfers, while the Singapore regime addresses the licensing and conduct of entities offering digital tokens. These are distinct regulatory domains; the EU rules do not impose a specific obligation that conflicts with the Singaporean requirement for authorisation or the MAS's focus on securities tokens. Therefore, the regimes are non-conflicting.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU PSD2 payment-services directive are designed to coexist — obligations apply cumulatively without collision. PSPs are AMLR/AMLD6 obliged entities — supervisory regime applies cumulatively with PSD2. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The FATF passage (chunk 85240528438654b9::396::417b) discusses the FATF's application of standards to 'so-called stablecoins' and the need for guidance. The Singapore passage (chunk 58f45cd2ef3de201::36c::e2f6) outlines the MAS's specific regulatory perimeter for 'Single-currency stablecoins (SCS)' issued in Singapore. The regimes address the same topic (stablecoins) but from different perspectives: FATF provides global AML/CFT standards applicable to VASPs, while MAS defines a domestic regulatory framework for specific stablecoin types. The obligations do not push against one another; rather, FATF standards would inform the AML/CFT obligations within MAS's framework. Therefore, the regimes are non-conflict.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The Australian AML/CTF regime (Regime A) focuses on anti-money laundering obligations for reporting entities, including customer identification, transaction reporting, and suspicious activity reporting (chunk cf7cefacba3f94bc::49a::f39e). The Singapore Payment Services Act (Regime B) passage (chunk 321e082bdbe732d3::309::b080) discusses the regulatory scope of Digital Payment Token (DPT) services, specifically transitional exemptions and licensing requirements. The passages describe distinct regulatory frameworks for different jurisdictions (Australia vs. Singapore) and different regulatory objectives (AML compliance vs. DPT service licensing). There is no evidence of a specific obligation in Regime A that conflicts with a specific obligation in Regime B. Therefore, the regimes are in different domains.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: The evidence from Regime A (AU_AML_CTF) outlines general reporting obligations for suspicious matters and threshold transactions under the AML/CTF Act. The evidence from Regime B (EU_MICA_TITLE_V_CASP) focuses on the specific requirements for applying for authorisation as a Crypto-Asset Service Provider (CASP) under MiCA. The obligations in Regime A relate to financial crime reporting, while the obligations in Regime B relate to market entry and licensing for crypto-asset services. The passages describe distinct regulatory domains and do not impose conflicting obligations on the same activity.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The Basel III framework (Regime A) regulates banking capital adequacy, leverage ratios, and credit risk provisions. The Singapore Digital Token Service Provider (DTSP) regime (Regime B) regulates the licensing and conduct of digital token service providers under the Financial Services and Markets Act 2022. The cited passages from Regime A discuss accounting treatment for fiduciary assets and general provisions (chunk_ids 32afd37cade34f84::34b::8d30, 32afd37cade34f84::25d::6825). The cited passages from Regime B discuss the definition of DTSPs, licensing requirements, and the suspension of services outside Singapore (chunk_ids 20d526d712753652::404::80be, cc1be49e9cf8c821::2f4::ea8f). There is no specific obligation in the Basel framework that conflicts with the licensing or operational obligations of DTSPs under the FSM Act. The regimes regulate distinct sectors (banking vs. digital token services) and different aspects of financial stability.


Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The EU_MICA passages describe obligations for crypto-asset service providers (CASPs) regarding market abuse prevention, knowledge and competence, and the provision of specific crypto-asset services (e.g., advice, asset-referenced tokens). The MAS_TRM passages describe the application of general financial institution guidelines (such as Fit and Proper Criteria and Business Continuity Management) to licensees, and the principles-based nature of the TRM Guidelines. The obligations in EU_MICA are specific to the crypto-asset sector and market integrity, while the obligations in MAS_TRM are general supervisory guidelines applicable to financial institutions. There is no specific obligation in EU_MICA that pushes against a specific obligation in MAS_TRM; rather, they regulate different domains (crypto-asset specific vs. general financial institution supervision).


1.1 The Guidelines on Licensing for Digital Token Service Providers (the "Guidelines")
are intended to provide guidance on the application procedures, licensing criteria and
ongoing requirements for Digital Token Service Providers under Part 9 of the Financial
Services and Markets Act 2022 (the "FSM Act"). Under this, digital token service providers are
defined as individuals, partnerships or Singapore corporations that are operating from a place
of business in Singapore or formed or incorporated in Singapore but carry on a business of
providing digital token services outside Singapore ("DTSPs").

1.2 These Guidelines should be read in conjunction with the provisions of the FSM Act,
the Financial Services and Markets (Digital Token Service Provider) Regulations (the "FSM
Regulations") and other relevant legislation, notices, guidelines and FAQs issued by the
Monetary Authority of Singapore ("MAS").

1.3 MAS will update these Guidelines periodically to provide further guidance.
2. Licence under the FSM Act

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The SG_FSMA_DTSP passages regulate the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022, focusing on AML/CFT obligations, licensing criteria, and the suspension of services outside Singapore by 30 June 2025 (chunk_ids 20d526d712753652::404::80be, cc1be49e9cf8c821::3fc::a271, cc1be49e9cf8c821::2f4::ea8f). In contrast, the SG_IRAS_TAX passages address the Goods and Services Tax (GST) treatment of digital payment tokens, specifically noting that their supply is exempt from GST and that businesses trading in them are no longer liable for GST registration (chunk_ids abc2247bc6415d1d::5c7::68f5, abc2247bc6415d1d::41e::b184). The two regimes regulate distinct aspects of the digital token ecosystem—financial services regulation versus tax treatment—resulting in no direct conflict between the obligations.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

Explanation: The EU MiCA RTS passage discusses the notification obligations for financial entities providing crypto-asset services under Article 60(7) and the development of RTS on sustainability indicators and market abuse (chunk_id=c51ad46265cea4e5::2f5::4513). The Singapore Stablecoin passage outlines the regulatory perimeter for Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from Non-SCS which remain under the existing DPT regime (chunk_id=58f45cd2ef3de201::36c::e2f6). The obligations in MiCA regarding notification and sustainability reporting apply to crypto-asset service providers and issuers within the EU, while the Singapore regime focuses on the specific issuance and reserve requirements of SCS pegged to SGD or G10 currencies. The regimes regulate different aspects of the crypto-asset ecosystem (general crypto-asset service provision and notification vs. specific stablecoin issuance standards) and do not impose conflicting obligations on the same entity or transaction type.


19. Article 62(4) of MiCA sets out that NCAs must not require an applicant CASP to provide
any information referred to in Article 62(2) of MiCA that they have already received under
the respective authorisation procedures in accordance with Directive 2009/110/EC4,
2014/65/EU5 or (EU) 2015/23666, or pursuant to national law applicable to crypto-asset
services prior to the date of entry into force of MiCA, provided that such previously
submitted information or documents are still up-to-date.

3.2 Feedback statement
Q2: Do you agree with the list of information to be provided with an application for
authorisation as a crypto-asset service provider? Please also state the reasons for your
answer.

Explanation: The EU MiCA passages (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::2bc::cafa) focus on the requirements for obtaining authorisation as a Crypto-Asset Service Provider (CASP) and the information required by National Competent Authorities (NCAs). The MAS passages (20d526d712753652::403::be97) discuss internal processes for inaccurate representations and the application of general guidelines (like Fit and Proper Criteria) to licensees. There is no specific obligation in MiCA that conflicts with the MAS guidance on inaccurate representations or general licensing principles. The regimes regulate different aspects of financial services (MiCA specifically for crypto-asset services, MAS for general financial institutions and licensees).


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The evidence for AU_ASIC_CRYPTO focuses on the interpretation of the Corporations Act 2001 regarding crypto-assets as financial products and licensing requirements (chunk_ids abc9007e907ef318::3c9::4151, abc9007e907ef318::5a2::9ff3). The evidence for EU_EMD2 cites Directive (EU) 2022/2556 regarding digital operational resilience for the financial sector (chunk_id 85307f9e2a040982::14a::134d). The two regimes regulate distinct aspects of the financial sector—licensing and product classification under Australian law versus operational resilience under EU law—and there is no evidence of a specific obligation in one regime conflicting with a specific obligation in the other.


121 See Corporations Act, s 761E.
Annexure 1. Legal and regulatory framework | 41

Regulator: AUSTRAC
Relevant Legislation: AML/CTF Act
Digital currency exchanges are regulated by AUSTRAC under the Anti Money Laundering and
Counter Terrorism Financing (AML/CTF) Act for the purposes of preventing and detecting money
laundering and terrorism financing.
Digital currency exchanges must register with AUSTRAC and meet AML/CTF compliance and
reporting obligations (including Know Your Customer requirements).
Regulator: ATO
Relevant Legislation: Income Tax Act, Goods and Services Tax Act
Investors in crypto tokens and other market participants are subject to tax laws. If an entity is
carrying on a business in relation to digital currency, or as part of their existing business, or if
they are accepting digital currency as a payment in business, the entity needs to consider any
GST consequences that may arise.
Tax implications for investors flow from the underlying nature of the rights and obligations
attached to the asset and the personal circumstances of the investor. Crypto tokens will
generally be capital assets, meaning there could be capital gains tax consequences.122

For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

Part 9 of this instrument, be contained in a report under subsection 41(2) of the
Act in relation to the suspicious matter reporting obligation. (3) The AUSTRAC CEO may, by notifiable instrument, specify a day for the
purposes of subparagraph (1)(d)(ii).
118 Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 Application, saving and transitional provisions Part 12
Section 12-3
12-3 Transitional-reports of threshold transactions to be in old form for first 3
months after commencement
(1) Subsections (2) and (3) apply if:
(a) a reporting entity commences to provide, or provides, a designated service
to a customer; and
(b) the provision of the service involves a threshold transaction; and
(c) the reporting entity is required under subsection 43(2) of the Act to give the
AUSTRAC CEO a report of the transaction at any time during the period:
(i) beginning at the commencement of this instrument; and
(ii) ending on 30 June 2026.

Explanation: AU_ATO_CRYPTO (Australian Taxation Office crypto-asset tax framework — every disposal is a CGT event requiring identification of cost base, recordkeeping, and taxpayer reporting) and AU_AML_CTF (Australian AML/CTF Act — every designated-service interaction generates AUSTRAC reporting obligations and recordkeeping duty). The friction is recurring: every transaction on a regulated AU crypto-asset operator generates parallel obligations under both regimes — ATO tax-event tracking AND AUSTRAC AML data collection and reporting. Same shape as the careful-cohort labelled EU_DAC8 :: EU_AMLR_TFR recurring_friction (same-jurisdiction tax × AML scaling with transaction count).


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The EU MiCA RTS passages discuss the notification obligations of financial entities providing crypto-asset services and the development of technical standards for CASPs (chunk_ids c51ad46265cea4e5::2f5::4513 and c51ad46265cea4e5::361::e378). In contrast, the Basel III General passages address the leverage ratio exposure measure, the treatment of fiduciary assets, and the calculation of expected losses and provisions for banks (chunk_ids 32afd37cade34f84::34b::8d30, 32afd37cade34f84::34e::4d5c, and 32afd37cade34f84::25d::6825). The obligations in MiCA regarding crypto-asset service provision do not overlap with the banking capital and leverage ratio obligations in Basel III. Therefore, the regimes regulate different domains and do not conflict.


Such a warning may be
provided in a standardised format;
(d) the investment firm complies with its obligations under Article 23.
5. The investment firm shall establish a record that includes the document or documents agreed between the
investment firm and the client that set out the rights and obligations of the parties, and the other terms on which
the investment firm will provide services to the client. The rights and duties of the parties to the contract may be
incorporated by reference to other documents or legal texts.
6. The investment firm shall provide the client with adequate reports on the service provided in a durable medium. Those reports shall include periodic communications to clients, taking into account the type and the complexity of
financial instruments involved and the nature of the service provided to the client and shall include, where applicable, the
costs associated with the transactions and services undertaken on behalf of the client. When providing investment advice, the investment firm shall, before the transaction is made, provide the client with a
statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences,
objectives and other characteristics of the retail client.

Explanation: The evidence from AU_AML_CTF (chunk 254ca2d92d196180::2ac::a5fe) outlines reporting obligations for suspicious matters, threshold transactions, and international funds transfer instructions. The evidence from EU_MIFID2 (chunk 28dfda0f6a6539b6::4f2::95d6) focuses on the investment firm's obligation to provide clients with adequate reports on the service provided, including periodic communications and costs. The obligations in the AU regime relate to anti-money laundering and counter-terrorism financing reporting, while the obligations in the EU regime relate to client reporting and suitability statements for investment services. These are distinct regulatory domains with no apparent overlap or conflict in obligations.


1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: AU_ASIC_CRYPTO (regime A) addresses when crypto-assets are financial products under Australia's Corporations Act and require AFSL-style licensing of providers. SG_PSA_GENERAL (regime B) addresses payment-service licensing under Singapore's PSA. Both cover crypto licensing in their jurisdictions, but they apply different licensing perimeters: financial-product-status (A) vs payment-service-activity (B). The cited passages don't impose conflicting obligations on the same entity action.


Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The AU_TREASURY_DAP passages describe Australia's domestic regulatory agenda for crypto assets, specifically token mapping and future licensing frameworks (chunk_ids d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). The INT_IOSCO_GENERAL passages are methodological references to IOSCO's general objectives and principles for securities regulation, including cross-border disclosure standards and cooperation (chunk_id f173909614befd49::455::1a1a). The regimes regulate different domains: one is a specific national legislative reform proposal for crypto assets, while the other is a general international standard-setting body's methodology for securities regulation. There is no specific obligation in the Australian crypto reform agenda that conflicts with the general IOSCO principles cited.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

Explanation: The AU_PRIVACY passages regulate the cross-border disclosure of personal information, requiring entities to ensure overseas recipients comply with Australian Privacy Principles (APPs) and providing exceptions for consent or permitted general situations (e.g., safety threats) [e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3]. The EU_PSD2 passages regulate payment services, specifically strong customer authentication (SCA) and the protection of payment service users' personalised security credentials [adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b]. The obligations are distinct: one governs data privacy and cross-border transfer, while the other governs payment security and authentication. There is no specific obligation in AU_PRIVACY that pushes against a specific obligation in EU_PSD2, nor do the regimes regulate the same subject matter. Therefore, the regimes are in different domains.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The evidence for Regime A (AU_APRA_CPS230) focuses on operational risk management, resilience, and the management of service providers to ensure critical operations continue through disruptions. The evidence for Regime B (EU_REVERSE_SOLICITATION) focuses on the regulatory treatment of crypto-asset services provided by third-country firms to clients who initiate the relationship (reverse solicitation). The obligations in Regime A relate to the internal risk management and continuity of operations for an APRA-regulated entity, whereas the obligations in Regime B relate to the authorization requirements and solicitation rules for crypto-asset services in the EU. The two regimes regulate distinct domains of financial activity and do not impose conflicting obligations on the same entity or transaction type.


150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: INT_BASEL_GENERAL (Basel III prudential framework — leverage ratio, capital provisions) and INT_FATF_VASP (FATF VASP AML guidance). International standards bodies addressing distinct but coordinated concerns (prudential vs AML). Aligned pillars of international financial regulation.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The Australian regime (Regime A) regulates reporting entities and reporting obligations under the AML/CTF Act, including obligations for remittance dealers and cash dealers. The Singapore regime (Regime B) regulates digital payment token (DPT) service providers under the Payment Services Act and MAS Notice PSN02. The passages confirm that the Singapore regime applies to entities dealing in, exchanging, transmitting, or providing custodian wallet services for DPTs, and requires them to comply with AML/CFT requirements. While both regimes share the goal of AML/CFT compliance, the specific obligations and regulated entities (reporting entities vs. DPT service providers) are distinct. The evidence shows no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, they regulate different sectors (general financial services vs. digital payment tokens) within the broader AML/CFT framework.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

GUIDANCE FOR A RISK-BASED APPROACH
MONEY OR VALUE TRANSFER
SERVICES
FEBRUARY 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance for a Risk-Based Approach for Money or Value Transfer Services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/rba-money-or-value-transfer.html
© 2016 FATF/OECD.

Explanation: AU_TRAVEL_RULE (AU's FATF travel-rule consultation for DCE providers — Australia has not yet implemented but DCE providers comply with AML/CTF obligations including customer identification) and FATF_R16 (FATF Recommendation 16 — the underlying international travel-rule standard). The AU framework explicitly references and is moving toward FATF R16 implementation. Reinforcing rather than conflicting; AU is implementing the FATF standard.


5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

117. The token mapping framework defines the concepts of 'tokens', 'token systems' and 'functions'.
A crypto token performs the record keeping role. It is analogous to a physical token or an entry
in a registry. A token system is the business or social protocol, or mechanism. It is the steps
taken to perform a function in relation to crypto tokens. A function is the product or benefit
provided by a token system.
Insights

118. The crypto ecosystem is not a homogenous industry sector and crypto assets are not a
homogenous asset class. The process of assessing crypto related products against the functional
perimeter is no different than the process for assessing any other product.

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

Competent authorities shall refuse authorisation as a crypto-asset service provider where there are objective and
demonstrable grounds that:
(a) the management body of the applicant crypto-asset service provider poses a threat to its effective, sound and
prudent management and business continuity, and to the adequate consideration of the interest of its clients and
the integrity of the market, or exposes the applicant crypto-asset service provider to a serious risk of money
laundering or terrorist financing;
(b) the members of the management body of the applicant crypto-asset service provider do not meet the criteria set out
in Article 68(1);
(c) the shareholders or members, whether direct or indirect, that have qualifying holdings in the applicant crypto-asset
service provider do not meet the criteria of sufficiently good repute set out in Article 68(2);
(d) the applicant crypto-asset service provider fails to meet or is likely to fail to meet any of the requirements of this
Title.
11.

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Article 62
Application for authorisation as a crypto-asset service provider
1.
Legal persons or other undertakings that intend to provide crypto-asset services shall submit their application for
an authorisation as a crypto-asset service provider to the competent authority of their home Member State.
2.
The application referred to in paragraph 1 shall contain all of the following information:
(a) the name, including the legal name and any other commercial name used, the legal entity identifier of the applicant
crypto-asset service provider, the website operated by that provider, a contact email address, a contact telephone
number and its physical address;
EN
L 150/118

(b) the legal form of the applicant crypto-asset service provider;
(c) the articles of association of the applicant crypto-asset service provider, where applicable;
(d) a programme of operations, setting out the types of crypto-asset services that the applicant crypto-asset service
provider intends to provide, including where and how those services are to be marketed;
(e) proof that the applicant crypto-asset service provider meets the requirements for prudential safeguards set out in

Explanation: Treasury's proposed Digital Asset Platforms regime (Australia) and MiCA Title V (EU) each establish a jurisdiction-specific licensing regime for the same economic activity — operating a platform that custodies, exchanges, or otherwise services crypto-assets for retail customers. The tension is structural: neither regime contains an equivalence, mutual-recognition, or transit pathway that lets an entity authorised under one operate under the other without a separate, full authorisation. An AU-licensed DAP operator seeking to provide crypto-asset services to EU clients must obtain a separate MiCA Title V CASP authorisation; an EU-authorised CASP cannot transit its authorisation to operate as a DAP in Australia. The pattern is the same as AUDD-vs-MiCA-Title-IV on the token side (example subgraph 02), but at the entity/CASP-licensing layer. Unlike operationally-resolvable conflicts, there is no published mechanism (no SCC-equivalent, no adequacy decision) that bridges the gap — the only path is to obtain authorisation in each jurisdiction separately.

Establish a separately-licensed entity in each jurisdiction (AU subsidiary for DAP + EU subsidiary for MiCA CASP).

Restrict services to a single jurisdiction's clients and rely on territoriality + narrow exceptions (e.g. EU reverse solicitation under Art. 61) — accepting that these are exceptions, not authorisation substitutes.

DAP regime is treated as finalised per the 2023 Treasury proposal; the analysis would change if Australia subsequently enters a mutual-recognition arrangement with the EU.

Reverse-solicitation handling is bounded to genuine client-initiated requests under ESMA's narrow interpretation.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

Explanation: AU_APRA_CPS230 (APRA Operational Risk Management standard) and INT_BASEL_GENERAL (Basel III framework — including operational-risk capital and risk-management principles). APRA implements Basel-aligned prudential standards; CPS 230 sits within the broader Basel-influenced operational-risk framework. Aligned by design.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

19. Article 62(4) of MiCA sets out that NCAs must not require an applicant CASP to provide
any information referred to in Article 62(2) of MiCA that they have already received under
the respective authorisation procedures in accordance with Directive 2009/110/EC4,
2014/65/EU5 or (EU) 2015/23666, or pursuant to national law applicable to crypto-asset
services prior to the date of entry into force of MiCA, provided that such previously
submitted information or documents are still up-to-date.

3.2 Feedback statement
Q2: Do you agree with the list of information to be provided with an application for
authorisation as a crypto-asset service provider? Please also state the reasons for your
answer.

Explanation: EU_PSD2 (Article 97 strong-customer-authentication on every payment account access / electronic transaction) and EU_MICA_TITLE_V_CASP (MiCA CASP authorisation with operational and conduct obligations). MiCA-authorised CASPs handling fiat-rail transactions are subject to PSD2's SCA requirements on every authentication event. The friction is recurring: every transaction triggers PSD2's per-event obligation in addition to MiCA's per-relationship obligations.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

Explanation: The EU regime (Regime A) regulates the specific licensing and solicitation requirements for crypto-asset service providers (CASPs) operating in the EU, specifically addressing 'reverse solicitation' exemptions under MiCA. The FATF regime (Regime B) provides global AML/CFT standards and guidance, including on digital identity and virtual assets. The passages provided for Regime B are general introductory or bibliographic references to FATF documents (e.g., 'DIGITAL IDENTITY', 'FATF REPORT', 'GUIDANCE FOR A RISK-BASED APPROACH') and do not contain specific obligations regarding solicitation, licensing, or the reverse solicitation exemption. Because the obligations in Regime A do not push against specific obligations in Regime B, and the FATF passages do not address the specific regulatory tension of reverse solicitation, the regimes are in different domains.


Article 59
Authorisation
1.
A person shall not provide crypto-asset services, within the Union, unless that person is:
(a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Explanation: MiCA Title V CASP rules are explicitly modelled on MiFID II investment-firm authorisation and conduct. MiCA Article 60 carves out incumbent regulated entities including MiFID II investment firms — those entities may provide crypto-asset services on the strength of their existing authorisation, subject to a notification regime. The two regimes are aligned by design with MiCA explicitly building on MiFID II concepts (best execution, suitability) carried into the crypto context.

A MiCA Level-2 RTS prescribed a CASP-specific best-execution rule incompatible with MiFID II Art. 27 — Level-2 work is coordinated to avoid this.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

(83) Essential and important entities should ensure the security of the network and information systems which they use
in their activities. Those systems are primarily private network and information systems managed by the essential
and important entities' internal IT staff or the security of which has been outsourced. The cybersecurity risk-
management measures and reporting obligations laid down in this Directive should apply to the relevant essential
and important entities regardless of whether those entities maintain their network and information systems
internally or outsource the maintenance thereof.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU NIS 2 horizontal cybersecurity directive operate in disjoint regulatory domains at the obligation level. AML supervisor vs horizontal cybersecurity directive — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU Market Abuse Regulation operate in disjoint regulatory domains at the obligation level. AML supervisor vs market-abuse regulation — disjoint domains. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: EU_AMLD6 (EU's anti-money-laundering directive framework, latest iteration) and FATF_R16 (FATF Recommendation 16 — travel rule for VAs/VASPs). EU AMLD6 and the accompanying AMLR/TFR are the EU's implementation of FATF Recommendations including R16; the two are designed to align. Reinforcing rather than conflicting relationship.