Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Explanation: The APRA passage describes a prudential framework for regulated institutions (ADIs, insurers, RSE licensees) focused on capital requirements, licensing, and supervision (chunk 66d049e24f0863da::3f7::aec8). The EU_PSD2 passage describes a directive on payment services, specifically focusing on strong customer authentication and security measures for payment service providers (chunk adb1a81b9cecaf8c::64f::f5ad). The obligations in the APRA regime relate to prudential supervision and capital adequacy, while the obligations in the EU_PSD2 regime relate to payment service security and authentication. These are distinct regulatory domains with no apparent overlap of obligations.


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: INT_FATF_VASP (FATF AML standards for VAs/VASPs) and INT_IOSCO_GENERAL (IOSCO securities regulation principles). Both are international standards bodies; FATF addresses AML/CFT, IOSCO addresses securities-regulation conduct and market integrity. They publish coordinated international guidance, often jointly, on crypto-related concerns. Aligned pillars of international financial regulation.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The AU_PRIVACY regime regulates the cross-border disclosure of personal information to overseas recipients, requiring entities to ensure recipients comply with Australian Privacy Principles (APPs) or obtain specific consent (chunk_ids e9f6b0a9e797777d::5d6::e5ff, e9f6b0a9e797777d::4ba::1af3). The SG_STABLECOIN regime regulates the issuance and reserve requirements of Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from other digital payment tokens (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The obligations in the SG_STABLECOIN regime pertain to the asset backing and regulatory perimeter of the token itself, whereas the AU_PRIVACY obligations pertain to the handling of personal data during cross-border transfers. There is no specific obligation in the SG_STABLECOIN regime that pushes against the cross-border disclosure obligations in AU_PRIVACY. Therefore, the regimes regulate different domains and do not conflict.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

2 APRA's prudential framework comprises prudential standards and prudential practice guides (PPGs). APRA is
empowered to issue legally binding prudential standards that set out specific requirements with which APRA-regulated
institutions - authorised deposit-taking institutions (ADIs), general insurers and life companies (collectively,
insurers) and registrable superannuation entity licensees (RSE licensees) - must comply. APRA also issues PPGs,
which clarify APRA's expectations with regard to prudential matters. PPGs frequently discuss legal requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements.

Explanation: AU_APRA_CPS234 (APRA Information Security prudential standard) and AU_APRA_PRUDENTIAL (APRA's broader prudential framework). CPS 234 is part of APRA's prudential standards architecture; they operate together as parts of the same AU prudential framework.


Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): AUSTRAC IFTI / EFTI travel-rule reporting and AU Treasury Digital Asset Platforms framework operate in disjoint regulatory domains at the obligation level. AML travel-rule vs proposed DAP framework — disjoint domains. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 230 operational-risk management standard and APRA CPS 234 information security standard are designed to coexist — obligations apply cumulatively without collision. Both APRA prudential standards on operational risk and information security — designed to coexist within the APRA framework. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: The evidence from Regime A (AU_AML_CTF) outlines general reporting obligations for suspicious matters and threshold transactions under the AML/CTF Act. The evidence from Regime B (SG_PSA_DPT) confirms that holders of a payment service licence providing digital payment token services are subject to AML/CFT requirements. The obligations in Regime A (reporting suspicious matters) are complementary to the obligations in Regime B (compliance with AML/CFT requirements for DPT services), reinforcing the same compliance goal without creating a specific conflict between the two regimes.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

'@ Australian Government Cee ee
ahem 8 eporting Home / Business / Core guidance / Reporting As a reporting entity you must report certain transactions and suspicious matters, and
submit compliance reports to AUSTRAC. Everyone, including reporting entities, must
report cross-border movements of physical currency. Ongoing reporting obligations Threshold transaction reports You must submit threshold transaction reports (TTR) for transfers of A$10,000 or more
in cash (or the foreign currency equivalent). TTRs are due within 10 business days after
the date of the transaction. International funds transfer instruction reports (IFTIs) You must submit international funds transfer instruction reports (IFTIs) for transfers of
funds of any value into or out of Australia, made either electronically or under a
designated remittance arrangement. IFTIs are due within 10 business days after the
transfer instruction is sent or received. Suspicious matter reports (SMRs) You must submit suspicious matter reports (SMRs) when you have a suspicion that a
customer or transaction is related to criminal activity.

(66)
Issuers of e-money tokens should be authorised either as a credit institution under Directive 2013/36/EU or as an
electronic money institution under Directive 2009/110/EC. E-money tokens should be deemed to be 'electronic
money' as that term is defined in Directive 2009/110/EC and their issuers should, unless specified otherwise in
this Regulation, comply with the relevant requirements set out in Directive 2009/110/EC for the taking up,
pursuit and prudential supervision of the business of electronic money institutions and the requirements on
issuance and redeemability of e-money tokens. Issuers of e-money tokens should draw up a crypto-asset white
paper and notify it to their competent authority. Exemptions regarding limited networks, regarding certain
transactions by providers of electronic communications networks and regarding electronic money institutions
issuing only a limited maximum amount of electronic money, based on the optional exemptions specified in
Directive 2009/110/EC, should also apply to e-money tokens. However, issuers of e-money tokens should still be
required to draw up a crypto-asset white paper in order to inform buyers about the characteristics and risks of
the e-money tokens and should also be required to notify the crypto-asset white paper to the competent authority
before its publication.

Article 57
Voluntary classification of e-money tokens as significant e-money tokens
1.
An issuer of an e-money token, authorised as a credit institution or as an electronic money institution, or applying
for such authorisation, may indicate that it wishes for its e-money token to be classified as a significant e-money token.
In that case, the competent authority shall immediately notify such request of the issuer to EBA, to the ECB and, in the
cases referred to in Article 56(3), second subparagraph, to the central bank of the Member State concerned.
In order for the e-money token to be classified as significant under this Article, the issuer of the e-money token shall
demonstrate, through a detailed programme of operations, that it is likely to meet at least three of the criteria set out in

Explanation: MiCA Title IV regulates issuers of e-money tokens; AUSTRAC AML/CTF regulates reporting entities providing designated services in Australia. The two regimes apply to different regulated populations in different jurisdictions and address different subject matters. An Australian reporting entity is not an EMT issuer in the EU unless it separately establishes and authorises there (see the structural conflict labelled at AU_TREASURY_DAP :: EU_MICA_TITLE_IV_EMT). For an AU reporting entity simply performing AML/CTF compliance on its Australian-customer book, no MiCA Title IV obligation arises. This is the 'different domains' negative class — a deliberate non-conflict that the typed-seed queue surfaced as borderline.

The AU AML/CTF entity itself issued a stablecoin marketed to EU residents — that scenario is the structural pair AU_TREASURY_DAP :: EU_MICA_TITLE_IV_EMT.


1 INTRODUCTION
This Regulation Impact Statement (RIS) addresses the Australian Prudential Regulation
Authority's (APRA's) proposed introduction of new reporting standards applying to trustees of
registrable superannuation entities (RSE licensees). APRA is the prudential regulator of the superannuation, banking and insurance industries. Its
mission is to ensure that, under all reasonable circumstances, financial promises made by APRA-
regulated institutions are met within a stable, efficient and competitive financial system. APRA
carries out this mission through a multi-layered prudential framework that encompasses
licensing and supervision of institutions. For many years, APRA has had the power to make
prudential standards implementing this framework for the banking and insurance industries. APRA is also empowered to make reporting standards under the Financial Sector (Collection of
Data) Act 2001 (FSCODA), which require regulated institutions to submit specified data through
various reporting forms.

(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

Explanation: The AU_APRA_PRUDENTIAL passage describes APRA's prudential framework, licensing, and supervision of financial institutions (chunk 66d049e24f0863da::3f7::aec8). The EU_AMLR_TFR passage references the EU's Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) framework and specific regulations regarding transfers of funds and crypto-assets (chunk c4024f4c4c1616cc::23d::700a). The obligations described in the EU passage relate to information accompanying transfers and AML/CFT compliance, whereas the APRA passage focuses on prudential standards, capital requirements, and supervision. These are distinct regulatory domains with no apparent overlap of obligations or conflicting requirements.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The AU_TRAVEL_RULE passages discuss the Australian regulatory framework for digital currency exchanges and the implementation of FATF's 'Travel Rule' (chunk_ids cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). The MAS_TRM passages discuss MAS guidelines for licensees, including the TRM Guidelines and F&P Guidelines, and responses to feedback regarding their application (chunk_ids 20d526d712753652::403::be97, 20d526d712753652::401::f956). The two regimes regulate distinct aspects of the financial services industry: one focuses on AML/CTF obligations and the Travel Rule for digital currency in Australia, while the other focuses on MAS licensing guidelines and principles for financial institutions. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are in non_conflict.


2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

1.1 The Guidelines on Licensing for Digital Token Service Providers (the "Guidelines")
are intended to provide guidance on the application procedures, licensing criteria and
ongoing requirements for Digital Token Service Providers under Part 9 of the Financial
Services and Markets Act 2022 (the "FSM Act"). Under this, digital token service providers are
defined as individuals, partnerships or Singapore corporations that are operating from a place
of business in Singapore or formed or incorporated in Singapore but carry on a business of
providing digital token services outside Singapore ("DTSPs").

1.2 These Guidelines should be read in conjunction with the provisions of the FSM Act,
the Financial Services and Markets (Digital Token Service Provider) Regulations (the "FSM
Regulations") and other relevant legislation, notices, guidelines and FAQs issued by the
Monetary Authority of Singapore ("MAS").

1.3 MAS will update these Guidelines periodically to provide further guidance.
2. Licence under the FSM Act

Explanation: EU_MICA (broad EU crypto-asset framework, including CASP authorisation) and SG_FSMA_DTSP (Singapore DTSP licensing under FSM Act 2022). Both establish parallel licensing regimes for crypto-asset / digital token services in their respective jurisdictions with no transit pathway. Structural-non-transit conflict.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: Regime A (INT_BASEL_CRYPTO) regulates capital requirements, risk-weighting, and prudential standards for banks and financial institutions (e.g., exposures to securities firms, collateral treatment). Regime B (SG_MAS_AML_GENERAL) regulates Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations, specifically targeting Digital Payment Token (DPT) providers and financial institutions. The obligations in Regime A relate to financial stability and capital adequacy, while the obligations in Regime B relate to compliance with sanctions, money laundering risks, and licensing requirements. The passages confirm that these regimes govern distinct domains—prudential banking regulation versus AML/CFT compliance—resulting in no overlap of obligations.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: EU_MICA (EU Markets in Crypto-Assets framework — market abuse guidelines under Article 92) and SG_PSA_GENERAL (Singapore Payment Services Act / stablecoin framework). Both regulate crypto/payment services in different jurisdictions. The cited passages address different specific concerns (EU market-abuse supervisory practices vs SG stablecoin regulatory scope). No conflicting obligation on cited passages.


For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: EU_GDPR (cross-border data transfer / data-processing principles — the cited passage is from the EU's prior TFR predecessor recognising GDPR-style data-protection limits on AML data processing) and SG_AML (MAS Notice 314 AML/CFT training requirements for AML staff, including handling of personal data). When a regulated entity operating across both jurisdictions implements AML training and data-handling per MAS Notice 314 on EU-resident customers, GDPR's cross-border processing restrictions engage. Operationally resolvable via GDPR Art. 6(1)(c) and Chapter V mechanisms.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers (specifically digital asset intermediaries) in Australia. The EU_NIS2 regime regulates the security of network and information systems within the European Union. The cited passages confirm that the obligations are jurisdictionally and functionally distinct: Regime A focuses on financial services licensing and conduct (chunk 550958b067dc6726::709::b159), while Regime B focuses on digital operational resilience and security standards (chunk 85307f9e2a040982::14a::134d). There is no specific obligation in one regime that creates a direct, actionable conflict with a specific obligation in the other.


'@ Australian Government Cee ee
ahem 8 eporting Home / Business / Core guidance / Reporting As a reporting entity you must report certain transactions and suspicious matters, and
submit compliance reports to AUSTRAC. Everyone, including reporting entities, must
report cross-border movements of physical currency. Ongoing reporting obligations Threshold transaction reports You must submit threshold transaction reports (TTR) for transfers of A$10,000 or more
in cash (or the foreign currency equivalent). TTRs are due within 10 business days after
the date of the transaction. International funds transfer instruction reports (IFTIs) You must submit international funds transfer instruction reports (IFTIs) for transfers of
funds of any value into or out of Australia, made either electronically or under a
designated remittance arrangement. IFTIs are due within 10 business days after the
transfer instruction is sent or received. Suspicious matter reports (SMRs) You must submit suspicious matter reports (SMRs) when you have a suspicion that a
customer or transaction is related to criminal activity.

means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

Exemption of certain types of transactions relating to safe deposit boxes or similar CHAPTER 32
facilities
(e) resort; or
(f) serviced apartment. Reporting entities should note that in relation to activities they undertake to comply
with the AML/CTF Act, they will have obligations under the Privacy Act 1988,
including the requirement to comply with the Australian Privacy Principles, even if
they would otherwise be exempt from the Privacy Act. For further information about
these obligations, please go to http://www.oaic.gov.au or call 1300 363 992. Anti-Money Laundering and Counter-Terrorism Financing 187
Rules Instrument 2007 (No. 1)

Disclosing personal information to an overseas
recipient where a permitted general situation
exists
8.37 The cross-border principle will not apply if a permitted general situation exists for that
disclosure (APP 8.2(d)). Section 16A lists five permitted general situations that may exist for a
cross border disclosure. These situations are set out below, and are discussed in more detail
in Chapter C (Permitted general situations) (including the meaning of relevant terms).
16 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 84. Office of the Australian Information Commissioner - APP Guidelines Page 11 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Lessening or preventing a serious threat to life, health or
safety
8.38 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• it is unreasonable or impracticable to obtain the individual's consent to the disclosure,
and
• the entity reasonably believes the disclosure is necessary to lessen or prevent a serious
threat to the life, health or safety of any individual, or to public health or safety (s 16A(1),
Item 1)
8.39 For example, this permitted general situation might apply where an APP entity discloses the
personal information of an individual to a foreign authority, based on a reasonable belief
that this disclosure will lessen a serious threat to the health or safety of that individual's
children, but seeking the individual's consent may increase the threat.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.3, October 2025
8.27 The mechanism may be a single mechanism or a combination of mechanisms. It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
Exception 2 - Disclosing personal information
to an overseas recipient where the country or a
binding scheme is prescribed by regulations
8.28 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where the overseas recipient of the relevant personal information is:
• subject to the laws of a country prescribed by regulations, or a participant in a binding
scheme prescribed by regulations,16 and
• if the country or binding scheme is prescribed subject to conditions, those conditions are
satisfied.17
8.29 Laws and binding schemes are discussed above at paragraphs 8.22-8.23.
8.30 The Governor-General may make regulations under the Privacy Act to prescribe these
matters.18
Exception 3 - Disclosing personal information
to an overseas recipient with the individual's
consent after the individual is expressly
informed
8.31 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b)).

Explanation: The AML/CTF Act and AML/CTF Rules require reporting entities to collect KYC information, lodge threshold transaction reports and suspicious matter reports, and disclose this personal information to AUSTRAC and (in defined cases) overseas counterparts. The Privacy Act / APPs constrain collection, use and onward disclosure (APP 3, APP 6, APP 8) and place accountability for overseas recipients on the disclosing entity. The AML/CTF Rules themselves explicitly note that reporting entities continue to have Privacy Act obligations in respect of the activities they undertake to comply with the AML/CTF Act, which signals that Parliament intended the regimes to coexist rather than override one another. APP 6.2(b) (use/disclosure required or authorised by Australian law) and the permitted-general-situation doctrine under APP 8.2(d) provide an operative resolution: AML/CTF disclosures are 'authorised by law' and therefore not prevented by APP 6, and overseas-disclosure accountability under APP 8.1 is in practice modulated where the disclosure is to a foreign regulator or FIU under recognised arrangements. The tension is real but routinely managed in practice.

Use AML/CTF disclosure exceptions: rely on APP 6.2(b) (use or disclosure required or authorised by an Australian law) for AUSTRAC reporting and SMR transmission.

For overseas disclosure (e.g. to a foreign FIU), document either an APP 8.2(a) reasonable-belief assessment or an APP 8.2(d) permitted general situation per s 16A.

Maintain an APP 1 transparent privacy policy that explicitly references AML/CTF reporting as a primary purpose of collection.

Reporting entity is registered under the AML/CTF Act and not relying on small-business or media-style Privacy Act exemptions.

Disclosures are made to AUSTRAC, the ATO, or foreign FIUs under recognised information-sharing arrangements rather than to private parties.


Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

To that end, crypto-asset service providers shall employ appropriate and proportionate
resources and procedures, including resilient and secure ICT systems as required by Regulation (EU) 2022/2554. Crypto-asset service providers shall establish a business continuity policy, which shall include ICT business continuity
plans as well as ICT response and recovery plans set up pursuant to Articles 11 and 12 of Regulation (EU) 2022/2554
that aim to ensure, in the case of an interruption to their ICT systems and procedures, the preservation of essential data
and functions and the maintenance of crypto-asset services or, where that is not possible, the timely recovery of such
data and functions and the timely resumption of crypto-asset services.
8. Crypto-asset service providers shall have in place mechanisms, systems and procedures as required by Regulation
(EU) 2022/2554, as well as effective procedures and arrangements for risk assessment, to comply with the provisions of
national law transposing Directive (EU) 2015/849.

components of the ICT response and recovery plans of crypto-asset service providers. This Regulation complements those provisions of Regulation (EU) 2022/2554 and of
Delegated Regulation (EU) xx/xxx on DORA ICT risk management framework] with
respect to continuity and regularity in the performance of the crypto-asset services. (3) Certain measures taken by a crypto-asset service provider may not be capable of
ensuring the regularity and continuity of their services when disruptions occur which
are caused by problems inherent in the operation of the distributed ledger that the
crypto-asset service provider does not control, such as permissionless distributed
ledgers. To limit the adverse impact on clients affected by disruptions to services using
a permissionless distributed ledger, the crypto-asset service provider should include
measures for timely communication with clients and other external stakeholders in their
business continuity plans. Such communication should include essential and timely
information for clients, including ongoing status updates until the incident is resolved
and services are resumed.

Explanation: MiCA Article 68 expressly requires CASPs to employ 'resilient and secure ICT systems as required by Regulation (EU) 2022/2554' (DORA) and to establish ICT business-continuity, response and recovery plans 'pursuant to Articles 11 and 12 of Regulation (EU) 2022/2554'. ESMA's MiCA final report describes its operational-resilience standards as complementing those of DORA. A reasonable single party (a EU-authorised CASP) can — and must — satisfy both regimes simultaneously; no obligation in one points against any obligation in the other. A labeller could mistake this for a conflict because both regimes regulate operational and ICT-related matters for crypto-asset firms, but on inspection MiCA is the sectoral authorisation regime and DORA is the cross-sectoral ICT-risk regime that MiCA explicitly defers to.

MiCA later mandated a CASP-specific ICT control that contradicted a DORA standard (current text expressly forecloses this by deferring to DORA).


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: The EU_MAR regime regulates market abuse, insider dealing, and market manipulation in financial markets (chunk_ids 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The SG_FOUNDATIONAL_LEGISLATION passages discuss the Monetary Authority of Singapore's (MAS) oversight of digital tokens, ICOs, and securities token offerings, as well as international regulatory cooperation (chunk_ids b49627bb889ef1d9::3ef::7168, 7c04f2a0bd85290a::413::fc6a). While both regimes involve financial market integrity, the SG passages focus on the regulation of virtual assets and token offerings, which are distinct from the specific market abuse prohibitions and detection mechanisms detailed in the EU_MAR passages. There is no evidence of a specific obligation in EU_MAR conflicting with a specific obligation in the SG legislation; rather, they operate in different domains regarding the specific instruments and activities regulated.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

Explanation: The evidence from Regime A (AU_APRA_CPS230) focuses on operational risk management, business continuity, and the resilience of APRA-regulated entities to disruptions (chunk_id f296a7e0bead93df::5e9::d5f4). The evidence from Regime B (EU_MICA_RTS) focuses on the development of regulatory technical standards (RTS) for the assessment of proposed acquisitions of qualifying holdings in Crypto-asset service providers (CASPs) (chunk_id c51ad46265cea4e5::361::e378). The obligations in Regime A relate to internal risk management and resilience, while the obligations in Regime B relate to external notification requirements for acquisitions. These are distinct regulatory domains with no apparent overlap or conflict.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The evidence for Regime A (AU_APRA_CPS234) describes a general prudential practice guide focused on operational risk management and information security for APRA-regulated entities (chunk 4b6fab404e7acfca::3c4::1564). The evidence for Regime B (SG_STABLECOIN) outlines a specific regulatory framework for Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from other digital payment tokens (chunk 58f45cd2ef3de201::36c::e2f6). The passages describe distinct regulatory domains—one focused on general prudential risk management for Australian entities and the other on a specific stablecoin issuance regime in Singapore. There is no evidence of a specific obligation in one regime directly conflicting with a specific obligation in the other.


2 APRA's prudential framework comprises prudential standards and prudential practice guides (PPGs). APRA is
empowered to issue legally binding prudential standards that set out specific requirements with which APRA-regulated
institutions - authorised deposit-taking institutions (ADIs), general insurers and life companies (collectively,
insurers) and registrable superannuation entity licensees (RSE licensees) - must comply. APRA also issues PPGs,
which clarify APRA's expectations with regard to prudential matters. PPGs frequently discuss legal requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Explanation: The APRA passage describes the Australian prudential regulatory framework, including standards for ADIs and insurers, and the MIFID2 passage describes the European Union's product governance and suitability obligations for investment firms. The obligations in the APRA passage relate to prudential supervision and capital requirements for regulated institutions, while the obligations in the MIFID2 passage relate to the conduct of business, product governance, and suitability assessments for investment services. These are distinct regulatory domains; APRA's prudential standards do not impose the specific product governance and suitability obligations detailed in MIFID2, nor do MIFID2's conduct obligations directly conflict with APRA's prudential capital requirements.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Explanation: The evidence from Regime A (AU_FEDREG_AML) focuses on obligations for reporting entities regarding customer identification, suspicious transaction reporting, and AML/CTF program compliance (chunk cf7cefacba3f94bc::49a::f39e). The evidence from Regime B (EU_MICA_TITLE_IV_EMT) focuses on the liability of issuers of e-money tokens for information provided in crypto-asset white papers (chunk 491a2f0014d56ffb::702::05e4). The obligations in Regime A relate to anti-money laundering and financial crime prevention, while the obligations in Regime B relate to consumer protection and disclosure requirements for token issuers. The regimes regulate different domains (financial crime compliance vs. product disclosure), and there is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token issued by an issuer that is not authorised in accordance with
Title III of MiCA. At the time of providing the relevant crypto-asset service(s),
the third-country firm also markets or offers a widely different type of crypto-
asset, for instance, meme coins to the EU client. Guideline 4 A third-country firm is contacted by an EU client that wishes to buy an asset-
referenced token authorised in the EU under Title III of MiCA. At the time of
providing the relevant crypto-asset service(s), the third-country firm also
markets or offers "meme coins" to the EU client. Guideline 4 A third-country firm is approached by an EU-based individual for the provision
of a specific crypto-asset service. In response, the third-country firm offers
this individual a package of bundled crypto-asset services.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: The EU_MICA passages describe obligations related to crypto-asset service provision, market abuse prevention, and licensing requirements for crypto-asset service providers (e.g., Guideline 4, Article 92, Article 81). The SG_MAS_AML_GENERAL passages describe the regulatory framework for Digital Payment Token (DPT) services, transitional exemptions, and AML/CFT supervision. The passages do not contain specific obligations in one regime that directly oppose or conflict with obligations in the other. Instead, they address distinct regulatory domains (EU MiCA crypto-asset services vs. Singapore MAS DPT and AML/CFT supervision).


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

(68) To evaluate and monitor on a regular basis the ability of an ICT third party service provider to securely provide
services to a financial entity without adverse effects on a financial entity's digital operational resilience, several key
contractual elements with ICT third-party service providers should be harmonised. Such harmonisation should
cover minimum areas which are crucial for enabling a full monitoring by the financial entity of the risks that could
emerge from the ICT third-party service provider, from the perspective of a financial entity's need to secure its
digital resilience because it is deeply dependent on the stability, functionality, availability and security of the ICT
services received.

(69) When renegotiating contractual arrangements to seek alignment with the requirements of this Regulation, financial
entities and ICT third-party service providers should ensure the coverage of the key contractual provisions as
provided for in this Regulation.

Explanation: AMLR/TFR addresses AML/CFT information collection, retention and transmission for transfers of funds and crypto-assets. DORA addresses the ICT-risk management framework, operational resilience, incident reporting and third-party ICT-risk on EU financial entities and CASPs. The two regimes share the same regulated population (PSPs and CASPs in particular) but operate on completely different obligation surfaces. A labeller might wonder whether DORA's record-retention or incident-reporting rules interact with TFR's retention duty (Art. 19) — they do not intersect in content; DORA retention is about ICT logs, TFR is about transaction-level customer data.

DORA's data-protection annex provisions (Art. 9(4)(d)) created a stricter retention or pseudonymisation duty inconsistent with TFR's 5-year customer-data retention — they do not.


Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The AU_TREASURY_DAP passages describe a domestic policy agenda focused on 'token mapping' and the development of a licensing framework for crypto assets (chunk_ids d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). In contrast, the FATF_R16 passages provide international guidance on digital identity and anti-money laundering (AML) standards (chunk_ids 5d489619a0fb9ecf::377::a91e, 85240528438654b9::396::417b). The regimes regulate different domains: one is a domestic regulatory reform agenda for crypto assets, while the other is international AML/CFT guidance on digital identity. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

MAS to adopt a collegiate approach with regulators in jurisdiction of issuers and
distribution to align enforcements
6 Binance Question 1. MAS seeks comments on the regulatory scope, particularly on whether the focus on SCS
is adequate and whether there may be reasons for MAS to extend its regulatory powers
to SCS issued outside of Singapore. Binance has provided comments to specific questions. More generally, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction. For example, SCS issued under
EU MiCA regulation, or SCS issued using currencies referred to in paragraph 4.14 of the
CP. (b) that extending regulatory powers of for example, supervision and enforcement to SCS
issued outside SG, that operate inside or outside of SG, may be better achieved through
existing regulatory cooperation agreements within the financial services sector, including
those being developed at the global level by the Financial Stability Board.

Explanation: EU_MICA_RTS (EU CASP authorisation technical standards) and SG_PSA_GENERAL (Singapore Payment Services Act general framework). The B passage is actually a MAS consultation response on stablecoin regulation rather than the PSA itself — still SG-side payment-related. Different jurisdictional perimeters and specific obligations; no tension visible.