(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU AMLR TFR regime regulates the traceability of crypto-asset transfers and the obligations of obliged entities (e.g., crypto-asset service providers) to accompany transfers with payer information (c0300673081f7232::279::1918). The INT IOSCO GENERAL regime provides a high-level methodology for securities regulation and disclosure standards, focusing on the objectives and principles of securities regulation and cooperation among securities authorities (f173909614befd49::455::1a1a). The obligations in the EU regime relate to anti-money laundering and transaction traceability, while the IOSCO regime focuses on securities market regulation and disclosure. There is no specific obligation in the EU regime that pushes against a specific obligation in the IOSCO regime; they regulate distinct domains of financial activity.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: EU_NIS2 (EU Network and Information Security Directive — ICT access-control measures) and MAS_TRM (MAS Technology Risk Management guidelines — principles-based ICT/cybersecurity expectations). Both implement cybersecurity / technology-risk frameworks for financial-sector entities in their respective jurisdictions. Aligned in concern (cyber resilience) with different mechanisms.


or
(b) means an FX counterparty;
"relevant FX counterparty" is a FX counterparty that is not ⎯
(a) a financial institution as defined in section 2 of the FSM Act; or
(b) a financial institution incorporated or established outside Singapore that is subject
to, and supervised for compliance with, AML/CFT requirements consistent with
standards set by the FATF;
"SFA" means the Securities and Futures Act 2001;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"transaction" means any transaction accepted, processed, or executed by the payment
service provider in the course of carrying on its business of providing a digital payment
token service;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
[MAS Notice PSN02 (Amendment) 202

27 These offences typically relate to cybersecurity issues such as unauthorised access. addition, MAS' off-site monitoring will also enable us to identify and target specific
key risks and initiate supervisory follow-up actions including for-cause inspections
as necessary. Payment Services Act 2019
II-3-2 ML/TF risks have been identified as the primary risk concerns posed by virtual
assets, given the anonymity, speed and cross-border nature of transactions
facilitated by virtual asset providers. Under the Payment Services Act 2019 (PS
Act), MAS will impose AML/CFT requirements on the intermediaries that buy, sell
or exchange virtual assets in Singapore - these are the VASP business models
identified to be operating in Singapore. II-3-3 Under the PS Act, aligned with the FATF standards, DPT service providers are
required to conduct customer due diligence and transaction monitoring measures,
as well as to report suspicious transactions to the authorities. They are also
required to screen and submit information on their customers when transferring
DPTs to one another on behalf of their customers, and make this information
available on request to appropriate authorities in Singapore.

Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Explanation: SG_MAS_AML_GENERAL (MAS AML/CFT framework — FSM Sanctions Regulations and MAS Notices SFA04-N02 + PSN02, requiring SG-licensed entities to collect, retain, and share customer information for AML/CFT compliance, including with foreign counterparties under international cooperation arrangements) and AU_PRIVACY (Australian Privacy Principles, especially APP 8 cross-border disclosure restrictions). When SG-licensed entities serve AU-resident customers and transmit AML data to MAS or counterparty AU institutions, APP 8 obligations engage on the AU side; the AU APP entity must take reasonable steps to ensure overseas-recipient compliance with APPs. Operationally resolvable via APP 6.2(b) (use or disclosure required or authorised by law) plus APP 8.2(d) permitted general situations. Same conflict shape as labelled SG_MAS_AML_GENERAL × EU_GDPR.


Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Article 2
Definitions
The proposed acquirer shall supply to the competent authority
For the purposes of this Directive, the following definitions shall
information indicating the size of the intended holding and
apply:
relevant information referred to in Article 19a(4) of Directive
2006/48/EC.
1. 'electronic money institution' means a legal person that has
been granted authorisation under Title II to issue electronic
money;
Where the influence exercised by the persons referred to in the
second subparagraph is likely to operate to the detriment of the
2. 'electronic money' means electronically, including prudent and sound management of the institution, the
magnetically, stored monetary value as represented by a competent authorities shall express their opposition or take
claim on the issuer which is issued on receipt of funds for other appropriate measures to bring that situation to an end.
the purpose of making payment transactions as defined in Such measures may include injunctions, sanctions against
point 5 of Article 4 of Directive 2007/64/EC, and which is directors or managers, or the suspension of the exercise of
accepted by a natural or legal person other than the elec the voting rights attached to the shares held by the shareholders
tronic money issuer; or members in question.

Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Explanation: EMD2 is an e-money authorisation regime; MAR is a market abuse regulation for financial instruments traded on EU venues. E-money itself is not a financial instrument under MiFID II Annex I Section C, so EMD2 entities are largely outside MAR's substantive scope. Easy hard negative — regimes operate in entirely different domains.

E-money were re-classified as a financial instrument under a future MiFID amendment — speculative and not in current text.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The EU AMLA passages focus on cooperation obligations, information exchange, and the establishment of an authority for anti-money laundering and countering the financing of terrorism (AMLA) [df546f2364aaf9e2::15a::fbf2, df546f2364aaf9e2::620::328c, df546f2364aaf9e2::25a::6ab3]. The INT_BASEL_CRYPTO passages focus on capital requirements, risk-weighting methodologies, and prudential standards for banks and financial institutions [32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3c8::f259, 32afd37cade34f84::3ec::a3fa]. The obligations in the EU AMLA regime (reporting, cooperation, supervision) do not impose specific operational constraints or conflicts with the capital adequacy and risk management standards described in the INT_BASEL_CRYPTO regime. Therefore, the regimes regulate different domains and do not conflict.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

Explanation: The evidence from the AU_ATO_CRYPTO regime focuses on token mapping, tax compliance, and general crypto adoption statistics (chunk_id e6bb47e92e88e16c::567::36c4). The evidence from the EU_MICA regime outlines the legal framework for crypto-asset services, including the provision of advice on crypto-assets (chunk_id f9082873c5d9ba9d::302::bbe0). The passages describe distinct regulatory domains: one focuses on Australian tax and token classification, while the other establishes a European Union framework for crypto-asset service provision. There is no specific obligation in one regime that pushes against a specific obligation in the other; rather, they address separate regulatory objectives and scopes.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Explanation: The EU DAC8 regime regulates the reporting and exchange of tax information regarding crypto-asset users (c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The INT_BASEL_CRYPTO regime regulates capital requirements, risk-weighting, and supervisory standards for banks and financial institutions (32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The obligations in DAC8 relate to tax transparency and administrative cooperation, while the obligations in INT_BASEL_CRYPTO relate to prudential regulation and capital adequacy. There is no specific obligation in one regime that pushes against a specific obligation in the other; they regulate distinct domains of financial activity.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: AU_AML_CTF (Australian AML/CTF Act — AUSTRAC reporting framework requiring KYC, threshold, and suspicious-matter reporting) and SG_PDPA (Singapore Personal Data Protection Act). When AU reporting entities have SG-resident customers and need to share data per AML/CTF obligations, PDPA's consent/disclosure restrictions engage on the SG side. Operationally resolvable via PDPA s.13(b) ('required or authorised under any other written law') carve-out for AML compliance. Same conflict shape as the labelled AU AML/CTF ↔ AU PRIVACY conflict, scaled to cross-jurisdictional framing.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

1. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

2. MiCA sets out a new legal framework applicable to legal persons or other undertakings
intending to provide crypto-asset services, requiring such entities to submit an
application for authorisation containing all the information set out in Article 62(2) of MiCA,
as specified by the RTS on the information for authorisation as a CASP.

3. The next paragraphs present the cost-benefit analysis of the main policy options included
in this final report on the requirements for the application for authorisation as a CASP
under Article 62 of MiCA.
Problem identification

Explanation: The evidence for AU_PRIVACY focuses on the obligations of an Australian entity to ensure overseas recipients of personal information comply with Australian Privacy Principles (APPs) and the accountability for such disclosures. The evidence for EU_MICA_TITLE_V_CASP focuses on the requirements for legal entities to apply for authorisation as a Crypto-Asset Service Provider (CASP) under the Markets in Crypto-Assets (MiCA) Regulation, including the information required for the application and the establishment of a public register. The obligations in the AU_PRIVACY passage (ensuring overseas recipients handle personal information in accordance with APPs) do not directly oppose the obligations in the EU_MICA passage (submitting an application for authorisation as a CASP). The regimes regulate different aspects of the same transaction or entity: one governs data protection and cross-border data flows, while the other governs the licensing and operational requirements for providing crypto-asset services. Therefore, the regimes are in different domains and do not conflict.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Explanation: The AU_TRAVEL_RULE passages discuss Australia's regulatory framework for digital currency exchanges (DCEs) and the status of the FATF 'Travel Rule' implementation. Specifically, they state that Australia has not yet implemented the Travel Rule for digital currency exchanges and is consulting on reforms to extend it (chunk_ids cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). The EU_NIS2 passages discuss the Network and Information Security Directive (NIS2) and its technical standards for access controls in the context of ICT security (chunk_id 3c9eb3a25c93f394::474::4786). The obligations in AU_TRAVEL_RULE relate to customer identification and transaction reporting (Travel Rule), while the obligations in EU_NIS2 relate to cybersecurity and access control policies. These are distinct regulatory domains. Furthermore, the AU passages explicitly state that the Travel Rule is not yet implemented, meaning the specific obligations referenced in the AU regime are not currently active, while the EU regime addresses a different set of obligations entirely. Therefore, the regimes do not conflict.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: INT_FATF_GENERAL (FATF's general AML/CFT risk-assessment principles and standards) and SG_MAS_AML_GENERAL (MAS's AML/CFT framework — FSM Act sanctions regulations, MAS PSN02 supervisory approach). Singapore implements FATF risk-based AML/CFT principles through MAS notices and guidelines. Reinforcing relationship.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical currency transfers exceeding A$10,000 to AUSTRAC. The EU_REVERSE_SOLICITATION regime regulates the marketing of crypto-asset services to clients in the EU who have initiated the relationship. The obligations in Regime A (reporting cash thresholds) do not overlap with the obligations in Regime B (reverse solicitation exemptions for crypto-asset services). The regimes regulate distinct transaction types and compliance areas, resulting in no conflict.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

Explanation: The EU_EMD2 passages discuss digital operational resilience and financial rules for the Authority (chunk_ids cf4bab4773787409::1e6::5413 and 3a1785f95cb37b3c::34d::1756). The SG_MAS_AML_GENERAL passages discuss AML/CFT compliance, sanctions regulations, and cybersecurity issues related to money laundering (chunk_ids 6d8a84a9f3d6e9e4::480::ac46 and b49627bb889ef1d9::1b6::0802). The obligations in the EU regime regarding digital resilience do not impose specific requirements that conflict with the Singapore AML/CFT obligations regarding sanctions and cybersecurity. The regimes regulate distinct but related aspects of financial sector oversight (operational resilience vs. AML/CFT compliance), resulting in no direct conflict.


13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

3.1 This Notice is based on the following principles, which shall serve as a guide for all banks
in the conduct of their operations and business activities:
(a) A bank shall exercise due diligence when dealing with customers, natural persons
appointed to act on the customer's behalf, connected parties of the customer and
beneficial owners of the customer.
(b) A bank shall conduct its business in conformity with high ethical standards, and
guard against establishing any business relations or undertaking any transaction,
including a digital token transaction, that is or may be connected with, or facilitates
or may facilitate money laundering or terrorism financing.
(c) A bank shall, to the fullest extent possible, assist and cooperate with the relevant
law enforcement authorities in Singapore to prevent money laundering and
terrorism financing.

Explanation: The EU_EMD2 passages discuss digital operational resilience and financial rules for the European Authority (e.g., Recital 27, Article 21). The SG_AML passages discuss AML/CFT training obligations for insurers (Clause 13.14) and general AML/CFT principles for banks (Clause 3.1). The obligations in the EU_EMD2 text relate to operational resilience and financial administration, whereas the obligations in the SG_AML text relate to anti-money laundering and counter-terrorism financing controls. These are distinct regulatory domains with no apparent overlap or conflict.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The evidence from AU_TREASURY_DAP (chunk d75262e404517e0c::47b::7c9f) describes Australia's internal 'token mapping' exercise to identify how crypto assets fit into existing financial services laws. The evidence from SG_MAS_PRUDENTIAL_CRYPTO (chunk 7c04f2a0bd85290a::449::02f2) discusses Singapore's specific regulatory framework for Stablecoin Issuers (SCS) and their capital requirements. The two regimes are addressing distinct policy objectives and regulatory designs for different jurisdictions (Australia's mapping exercise vs. Singapore's SCS prudential framework). There is no specific obligation in one regime that pushes against a specific obligation in the other; rather, they represent separate national approaches to crypto regulation.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's internal policy agenda, specifically 'token mapping' to identify how crypto assets fit into existing financial services laws and the subsequent development of a licensing framework for crypto asset service providers (chunks d75262e404517e0c::47b::7c9f, e6bb47e92e88e16c::37a::29f6). In contrast, the EU_MAR passages define the scope of the Market Abuse Regulation, which establishes rules on insider dealing and market manipulation for financial instruments in the EU (chunk 5cc4a27bc578287a::165::3333). The two regimes regulate distinct policy areas: one is a domestic regulatory reform agenda for crypto assets, while the other is a specific EU directive prohibiting market abuse. There is no evidence of a direct obligation in one regime conflicting with a specific obligation in the other.


'@ Australian Government Cee ee
ahem 8 eporting Home / Business / Core guidance / Reporting As a reporting entity you must report certain transactions and suspicious matters, and
submit compliance reports to AUSTRAC. Everyone, including reporting entities, must
report cross-border movements of physical currency. Ongoing reporting obligations Threshold transaction reports You must submit threshold transaction reports (TTR) for transfers of A$10,000 or more
in cash (or the foreign currency equivalent). TTRs are due within 10 business days after
the date of the transaction. International funds transfer instruction reports (IFTIs) You must submit international funds transfer instruction reports (IFTIs) for transfers of
funds of any value into or out of Australia, made either electronically or under a
designated remittance arrangement. IFTIs are due within 10 business days after the
transfer instruction is sent or received. Suspicious matter reports (SMRs) You must submit suspicious matter reports (SMRs) when you have a suspicion that a
customer or transaction is related to criminal activity.

means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

32. An APRA-regulated entity's internal audit activities must include a review of the
design and operating effectiveness of information security controls, including

11 Also referred to as an 'untrusted' environment.

12 For the avoidance of doubt, paragraph 28 of this Prudential Standard applies to all information
assets managed by related parties and third parties, not only those captured under agreements with
service providers of outsourced material business activities under Prudential Standard CPS 231
Outsourcing or Prudential Standard SPS 231 Outsourcing.
CPS 234 - 7

those maintained by related parties and third parties (information security control
assurance).

33. An APRA-regulated entity must ensure that the information security control
assurance is provided by personnel appropriately skilled in providing such
assurance.

Explanation: The AML/CTF Act and Rules regulate customer due diligence, transaction monitoring, threshold transaction reporting and suspicious matter reporting; CPS 234 is APRA's prudential information-security standard. They apply to overlapping but not identical populations (APRA-regulated entities that are also reporting entities under AML/CTF — banks, super funds, life insurers, etc.) and they govern entirely different obligation surfaces: AML/CFT controls vs ICT-security capability. A regulated firm satisfies both with independent controls; the only point of practical interaction is incident notification where an ICT incident also has AML/CFT implications, and that is a routine coordination matter.

AUSTRAC required retention of records on systems CPS 234 would require to be air-gapped from external access — no such tension in current text.


Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 48
Transfers or disclosures not authorised by Union law
Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a
controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if
based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third
country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.

Article 49
Derogations for specific situations
1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to

Article 29
Disclosure of personal data to third countries
1. The competent authority of a Member State may transfer personal data to a third country provided the
requirements of Directive 95/46/EC are fulfilled and only on a case-by-case basis. The competent authority shall
ensure that the transfer is necessary for the purpose of this Regulation and that the third country does not transfer
the data to another third country unless it is given express written authorisation and complies with the conditions
specified by the competent authority of the Member State.
2. The competent authority of a Member State shall only disclose personal data received from a competent authority
of another Member State to a supervisory authority of a third country where the competent authority of the Member
State concerned has obtained express agreement from the competent authority which transmitted the data and, where
applicable, the data is disclosed solely for the purposes for which that competent authority gave its agreement.
3. Where a cooperation agreement provides for the exchange of personal data, it shall comply with the national laws,
regulations or administrative provisions transposing Directive 95/46/EC.
CHAPTER 5
ADMINISTRATIVE MEASURES AND SANCTIONS

Article 14
Prohibition of insider dealing and of unlawful disclosure of inside information
A person shall not:
(a) engage or attempt to engage in insider dealing;
(b) recommend that another person engage in insider dealing or induce another person to engage in insider dealing; or
(c) unlawfully disclose inside information.

Article 15
Prohibition of market manipulation
A person shall not engage in or attempt to engage in market manipulation.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

Explanation: MAR Article 29 expressly contemplates that competent authorities may transfer personal data to third countries — subject to (former) Directive 95/46/EC requirements, now GDPR. MAR Article 16 STOR (suspicious transaction or order report) and insider-list maintenance under Article 18 involve substantial personal-data processing. GDPR Articles 5-6 require purpose limitation and lawful basis; Article 44 regulates cross-border transfers; Article 48 forecloses third-country court/administrative orders not based on international agreement. The tension is operational: MAR requires personal-data processing for market-abuse supervision and cross-border information sharing; GDPR demands the standard lawful-basis ladder and transfer-instrument framework. Resolution: GDPR Art 6(1)(c) (legal obligation, namely MAR) is the lawful basis; for cross-border transfer, MAR Article 29's own framework supplements GDPR Chapter V; for non-EU regulator cooperation, MOU-based arrangements satisfy GDPR Art 46(2)(a) administrative arrangements between public authorities.

Use GDPR Art 6(1)(c) (legal obligation = MAR) for STOR / insider-list / supervisory data processing.

For cross-border supervisory transfer, layer MAR Art 29's specific framework on top of GDPR Chapter V; MOUs satisfy Art 46(2)(a).

Ensure GDPR Art 48 is not violated when cooperating with non-EU subpoenas — require an international agreement basis.

EU competent authority or in-scope market participant; non-financial-instrument data is outside MAR scope.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The evidence from Regime A (AU_FEDREG_AML) focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, specifically regarding reporting entities, customer identification, and suspicious transaction reporting. The evidence from Regime B (INT_BASEL_GENERAL) focuses on banking regulatory capital, leverage ratios, and the treatment of fiduciary assets and provisions. The obligations and subject matter are distinct; there is no specific obligation in the AML/CTF regime that pushes against a specific obligation in the Basel framework. Therefore, the regimes are in different domains.


Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: SG_MAS_AML_GENERAL (MAS AML/CFT supervisory framework for DPT providers) and SG_STABLECOIN (MAS's SCS regulatory framework for stablecoin issuers). Both are MAS-issued frameworks for crypto/digital-payment-token activities in Singapore; they apply in tandem (an SCS issuer that is also a DPT-service provider faces both). Reinforcing rather than conflicting — both arms of MAS's coordinated crypto regulatory architecture.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: INT_FATF_GENERAL (FATF AML/CFT general standards and risk-based approach) and INT_IOSCO_GENERAL (IOSCO securities-regulation principles). Both are international standards bodies addressing financial regulation from different angles (AML and securities regulation); they coordinate on overlapping issues like crypto-related concerns. Aligned pillars of international financial regulation.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Such a warning may be
provided in a standardised format;
(d) the investment firm complies with its obligations under Article 23.
5. The investment firm shall establish a record that includes the document or documents agreed between the
investment firm and the client that set out the rights and obligations of the parties, and the other terms on which
the investment firm will provide services to the client. The rights and duties of the parties to the contract may be
incorporated by reference to other documents or legal texts.
6. The investment firm shall provide the client with adequate reports on the service provided in a durable medium. Those reports shall include periodic communications to clients, taking into account the type and the complexity of
financial instruments involved and the nature of the service provided to the client and shall include, where applicable, the
costs associated with the transactions and services undertaken on behalf of the client. When providing investment advice, the investment firm shall, before the transaction is made, provide the client with a
statement on suitability in a durable medium specifying the advice given and how that advice meets the preferences,
objectives and other characteristics of the retail client.

Article 24
General principles and information to clients
1. Member States shall require that, when providing investment services or, where appropriate, ancillary services to
clients, an investment firm act honestly, fairly and professionally in accordance with the best interests of its clients and
comply, in particular, with the principles set out in this Article and in Article 25.
2. Investment firms which manufacture financial instruments for sale to clients shall ensure that those financial
instruments are designed to meet the needs of an identified target market of end clients within the relevant category
of clients, the strategy for distribution of the financial instruments is compatible with the identified target market, and the
investment firm takes reasonable steps to ensure that the financial instrument is distributed to the identified target
market. An investment firm shall understand the financial instruments they offer or recommend, assess the compatibility of the
financial instruments with the needs of the clients to whom it provides investment services, also taking account of the
identified target market of end clients as referred to in Article 16(3), and ensure that financial instruments are offered or
recommended only when this is in the interest of the client.
3.

Explanation: The AU_PRIVACY passages (e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3) regulate the cross-border transfer of personal information, requiring entities to ensure overseas recipients comply with Australian Privacy Principles. The EU_MIFID2 passages (28dfda0f6a6539b6::4f2::95d6, 28dfda0f6a6539b6::514::0ca0) regulate the conduct of investment firms, focusing on client suitability, information disclosure, and record-keeping. The obligations in MIFID2 relate to financial services conduct and client communication, whereas the obligations in APP 8 relate to data protection and privacy. There is no specific obligation in MIFID2 that pushes against a specific obligation in APP 8; they regulate distinct domains of financial services regulation and data protection.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU DAC 8 crypto-asset tax-reporting directive operate in disjoint regulatory domains at the obligation level. AMLA supervises AML obliged entities; DAC8 is a tax-reporting directive — disjoint regulatory purposes. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

Explanation: The EU AMLA passages (chunk_ids df546f2364aaf9e2::15a::fbf2 and df546f2364aaf9e2::620::328c) regulate cooperation obligations, information exchange, and the establishment of an AML authority. The INT_BASEL_GENERAL passages (chunk_ids 32afd37cade34f84::34b::8d30 and 32afd37cade34f84::25d::6825) regulate banking capital adequacy, specifically the leverage ratio and the treatment of general provisions. The obligations in the EU AMLA framework do not impose requirements on banking capital ratios or leverage exposure measures, nor do they conflict with the Basel III capital treatment rules. Therefore, the regimes regulate distinct domains and do not conflict.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

46 For information on ASIC's interpretation of this obligation, see ASIC PF 209 Australian financial services
licence conditions
Licensing digital asset intermediaries | 23

(vi) having the financial,47 technological, and human resources to carry out and supervise the
financial service covered by the AFSL,
(vii) having a dispute resolution system48 and compensation arrangements for retail clients for
loss or damage suffered due to breaches of obligations, and
(viii) maintaining a risk management system.
Financial requirements
(g) A platform provider must meet:
(i) the standard solvency and positive net asset requirements,49
(ii) the standard cash needs requirement, and
(iii) a net tangible assets (NTA) requirement for holding cash or cash equivalents and holding
liquid assets of at least:
• 0.5 per cent of the value of the facility (if using a sub-custodian digital asset facility that
has $5m NTA),50 or
• $5 million (if performing the custody function).
Info Box 6 Financial requirements
AFSL holders have obligations to meet 'financial requirements'. These requirements are typically
tailored for different financial products through ASIC legislative instruments. The NTA obligation is
to address the costs of orderly wind-up in the event the provider fails.51
A key issue with digital assets is concentration risk (see Info Box 11 Additional Standards for token
holders). The proposed financial requirements balance the need to avoid concentration of digital
assets among a small number of custodians with the need to ensure robust NTA. It sets the
required level of NTA at the greater of $5 million or 0.5% of the value of the assets held by the
facility.52 This arrangement ensures that as a facility expands, and the operational risk exposure of
the platform provider grows, the provider will maintain a corresponding level of financial
resources.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

2020Ed. Act 2012 20
(2) An organisation must not -
(a) as a condition of providing a product or service, require an
individual to consent to the collection, use or disclosure of
personal data about the individual beyond what is
reasonable to provide the product or service to that
individual; or
(b) obtain or attempt to obtain consent for collecting, using or
disclosing personal data by providing false or misleading
informationwithrespecttothecollection,useordisclosure
of the personal data, or using deceptive or misleading
practices. (3) Anyconsentgiveninanyofthecircumstancesinsubsection(2)
is not validly given for the purposes of this Act. (4) InthisAct,referencestoconsentgiven,ordeemedtohavebeen
given, by an individual for the collection, use or disclosure of
personal data about the individual include consent given, or deemed
to have been given, by any person validly acting on that individual's
behalf for the collection, use or disclosure of such personal data.

Explanation: AU_ASIC_AFSL (AFSL holders' KYC, suitability, and recordkeeping obligations under s.912A of the Corporations Act and ASIC INFO 225 for crypto-asset facilities) and SG_PDPA (Singapore PDPA consent-based collection/disclosure). AFSL licensees serving SG-resident clients must collect and retain client-identification data and may transmit it to SG counterparties for AML/CDD; PDPA restricts the SG-side collection/disclosure absent the 'required by law' carve-out. Operationally resolvable via PDPA s.13(b) + MAS AML framework providing the SG-side statutory authorisation. Lower severity than the AML conflicts because AFSL KYC is contractually based (Art. 6(1)(b)-style lawful basis available).


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules — AUSTRAC reporting framework) and SG_AML (MAS Notice 314 AML/CFT framework for life insurers). Both jurisdictions implement comparable AML/CFT obligations consistent with FATF standards. Reinforcing.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 230 operational-risk management standard and AUSTRAC TTR $10k cash threshold reporting operate in disjoint regulatory domains at the obligation level. Operational risk vs AML threshold reporting — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.