Division 4: General Requirements for Group 2 Cryptoassets
Sub-division 1: RWA Calculation for Group 2b Instruments
9A.4.1 For each Group 2 cryptoasset, to which a Reporting Bank has exposures arising
from Group 2b instruments, the Reporting Bank must calculate the RWA by applying a risk
weight of 1250% to the greater of the absolute value of the aggregate long exposures and
the absolute value of the aggregate short exposures to that cryptoasset928S as follows:
RRRRAAii =1250%×mmmmee�mmaaee��aaeeAAHH eeeeeeeeeeeeeeeeii�,mmaaee��eeheeeemm eeeeeeeeeeeeeeeeii��
where -
(a) i refers to a Group 2 cryptoasset;
(b) is the sum of long exposures to cryptoasset i; and
∑aaeeAAHH eeeeeeeeeeeeeeeeii
(c) is the sum of short exposures to cryptoasset i.
∑eeheeeemm eeeeeeeeeeee eeeeii
928R For example, the DLT.
928S This treatment is intended to capture both credit and market risk, including CVA risk, and to ensure that
the Reporting Bank holds minimum risk-based capital at least equal in value to their exposures to Group 2
cryptoassets arising from Group 2b instruments.

2016.5 The Group 1 and Group 2 bank samples are not directly comparable due to different business
models and different regional distribution of the samples, and hence the impacts on them are not uniform.
However, effects vary across banks. Some banks will face increased capital requirements. Among
Group 1 banks the aggregate shortfall is €27.6 billion in CET1 capital and €90.7 billion in total capital. The
predominant part of these shortfalls comes from G-SIBs. To put these shortfall numbers in perspective:
profit after tax for the same sample of banks in the concerned six-month reporting period (H2 2015)
amounted to €198.3 billion for Group 1 banks.6 Overall, the shortfall of the Group 2 banks in the sample
will be slightly reduced compared to current levels under fully phased-in national implementation of the
Basel III framework as agreed up to January 2016.
The analysis also shows some evidence for a reduction in risk-weighted asset variability among
the Group 1 banks in the sample.
Overview of results Table 1
Number of Change in Tier 1 MRC Change in CET1 Capital shortfalls combined
banks at the target level (%)1 capital ratio (€ billions)
All of which: (percentage
CET1 Tier 1 Total
risk-based points)
Group 1 banks 71 -0.5 0.2 0.2 27.6 56.4 90.7
Of which: G-SIBs 27 -1.4 -0.9 0.3 27.6 55.4 85.7
Group 2 banks 42 3.8 0.9 0.1 0.3 0.8 1.4

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

Explanation: Basel d457 ('Prudential treatment of crypto-asset exposures', final standard, December 2022, effective 1 Jan 2026) sets the *international* capital and disclosure baseline for crypto-asset exposures of internationally active banks. APRA CPS 230 ('Operational Risk Management', effective 1 July 2025) imposes the *national* operational-risk, business-continuity and service-provider-management framework on APRA-regulated entities. The interaction is not contradictory — d457 speaks to capital adequacy, CPS 230 to operational resilience — but for AU ADIs taking on crypto-asset exposures via service providers or subsidiaries, the *combined* obligation set creates non-trivial compliance design questions: third-party-risk treatment under CPS 230 must align with the categorisation of Group 1a/1b/2a/2b exposures under d457; service-provider failure scenarios in CPS 230 BCP testing must account for the d457-mandated capital impacts. The tension is operationally resolvable: APRA's transposition of d457 (forthcoming as Prudential Standard APS 117 or equivalent) is expected to mirror Basel's categorisation, and CPS 230 explicitly contemplates integration with other prudential standards. Severity is low because the framework is designed for parallel application; the operational burden is real but not strategically destabilising.

Treat d457 as the prudential-treatment floor and align CPS 230 service-provider risk-management with the d457 categorisation of crypto exposures.

Update CPS 230 BCP and incident-response playbooks to cover crypto-custody-provider failure scenarios consistent with d457's prudential treatment.

Entity is APRA-regulated and internationally active enough to be in Basel d457 scope.

APRA's transposition of d457 mirrors the Basel standard substantively (the current expectation).


(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The EU regime (Regime A) regulates the information accompanying transfers of funds and crypto-assets to ensure traceability for AML/CFT purposes, specifically extending obligations to crypto-asset service providers (Recital 8). The Singapore regime (Regime B) is a consultation paper regarding the Payment Services Act and Digital Payment Token (DPT) services, focusing on licensing definitions and transitional exemptions for entities providing DPT services. The passages describe distinct regulatory frameworks: one establishing information requirements for cross-border transfers of value, and the other addressing the licensing and operational scope of DPT service providers within Singapore. There is no specific obligation in the EU regime that directly conflicts with a specific obligation in the Singapore regime; rather, they address different aspects of the digital asset ecosystem (information reporting vs. licensing scope).


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

67 See Annex 10 of Basel II (June 2006) for an overview of methodologies for the capital treatment of transactions secured by
financial collateral under the standardised and IRB approaches.

68 Alternatively, banks with appropriate supervisory approval may instead use the Internal Model Method to determine the
exposure amount, taking into account collateral.
Basel III: Finalising post-crisis reforms 35

(ii) On-balance sheet netting

135. Where banks have legally enforceable netting arrangements for loans and deposits that meet the
conditions in paragraph 190 they may calculate capital requirements on the basis of net credit exposures
as set out in that paragraph.
(iii) Guarantees and credit derivatives

136. Where guarantees or credit derivatives fulfil the minimum operational conditions set out in
paragraphs 191 to 193, banks may take account of the credit protection offered by such credit risk
mitigation techniques in calculating capital requirements.

4 Standards on capital requirements for banks' equity investments in funds are available at www.bis.org/publ/bcbs266.pdf; and
for capital requirements for bank exposures to central counterparties are set out in Section XI of the counterparty credit risk
standards.
Basel III: Finalising post-crisis reforms 3

A. Individual exposures
Due diligence requirements

Several of the capital requirements introduced by the Committee to mitigate the
risks arising from firm-level exposures among global financial institutions will also help to
address systemic risk and interconnectedness. These include:
Basel III: A global regulatory framework for more resilient banks and banking systems 7  capital incentives for banks to use central counterparties for over-the-counter
derivatives;
 higher capital requirements for trading and derivative activities, as well as complex
securitisations and off-balance sheet exposures (eg structured investment vehicles);
 higher capital requirements for inter-financial sector exposures; and
 the introduction of liquidity requirements that penalise excessive reliance on short
term, interbank funding to support longer dated assets. B. Introducing a global liquidity standard
34. Strong capital requirements are a necessary condition for banking sector stability
but by themselves are not sufficient. A strong liquidity base reinforced through robust
supervisory standards is of equal importance. To date, however, there have been no
internationally harmonised standards in this area.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The Basel Crypto regime (Regime A) regulates capital requirements, risk weighting, and prudential standards for banks and financial institutions. The Singapore IRAS Tax regime (Regime B) regulates tax obligations, specifically regarding the Goods and Services Tax (GST) treatment of digital payment tokens and record-keeping. The obligations in Regime A relate to financial stability and capital adequacy, while the obligations in Regime B relate to tax compliance and GST treatment. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B. The passages confirm that the regimes regulate different domains (financial regulation vs. tax administration).


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Explanation: AU_ATO_CRYPTO (Australian token-mapping consultation and crypto tax framework) and EU_DAC8 (EU directive on administrative cooperation for crypto-asset reporting, implementing OECD CARF). Both jurisdictions are implementing internationally-coordinated tax treatments of crypto-assets; DAC8 specifically references the OECD framework which Australia is also working toward. Aligned direction.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The Basel III framework passage (Regime A) discusses the treatment of fiduciary assets and general provisions for leverage ratio calculations. The Singapore Payment Services Act passage (Regime B) discusses the definition of 'safeguarding institution' and the licensing of Digital Payment Token Services (DPT). The obligations in Regime A relate to banking capital adequacy and accounting treatment, while the obligations in Regime B relate to consumer asset protection and licensing for digital payment services. The regimes regulate distinct domains (banking capital vs. payment services licensing) and do not impose conflicting obligations on the same subject matter.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): AUSTRAC AML/CTF operational guidance and AU Treasury Digital Asset Platforms framework operate in disjoint regulatory domains at the obligation level. AML/CFT obligations vs Treasury's proposed Digital Asset Platforms framework — different statutory frames and different regulatory purposes. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

40.32 The derivatives should be converted into positions in the relevant underlying and become subject
to specific and general market risk charges as described above. In order to calculate the standard
formula described above, the amounts reported should be the market value of the principal
amount of the underlying or of the notional underlying resulting from the prudent valuation
guidance set out in paragraphs 690 to 701 in Basel II.[8]
Footnote
[8] For instruments where the apparent notional amount differs from the effective notional
amount, banks must use the effective notional amount.

Explanation: INT_BASEL_CRYPTO (Basel d424 crypto-asset prudential treatment) and INT_BASEL_GENERAL (Basel III general framework). The crypto-asset standard is part of the broader Basel III framework; both are Basel Committee outputs operating together. Aligned by design.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: AU_TREASURY_DAP (Australia's proposed Digital Asset Platforms framework — Treasury consultation, broad regulatory mapping) and SG_STABLECOIN (MAS's Single-Currency Stablecoin framework — Singapore-issued G10 stablecoins). Both regulate crypto/stablecoin activities in their respective jurisdictions but apply different mechanisms (AU asset-licensing framework vs SG SCS-issuer framework). Distinct jurisdictional perimeters.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The evidence for AU_AML_CTF outlines specific reporting obligations for suspicious matters, threshold transactions, and international funds transfer instructions (chunk 254ca2d92d196180::2ac::a5fe). The evidence for EU_EMD2 is a recital referencing Directive (EU) 2022/2556 regarding digital operational resilience for the financial sector (chunk 85307f9e2a040982::14a::134d). The obligations in the Australian regime relate to AML/CTF reporting, while the EU regime addresses operational resilience. The passages describe different regulatory domains and do not impose conflicting requirements on the same subject matter.


Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): Australian AML/CTF Act + Rules (binding instruments) and AU Treasury Digital Asset Platforms framework operate in disjoint regulatory domains at the obligation level. AML/CTF Act and Rules vs proposed DAP framework — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Explanation: The regimes regulate distinct aspects of the digital asset ecosystem. Regime A (MAS AML/CFT) focuses on compliance obligations, specifically the supervision of Digital Payment Token (DPT) providers and the application of AML/CFT regulations (e.g., FSM Sanctions Regulations, internal audit functions) to mitigate money laundering risks. Regime B (PSA) focuses on licensing and operational scope, specifically the definition of 'safeguarding' for customer assets and the structure of a Payment Services (PSA) license relative to Capital Market Services License (CMSL) activities. While both regimes apply to entities providing DPT services, the obligations are complementary rather than conflicting; one governs the anti-money laundering compliance framework, while the other governs the licensing and custody of assets. The shared passage (321e082bdbe732d3::309::b080) confirms that entities may operate under transitional exemptions or license applications, but does not indicate a direct clash between the AML/CFT compliance requirements and the PSA licensing requirements.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules) and INT_FATF_VASP (FATF VASP guidance — AML/CFT standards for VAs and VASPs). Australia's AML/CTF regime applies FATF-aligned obligations on digital-currency-exchange providers (DCE = VASP equivalent). Reinforcing.


Article 81
Financial rules
The financial rules applicable to the Authority shall be adopted by the Executive Board after consulting the Commission.
They shall not depart from Delegated Regulation (EU) 2019/715 unless such a departure is specifically required for the
Authority's operation and the Commission has given its prior consent.
(41) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council of 18 July 2018 on the financial rules
applicable to the general budget of the Union, amending Regulations (EU) No 1296/2013, (EU) No 1301/2013, (EU) No 1303/2013,
(EU) No 1304/2013, (EU) No 1309/2013, (EU) No 1316/2013, (EU) No 223/2014, (EU) No 283/2014, and Decision
No 541/2014/EU and repealing Regulation (EU, Euratom) No 966/2012 (OJ L 193, 30.7.2018, p. 1).
76/90 ELI: http://data.europa.eu/eli/reg/2024/1620/oj

EN

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The EU AMLD6 passages discuss financial rules and operational resilience for the European financial sector (Recital 27 and Article 81), while the SG Foundational Legislation passages focus on MAS enforcement actions against ICO issuers and exchanges, and the intention to align with international AML/CFT standards. The obligations in the EU regime do not impose specific requirements on Singaporean entities or assets that contradict the Singaporean regulatory framework; rather, the SG passages explicitly state an intention to align with international AML/CFT requirements, which includes standards like those referenced in the EU regime. Therefore, the regimes regulate different aspects of the financial system and do not conflict.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLR/TFR AML/CFT + travel-rule and EU EMD2 e-money-institution directive are designed to coexist — obligations apply cumulatively without collision. EMIs authorised under EMD2 are AMLR-obliged entities; the AML overlay applies cumulatively with EMD2 authorisation. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The Australian regime (AU_ASIC_AFSL) regulates the provision of financial services, specifically the holding of an Australian Financial Services Licence (AFSL) to issue and deal in digital asset facilities. The Singapore regime (SG_STABLECOIN) regulates the issuance of Single-Currency Stablecoins (SCS) under the Payment Services Act. The evidence shows that the Singapore regime focuses on the 'perimeter' of SCS issuance and reserve management (chunk_id 33d059aa86716ddd::4ed::8511), while the Australian regime focuses on the licensing of intermediaries providing financial services (chunk_id 550958b067dc6726::709::b159). There is no evidence in the provided passages of a specific obligation in one regime that directly conflicts with a specific obligation in the other. The regimes regulate different aspects of the digital asset ecosystem: one on the licensing of the service provider, and the other on the classification and reserve requirements of the specific token product.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The EU_PSD2 passages regulate the authentication of payment transactions and the authorisation of payment service providers (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The INT_BASEL_CRYPTO passages regulate the calculation of capital requirements and the risk weighting of bank exposures to financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The obligations in PSD2 regarding strong customer authentication and governance do not impose specific constraints on the capital treatment or risk weighting of exposures defined in the Basel framework. Therefore, the regimes regulate distinct domains and do not conflict.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

94. The FATF Standards, including the definitions of virtual assets and VASPs, represent
a minimum standard for countries to introduce. In line with the RBA, countries may
choose to extend their AML/CFT regimes to include other digital assets and entities,
beyond the FATF definition of virtual asset and VASP. Such a determination should
be made on the basis of a ML/TF risk assessment, with consideration of the
challenges associated with regulatory divergence.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  37
PART THREE:
APPLICATION OF FATF STANDARDS TO COUNTRIES AND
COMPETENT AUTHORITIES

Explanation: INT_FATF_GENERAL (FATF general AML/CFT standards) and INT_FATF_VASP (FATF VASP-specific guidance). Both are parts of the same FATF Recommendations framework; the VASP guidance extends FATF standards to virtual assets. Aligned by design.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Notabene commend's the Monetary Authority of Singapore (MAS) for proposing a
comprehensive and detailed regulatory approach for Digital Token Service Providers
(DTSPs) under the Financial Services and Markets Act 2022. Our comments focus on
the alignment of these notices and guidelines with international standards,
particularly in light of Financial Action Task Force (FATF) Recommendations,
including the Travel Rule.

(Please refer to paragraph 12 of the draft FSM Notice). The proposed requirements for Correspondent Account Services (CAS) in paragraph
5.6 of the draft FSM Notice are both applicable and appropriate for the digital token
service provider (DTSP) sector. Given the inherent cross-border nature and rapid
transactions within digital token services, the FATF-aligned risk mitigation measures
ensure that DTSPs are aligned with global AML/CFT standards, providing a secure
framework for correspondent services while addressing potential ML/TF risks. Applicability of Risk Mitigation Measures
The requirement for DTSPs to assess the suitability of financial institutions when
providing or receiving CAS, including evaluating their AML/CFT controls, is essential
for preventing potential misuse of these services. The dynamic and often cross-
jurisdictional interactions in digital token services make these standards particularly
relevant to ensuring consistent risk management. MAS could consider offering
guidance on specific factors DTSPs should evaluate, such as transaction monitoring
capabilities and the jurisdiction's regulatory reputation, to better equip licensees in
applying a comprehensive assessment.

Explanation: The FATF Guidance on Digital Identity (Regime A) focuses on customer identification and due diligence in the digital context. The Singapore DTSP consultation (Regime B) addresses the licensing and operational requirements for Digital Token Service Providers, including the alignment of its rules with international standards like the FATF Travel Rule. While both regimes reference FATF standards, the specific obligations in Regime A (digital identity verification) are not in conflict with the specific obligations in Regime B (licensing and correspondent account services). In fact, Regime B explicitly acknowledges the alignment of its approach with FATF Recommendations, including the Travel Rule, and notes that FATF-aligned risk mitigation measures are appropriate for the sector. Therefore, the regimes are aligned and complementary rather than conflicting.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

Explanation: The AU_FEDREG_AML regime focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, specifically customer identification, transaction reporting, and suspicious activity reporting for reporting entities (chunk cf7cefacba3f94bc::49a::f39e). The EU_DORA regime focuses on Digital Operational Resilience and ICT risk management for financial entities (chunk 85307f9e2a040982::5f2::974e). The obligations in the AML regime (reporting suspicious transactions) are complementary to the resilience obligations in DORA (reporting major ICT-related incidents) rather than conflicting. There is no evidence in the provided passages of a specific obligation in AML that pushes against a specific obligation in DORA.


This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a) it involves the payer withdrawing cash from the payer's own payment account;
(b) it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member
State;
(c) both the payer and the payee are payment service providers acting on their own behalf;
(d) it is carried out through cheque images exchanges, including truncated cheques. This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a) both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b) the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-
asset service provider. Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-
assets under this Regulation.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The EU regime regulates the information accompanying transfers of funds and crypto-assets to ensure traceability for AML/CFT purposes (chunk_id=d7502c011527b67c::3e7::ae26). The Singapore regime regulates the issuance and reserve requirements of Single Currency Stablecoins (SCS) under the Payment Services Act (chunk_id=58f45cd2ef3de201::36c::e2f6). The obligations are distinct: one focuses on the transfer and accompanying information of crypto-assets, while the other focuses on the issuance standards and reserve management of specific stablecoin products. There is no specific obligation in the EU regime that pushes against a specific obligation in the Singapore regime; rather, they regulate different aspects of the digital asset ecosystem.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Explanation: The evidence from the Australian regime (Regime A) focuses on the licensing and classification of crypto-assets as financial products under the Corporations Act (e.g., INFO 225, AFS licences) and explicitly notes that it does not cover obligations administered by other regulators like AUSTRAC or the ATO. The evidence from the EU regime (Regime B) concerns the scope of Anti-Money Laundering (AML) obligations for crypto-asset service providers. While both regimes regulate crypto-assets, they address distinct regulatory domains: one focuses on financial product licensing and consumer protection, while the other focuses on AML/CFT compliance. The passages do not indicate a specific obligation in one regime that conflicts with a specific obligation in the other; rather, they describe separate regulatory frameworks.


2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

Explanation: AU_ASIC_CRYPTO (ASIC's interpretation of when crypto-assets are financial products under the Corporations Act, with AFSL licensing implications) and EU_MICA (EU framework for crypto-asset services and CASP authorisation). Both regulate crypto-asset service providers and their products but apply in non-overlapping jurisdictions with materially different perimeters — AU classifies by financial-product status; EU MiCA establishes a dedicated CASP regime. The cited passages don't impose conflicting obligations on the same entity action; an entity operating in both must comply with each separately.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

2 APRA's prudential framework comprises prudential standards and prudential practice guides (PPGs). APRA is
empowered to issue legally binding prudential standards that set out specific requirements with which APRA-regulated
institutions - authorised deposit-taking institutions (ADIs), general insurers and life companies (collectively,
insurers) and registrable superannuation entity licensees (RSE licensees) - must comply. APRA also issues PPGs,
which clarify APRA's expectations with regard to prudential matters. PPGs frequently discuss legal requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements.

Explanation: AU_APRA_CPS230 (APRA Operational Risk Management prudential standard) and AU_APRA_PRUDENTIAL (APRA's broader prudential framework — prudential standards and PPGs). CPS 230 is part of APRA's broader prudential framework; they operate together as part of the same coordinated AU prudential architecture.


It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Part 1-Consideration of personal information
privacy
1 Australian Privacy Principle 1-open and transparent
management of personal information
1.1 The object of this principle is to ensure that APP entities manage
personal information in an open and transparent way. Compliance with the Australian Privacy Principles etc.
1.2 An APP entity must take such steps as are reasonable in the
circumstances to implement practices, procedures and systems
relating to the entity's functions or activities that:
(a) will ensure that the entity complies with the Australian
Privacy Principles and a registered APP code (if any) that
binds the entity; and
(b) will enable the entity to deal with inquiries or complaints
from individuals about the entity's compliance with the
Australian Privacy Principles or such a code. APP Privacy policy
1.3 An APP entity must have a clearly expressed and up-to-date policy
(the APP privacy policy) about the management of personal
information by the entity.
1.4 Without limiting subclause 1.3, the APP privacy policy of the APP
entity must contain the following information:
(a) the kinds of personal information that the entity collects and
holds;
(b) how the entity collects and holds personal information;
(c) the purposes for which the entity collects, holds, uses and
discloses personal information;
358 Privacy Act 1988

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

27.12.2022 EN Official Journal of the European Union L 333/39
(h) implement, as appropriate, relevant operational conclusions resulting from the tests referred to in point (g) and from
post-incident analysis into the ICT risk assessment process and develop, according to needs and ICT risk profile, ICT
security awareness programmes and digital operational resilience training for staff and management.
2. The ICT risk management framework referred to in paragraph 1, second subparagraph, point (a), shall be documented
and reviewed periodically and upon the occurrence of major ICT-related incidents in compliance with supervisory
instructions. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A
report on the review of the ICT risk management framework shall be submitted to the competent authority upon its
request.
3.

Explanation: AU Privacy Act / APPs regulate Australian APP entities' handling of personal information. DORA regulates EU financial entities' ICT risk management. Different jurisdictions, different regulated populations, different subject matters. Textbook easy negative; included for class-balance and to give the trainer a clear different-domain different-jurisdiction example.

An Australian-EU dual-regulated firm — the two regimes would apply cumulatively on its respective jurisdictional surface; no obligation collision.


That legal basis may contain specific provisions to adapt the application of
rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the
types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for
which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and
processing procedures, including measures to ensure lawful and fair processing such as those for other specific 4.5.2016 EN Official Journal of the European Union L 119/37
processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of
public interest and be proportionate to the legitimate aim pursued.
4. Where the processing for a purpose other than that for which the personal data have been collected is not based
on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate
measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to
ascertain whether processing for another purpose is compatible with the purpose for which the personal data are
initially collected, take into account, inter alia:
(a) any link between the purposes for which the personal data have been collected and the purposes of the intended
further processing;
(b) the context in which the personal data have been collected, in particular regarding the relationship between data
subjects and the controller;
(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

You should obtain the sum of the absolute values of
exempt supplies from each category to report in your GST return. Category of exempt supplies Exchange gain (loss) for digital
for the accounting period from payment tokens
Jan 2020 to Mar 2020
Exchange gain (loss) for digital (200)
payment tokens Exchange gain (loss) for foreign 400
currency
Interest received from deposit with 300
banks
Value of exempt supplies |(200)| + 400 + 300
= $900
Q9 Can I report the value of supply of digital payment tokens issued during
my ICO based on the proceeds received, and then report the value of
supply for subsequent transactions based on realised gain or loss? A9 Yes, you may report the proceeds received as the value of supply for ICO
transactions. For subsequent exchanges of the tokens for fiat currency or
other digital payment tokens, you may choose to report the realised gain or
loss. This is allowed as long as you apply the method chosen consistently.
14 Contact information
10.1 For enquiries on this e-Tax Guide, please contact the Goods and Services
Tax Division at www.iras.gov.sg (select "Contact Us")
15 Updates and Amendments
Date of
Amendments made
amendment
1 3 Aug 2022 • Editorial changes.
• Amended paragraphs 3.6 and 3.8 to reflect the
definition in Income Tax e-Tax Guide on digital
payment tokens.
• Added paragraph 5.11 to clarify that if a digital
payment token is listed on an exchange, IRAS will
regard the token as suitable for use as a medium
of exchange.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: EU_GDPR (Article 44+ cross-border data transfer restrictions) and SG_IRAS_TAX (IRAS GST and crypto-asset tax framework — recordkeeping and information requests on Singapore taxpayers' transactions including those involving EU counterparties or operators). When SG entities handle EU-resident customer data for IRAS reporting / GST audit purposes, GDPR Chapter V cross-border transfer restrictions engage on the EU side. Operationally resolvable via GDPR Article 6(1)(c) (legal-obligation lawful basis) plus Chapter V mechanisms (SCCs / Art. 49 derogations) or via the EU-SG competent-authority tax-info-exchange agreement framework. Same conflict shape as the labelled DAC8 × PDPA conflict, applied to EU-SG tax-reporting context.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

46 For information on ASIC's interpretation of this obligation, see ASIC PF 209 Australian financial services
licence conditions
Licensing digital asset intermediaries | 23

(vi) having the financial,47 technological, and human resources to carry out and supervise the
financial service covered by the AFSL,
(vii) having a dispute resolution system48 and compensation arrangements for retail clients for
loss or damage suffered due to breaches of obligations, and
(viii) maintaining a risk management system.
Financial requirements
(g) A platform provider must meet:
(i) the standard solvency and positive net asset requirements,49
(ii) the standard cash needs requirement, and
(iii) a net tangible assets (NTA) requirement for holding cash or cash equivalents and holding
liquid assets of at least:
• 0.5 per cent of the value of the facility (if using a sub-custodian digital asset facility that
has $5m NTA),50 or
• $5 million (if performing the custody function).
Info Box 6 Financial requirements
AFSL holders have obligations to meet 'financial requirements'. These requirements are typically
tailored for different financial products through ASIC legislative instruments. The NTA obligation is
to address the costs of orderly wind-up in the event the provider fails.51
A key issue with digital assets is concentration risk (see Info Box 11 Additional Standards for token
holders). The proposed financial requirements balance the need to avoid concentration of digital
assets among a small number of custodians with the need to ensure robust NTA. It sets the
required level of NTA at the greater of $5 million or 0.5% of the value of the assets held by the
facility.52 This arrangement ensures that as a facility expands, and the operational risk exposure of
the platform provider grows, the provider will maintain a corresponding level of financial
resources.

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The regimes regulate distinct aspects of the financial ecosystem. Regime A (AU_ASIC_AFSL) establishes licensing and conduct obligations for entities providing financial services, specifically digital asset facilities, including financial requirements and AFSL authorisation (chunk_ids 550958b067dc6726::41f::546c, 550958b067dc6726::74a::7ef1). Regime B (INT_BASEL_CRYPTO) focuses on prudential capital requirements for banks, defining exposures and risk weights for financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other; rather, they apply to different entities (platform providers vs. banks) and different regulatory objectives (licensing/conduct vs. capital adequacy).


19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The evidence for Regime A (AU_APRA_CPS230) focuses on operational risk management, business continuity, and the management of service providers to ensure resilience and prudential obligations (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence for Regime B (SG_FOUNDATIONAL_LEGISLATION) discusses the regulation of digital tokens, securities, and the Payment Services Act, specifically referencing MAS enforcement actions and the intention to align with international AML/CFT standards (chunk_ids b49627bb889ef1d9::3ef::7168, d6f4be6b9d136778::467::12af). The obligations in Regime A relate to internal risk management and continuity planning, while the obligations in Regime B relate to the licensing and conduct of digital token activities. These are distinct regulatory domains; there is no specific obligation in Regime A that pushes against a specific obligation in Regime B. Therefore, the regimes are non-conflicting.