Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The AU Travel Rule passage discusses the Australian regulatory framework for digital currency exchanges and the potential implementation of FATF's Travel Rule to identify parties in transactions (chunk_ids c4a92930a8caf822::380::0a18, cf7cefacba3f94bc::383::7d9d). The SG Stablecoin passage outlines Singapore's regulatory perimeter for Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from other digital payment tokens (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The two regimes regulate distinct aspects of the digital asset ecosystem: one focuses on AML/CTF obligations and transaction identification for exchanges, while the other focuses on the issuance and reserve requirements of specific stablecoin products. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other. Therefore, the relationship is non_conflict with subtype different_domains.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: The evidence from Regime A (AU_FEDREG_AML) outlines obligations for reporting entities under the AML/CTF Act, including customer identification, suspicious transaction reporting, and program requirements. The evidence from Regime B (EU_MICA_TITLE_V_CASP) describes the requirements for authorisation as a Crypto-Asset Service Provider (CASP) under MiCA, specifically the application process and information requirements. The passages do not describe conflicting obligations; rather, they address distinct regulatory frameworks (financial crime prevention vs. crypto-asset service provider authorisation). Therefore, the regimes are in different domains.


Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Note: Where a reporting entity is unable to ascertain whether the circumstances in
19.3(17)(a) applies, the reporting entity can assume that the transaction was
carried out by the customer.
19.4 If the threshold transaction arises under a designated service that is of a kind
described in item 3 of table 1 in subsection 6(2) of the AML/CTF Act, the
reference to 'customer' in subparagraphs 19.3(2) to 19.3(14) inclusive will
be taken, in the first instance, to refer only to the holder of the account and
the signatory (if any) conducting the transaction in relation to the account,
provided that:
(1) if there are other signatories to the account, the AUSTRAC CEO may
require the reporting entity to give to the AUSTRAC CEO, in the
form of a supplement to the subsection 43(2)

Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.3, October 2025
8.27 The mechanism may be a single mechanism or a combination of mechanisms. It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
Exception 2 - Disclosing personal information
to an overseas recipient where the country or a
binding scheme is prescribed by regulations
8.28 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where the overseas recipient of the relevant personal information is:
• subject to the laws of a country prescribed by regulations, or a participant in a binding
scheme prescribed by regulations,16 and
• if the country or binding scheme is prescribed subject to conditions, those conditions are
satisfied.17
8.29 Laws and binding schemes are discussed above at paragraphs 8.22-8.23.
8.30 The Governor-General may make regulations under the Privacy Act to prescribe these
matters.18
Exception 3 - Disclosing personal information
to an overseas recipient with the individual's
consent after the individual is expressly
informed
8.31 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b)).

Disclosing personal information to an overseas
recipient where a permitted general situation
exists
8.37 The cross-border principle will not apply if a permitted general situation exists for that
disclosure (APP 8.2(d)). Section 16A lists five permitted general situations that may exist for a
cross border disclosure. These situations are set out below, and are discussed in more detail
in Chapter C (Permitted general situations) (including the meaning of relevant terms).
16 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 84. Office of the Australian Information Commissioner - APP Guidelines Page 11 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Lessening or preventing a serious threat to life, health or
safety
8.38 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• it is unreasonable or impracticable to obtain the individual's consent to the disclosure,
and
• the entity reasonably believes the disclosure is necessary to lessen or prevent a serious
threat to the life, health or safety of any individual, or to public health or safety (s 16A(1),
Item 1)
8.39 For example, this permitted general situation might apply where an APP entity discloses the
personal information of an individual to a foreign authority, based on a reasonable belief
that this disclosure will lessen a serious threat to the health or safety of that individual's
children, but seeking the individual's consent may increase the threat.

Explanation: The AML/CTF Act and Rules establish a seven-year retention regime for KYC, transaction and SMR records (sections 113–116 of the Act). APP 11.2 requires APP entities to take 'reasonable steps' to destroy or de-identify personal information that the entity 'no longer needs for any purpose' for which it may be used or disclosed under the APPs. The two settings push in opposite directions on a recurring basis: every customer departure resets a clock that ends with retention under AML/CTF (seven years post-relationship) but starts the APP 11.2 'reasonable steps to destroy' obligation in tension. The resolution is well-known (APP 11.2 has a 'unless required to retain by an Australian law' exception that AML/CTF satisfies), so this is not operationally unresolved; but the cost recurs and the periodic friction is real, particularly for entities with high customer churn or for SMRs that age past their statutory minimum.

Implement a retention-policy register that ties AML/CTF and APP 11.2 obligations to a single record-lifecycle calendar.

After AML/CTF retention expires, destroy / de-identify per APP 11.2.

Reporting entity has standardised customer onboarding documentation; bespoke or enhanced-CDD records may have different retention chains.


Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

Article 59
Authorisation
1.
A person shall not provide crypto-asset services, within the Union, unless that person is:
(a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with

Article 62
Application for authorisation as a crypto-asset service provider
1.
Legal persons or other undertakings that intend to provide crypto-asset services shall submit their application for
an authorisation as a crypto-asset service provider to the competent authority of their home Member State.
2.
The application referred to in paragraph 1 shall contain all of the following information:
(a) the name, including the legal name and any other commercial name used, the legal entity identifier of the applicant
crypto-asset service provider, the website operated by that provider, a contact email address, a contact telephone
number and its physical address;
EN
L 150/118

(b) the legal form of the applicant crypto-asset service provider;
(c) the articles of association of the applicant crypto-asset service provider, where applicable;
(d) a programme of operations, setting out the types of crypto-asset services that the applicant crypto-asset service
provider intends to provide, including where and how those services are to be marketed;
(e) proof that the applicant crypto-asset service provider meets the requirements for prudential safeguards set out in

As regards crypto-asset service providers, the register shall contain the following information:
(a) the name, legal form and legal entity identifier of the crypto-asset service provider and, where applicable, of the
branches of the crypto-asset service provider;
(b) the commercial name, physical address, telephone number, email and website of the crypto-asset service provider
and, where applicable, of the trading platform for crypto-assets operated by the crypto-asset service provider;
(c) the name and address of the competent authority that granted authorisation and its contact details;
(d) the list of crypto-asset services provided by the crypto-asset service provider;
(e) the list of host Member States in which the crypto-asset service provider intends to provide crypto-asset services;
(f) the starting date, or, if not available at the time of the notification by the competent authority, the intended starting
date, of the provision of crypto-asset services;
(g) any other services provided by the crypto-asset service provider not covered by this Regulation with a reference to
the applicable Union or national law;
(h) the date of authorisation and, where applicable, of the withdrawal of an authorisation.
6. Competent authorities shall notify ESMA without delay of the measures listed in Article 94(1), first subparagraph,
point (b), (c), (f), (l), (m), (n), (o) or (t), and of any public precautionary measures taken pursuant to Article 102 affecting
the provision of crypto-asset services or the issuance, offer to the public or use of crypto-assets.

Explanation: MiCA Title V imposes substantial personal-data processing duties on CASPs and their applicants: Article 62 application files identify management-body members with personal identifying information; Article 109 maintains a public register containing identifying details of CASPs and (where relevant) management-body members; Title V's conduct rules (Articles 68-79) require customer-suitability assessments, complaint-handling and order-execution records that involve personal data. GDPR Articles 5(1)(b)-(c) demand purpose limitation and minimisation; Article 25 requires data protection by design; Chapter V regulates cross-border transfer. The tension is operational rather than structural: GDPR Article 6(1)(c) (legal obligation) supplies the lawful basis for MiCA-mandated processing, Article 6(1)(b) covers contract performance for customer-conduct rules, and cross-border transfer to non-EEA counterparties is resolvable through Chapter V instruments. Practitioners must document the lawful-basis chain and design for purpose limitation, but no obligation in MiCA Title V is structurally incompatible with GDPR.

Rely on GDPR Art. 6(1)(c) (legal obligation) for MiCA Art 62/109 mandatory disclosures.

Use Art. 6(1)(b) (contract) for customer-conduct processing under MiCA Articles 68-79.

Apply Art. 25 data-protection-by-design when implementing MiCA's record-keeping requirements.

CASP is authorised under MiCA Title V and operating in the EU; third-country firms under reverse solicitation have a different analysis (labelled separately).


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

25. The reverse solicitation exemption is based on the premise that the crypto-asset product,
service or activity is provided at the client's own exclusive initiative. Article 61(2) of MiCA
leaves open the possibility for the third-country firm to market to that client crypto-assets
or crypto-asset services or activities of the same type. However, the requirement that the
crypto-asset services be provided on the basis of the own exclusive initiative of the client
still applies.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and ESMA's reverse-solicitation Guidelines under MiCA operate in disjoint regulatory domains at the obligation level. AML supervisor vs ESMA reverse-solicitation guidelines under MiCA — different subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards for access controls and cryptography (chunk_id 3c9eb3a25c93f394::474::4786). The SG_MAS_PRUDENTIAL_CRYPTO passage discusses the imposition of a risk-based capital framework for Stablecoin Issuers (SCS) and the principle of 'same activities, same risk, same regulation' (chunk_id 7c04f2a0bd85290a::449::02f2). The obligations are distinct: one relates to ICT security measures (access control/cryptography), while the other relates to financial prudential standards (capital requirements). There is no specific obligation in one regime that pushes against a specific obligation in the other. Therefore, the regimes are in different domains.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

Explanation: Regime A (INT_BASEL_CRYPTO) regulates capital requirements, risk-weighting of exposures, and prudential standards for banks and financial institutions. Regime B (SG_MAS_OUTSOURCING) regulates the management of outsourcing arrangements and information access for institutions operating in Singapore. The obligations in Regime A relate to financial risk and capital adequacy (e.g., defining bank exposures and risk-weighting) [32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa], while the obligations in Regime B relate to supervisory access and information retrieval regarding service providers [a82833dc0f7ca903::5f1::735d]. These are distinct regulatory domains; the capital treatment of exposures does not inherently conflict with the requirements for outsourcing information access.


or
(b) means an FX counterparty;
"relevant FX counterparty" is a FX counterparty that is not ⎯
(a) a financial institution as defined in section 2 of the FSM Act; or
(b) a financial institution incorporated or established outside Singapore that is subject
to, and supervised for compliance with, AML/CFT requirements consistent with
standards set by the FATF;
"SFA" means the Securities and Futures Act 2001;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"transaction" means any transaction accepted, processed, or executed by the payment
service provider in the course of carrying on its business of providing a digital payment
token service;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
[MAS Notice PSN02 (Amendment) 202

27 These offences typically relate to cybersecurity issues such as unauthorised access. addition, MAS' off-site monitoring will also enable us to identify and target specific
key risks and initiate supervisory follow-up actions including for-cause inspections
as necessary. Payment Services Act 2019
II-3-2 ML/TF risks have been identified as the primary risk concerns posed by virtual
assets, given the anonymity, speed and cross-border nature of transactions
facilitated by virtual asset providers. Under the Payment Services Act 2019 (PS
Act), MAS will impose AML/CFT requirements on the intermediaries that buy, sell
or exchange virtual assets in Singapore - these are the VASP business models
identified to be operating in Singapore. II-3-3 Under the PS Act, aligned with the FATF standards, DPT service providers are
required to conduct customer due diligence and transaction monitoring measures,
as well as to report suspicious transactions to the authorities. They are also
required to screen and submit information on their customers when transferring
DPTs to one another on behalf of their customers, and make this information
available on request to appropriate authorities in Singapore.

PART 3
GENERAL RULES WITH RESPECT TO
PROTECTION OFAND ACCOUNTABILITY FOR
PERSONAL DATA
11. Compliance with Act
12. Policies and practices

2020Ed. Act 2012 2

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Section
13. Consent required
14. Provision of consent
15. Deemed consent
15A. Deemed consent by notification
16. Withdrawal of consent
17. Collection, use and disclosure without consent
Division 2 - Purpose
18. Limitation of purpose and extent
19. Personal data collected before 2 July 2014
20. Notification of purpose

PART 5
ACCESS TO AND CORRECTION OF
PERSONAL DATA
21. Access to personal data
22. Correction of personal data
22A. Preservation of copies of personal data

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: SG_MAS_AML_GENERAL (MAS's broader AML/CFT supervisory framework — FSM Sanctions Regulations, MAS Notices SFA04-N02 and PSN02, requiring KYC/CDD and supervisory data collection on regulated entities and their customers) and SG_PDPA (Singapore PDPA — consent-based collection, use, and disclosure restrictions, Part 4). Same shape as the labelled SG_AML :: SG_PDPA conflict (careful cohort, operationally_resolvable): MAS's AML obligations require collection and ongoing use of personal data; PDPA restricts absent the 'required or authorised under any other written law' carve-out in s.13(b). Operationally resolvable via that statutory carve-out plus the MAS notices providing the legal basis.


2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

3.1 DTSPs are susceptible to higher money laundering, terrorism financing and
proliferation financing ("ML/TF") risks due to the internet-based and cross-border nature of
such services. This would result in a greater risk of such providers being engaged in or
misused for illicit purposes to the detriment of Singapore's reputation. In light of these risks,
MAS approaches the licensing of DTSPs in a prudent and cautious manner, and there will be
extremely limited circumstances under which MAS will consider granting an applicant a DTSP
licence under the FSM Act. The extremely limited circumstances include:
• The applicant has a business model that makes economic sense, and is able to
demonstrate to MAS' satisfaction that it has valid reasons as to why it does not
intend to carry on a business of providing digital token services in Singapore
despite operating in or being formed or incorporated in Singapore;
• The applicant does not operate in a manner that is of concern to MAS and is
already regulated and supervised for its compliance with relevant internationally
agreed standards, such as standards established by the Financial Stability
Board, the International Organisation of Securities Commissions and the
Financial Action Task Force ("FATF"); and
• MAS does not have concerns with the business structure of the applicant in
relation to, for example, its ability to comply with regulatory obligations.

We note that one of the MAS' criteria for DTSP applicants is that they are already
regulated and supervised for compliance with relevant internationally agreed
standards. For DTSP applicants that are already licensed overseas as payment
service providers and subject to AML/CFT requirements that are in line with FATF
standards, we note that under the AML Notice proposed under this regime, they will
not be able to rely on the CDD measures carried out by their overseas entities if such
overseas entities are payment services providers. We note that this is consistent
with the approach taken under PSN02. However, we query whether this is necessary in the context of this DTSP regime,
recognising that there could be some differences in the AML/CFT requirements in
the overseas jurisdictions with those required under the FSM AML Notice and
particularly since DTSPs would not have Singapore customers or business in
Singapore. Many DTSP applicants are likely to rely on existing compliance officers of
their overseas regulated entities who are already responsible to ensure AML/CFT
and CDD compliance with the requirements of their home regulator.

Specifically, we would like to seek clarity on the application of provisions in the PS Act
relating to licensing of payment service providers, and the prohibition against solicitation. 15 August 2023 | 92
(a) Will section 5 of the PS Act prohibit Overseas Issuers from carrying on a business of
providing regulated SCS issuance services in Singapore? Or will Overseas Issuers be
prohibited from carrying on a business of providing any stablecoin issuance services in
Singapore? (b) Will section 9 of the PS Act prohibit Overseas Issuers from offering to provide
regulated SCS issuance services in Singapore? Or will Overseas Issuers be prohibited from
offering to provide any stablecoin issuance services in Singapore? Question 2. MAS seeks comments on whether it is sufficient to introduce an additional regulated
payment service of stablecoin issuance, and whether there is a need to introduce any
other regulated services specific to stablecoins. We are supportive of the intention to introduce an additional regulated payment service
of SCS/stablecoin issuance.

Explanation: FSM Act Part 9 (operationalised by section 137) requires any person 'conducting digital token services in Singapore' to hold a DTSP licence unless exempt; Section 137(5) sets out the applicable exemptions. The DTSP Guidelines flag the cross-border / internet-based nature of DTSP services and their ML/TF exposure. Whether a foreign stablecoin issuer is 'conducting digital token services in Singapore' — and therefore subject to the DTSP licensing regime — depends on fact-sensitive elements: physical presence, marketing reach to SG residents, governing-law election, and contractual touchpoints. Industry submissions directly ask MAS to clarify whether PS Act s 5's prohibition on soliciting captures overseas issuers and how it interacts with FSMA DTSP licensing. This is fact-sensitive in the same vein as the SG_PSA_DPT :: SG_STABLECOIN pair.

Document geographic split of customer base; structure operations so that no part of the digital-token-service value chain is conducted in Singapore unless under a DTSP licence.

Foreign stablecoin issuer with no physical presence in SG; question is purely about extraterritorial DTSP licence reach.


178. As set out in INR. 15, countries should apply Recommendation 16 to VA transfers
and VASPs. Countries should apply Recommendation 16 regardless of whether the
value of the traditional wire transfer or the VA transfer is denominated in fiat
currency or a VA. However, recognising the unique technological properties of VAs,
Recommendation 16 applies in an amended way to VAs as set out in paragraph 7(b)
of INR.15. The application of the FATF's wire transfer requirements in the VA
context is called the travel rule.

40 See 2015 VC Guidance, paragraph 44 as well as June 2013 Guidance for a Risk-Based
Approach to New Payment Products and Services, paragraph 66.

52  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
or services, and conducting ongoing due diligence (see Section IV for further
discussion on ongoing due diligence and monitoring obligations for VASPs and
other obliged entities). Such transactional and record reviews are vital for effective
supervision and are an important data source for the transfer of the required
relevant customer information for compliance with the 'travel rule' (see
Recommendation 16).
Record-keeping

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): FATF Recommendation 16 travel rule and FATF VA/VASP Updated Guidance are designed to coexist — obligations apply cumulatively without collision. Same FATF authority — Recommendation 16 plus the detailed VA/VASP guidance that operationalises it for virtual assets. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The IOSCO General Principles passage (chunk_id f173909614befd49::455::1a1a) outlines high-level objectives and standards for securities regulation, focusing on cooperation and market integrity. The Singapore PDPA passage (chunk_id 0e996ae99839f19e::37b::85a8) regulates the collection, use, and disclosure of personal data, requiring consent. The obligations in these regimes regulate distinct domains—financial market regulation versus data protection—resulting in no direct conflict between the specific obligations cited.


Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Explanation: MiFID II governs investment-firm conduct (suitability, appropriateness, best execution, trading venue rules); PSD2 governs payment-service-provider conduct (strong customer authentication, open banking, payment instruments). They apply to substantively non-overlapping populations — an investment firm is not by default a PSP and vice versa. Hard negative.

MiFID II suitability rules required disclosure of payment-account-access permissions that PSD2 strong customer authentication confidentiality rules forbade — no such conflict in current text.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The passages from INT_BASEL_CRYPTO describe prudential capital requirements for banks and financial institutions, specifically defining 'bank exposures' and risk-weighting methodologies (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The passages from SG_FOUNDATIONAL_LEGISLATION describe MAS enforcement actions against ICO issuers and exchanges, and the intention to expand legislation to cover virtual asset service providers (chunk_ids b49627bb889ef1d9::3ef::7168, d6f4be6b9d136778::467::12af). These two regimes regulate distinct aspects of the financial system: Basel regulates capital adequacy and risk management for banks, while MAS regulates the conduct and licensing of digital token issuers and exchanges. There is no specific obligation in the Basel framework that conflicts with the MAS directives on digital tokens.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: The obligations in Prudential Standard CPS 230 (Regime A) relate to operational risk management, business continuity, and the resilience of critical operations for APRA-regulated entities. The obligations in the FATF General Guidance (Regime B) relate to anti-money laundering (AML), counter-terrorist financing (CFT), and the assessment of cross-border risks. The passages confirm that these regimes regulate distinct domains: one focuses on the resilience of critical operations and service provider management, while the other focuses on the detection of criminal proceeds and suspicious transactions. There is no specific obligation in CPS 230 that pushes against a specific obligation in FATF General Guidance, nor do the regimes apply to the same subject matter in a conflicting manner.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

Explanation: AU_ASIC_CRYPTO (ASIC's INFO 225 / financial-product classification of digital assets and AFSL licensing) and EU_MICA_RTS (EU technical standards for CASP authorisation and qualifying-holding acquisitions under MiCA). Both regulate crypto-asset service providers but in different jurisdictions with materially different mechanisms (AU financial-product status under the Corporations Act vs EU CASP authorisation framework). Distinct perimeters; no obligation conflict.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

19. Article 62(4) of MiCA sets out that NCAs must not require an applicant CASP to provide
any information referred to in Article 62(2) of MiCA that they have already received under
the respective authorisation procedures in accordance with Directive 2009/110/EC4,
2014/65/EU5 or (EU) 2015/23666, or pursuant to national law applicable to crypto-asset
services prior to the date of entry into force of MiCA, provided that such previously
submitted information or documents are still up-to-date.

3.2 Feedback statement
Q2: Do you agree with the list of information to be provided with an application for
authorisation as a crypto-asset service provider? Please also state the reasons for your
answer.

Explanation: EU_DAC8 (EU directive on administrative cooperation for crypto-asset reporting — CASPs must report user data to tax authorities) and EU_MICA_TITLE_V_CASP (EU CASP authorisation framework). The friction is recurring: every crypto-asset transaction or relationship MiCA's CASPs handle generates DAC8 reporting obligations. The two regimes are aligned in policy direction but the combined operational cost on CASPs scales with transaction count — a built-in friction of the regulatory design.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The EU_MAR regime regulates market abuse, insider dealing, and market manipulation in financial instruments (chunk_ids 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The SG_STABLECOIN regime regulates the issuance and reserve management of Single Currency Stablecoins (SCS) issued in Singapore (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The obligations in EU_MAR relate to the conduct of trading and the prevention of market abuse, whereas the obligations in SG_STABLECOIN relate to the issuance standards and reserve requirements for specific digital assets. The two regimes regulate distinct domains of activity and do not impose conflicting obligations on the same conduct.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Binance is supportive of the redemption-related requirements. In general, five business
days should be sufficient to return the par value of the SCS to customers. However, given
that this is ultimately dependent on the availability of the relevant banking services,
Binance would propose that this is aligned to the prevailing turnaround time provided by
the financial institution that the reserve assets are held with. Question 7. MAS seeks comments on whether the prudential requirements outlined in paragraph
4.21 are risk proportionate. MAS welcomes suggestions on alternative approaches to
address the risks. Binance is supportive of the prudential requirements outlined in paragraph 4.21. 15 August 2023 | 23
Question 10. MAS seeks comments on whether the scenario outlined in paragraph 4.22 is a likely
development and whether the approaches outlined in paragraph 4.24 are feasible. MAS
welcomes suggestions on other approaches to address this issue. As per Q1, we would observe:
(a) that MAS may wish to provide recognition for foreign SCS operating in SG that meet
equivalent regulatory standards in their home jurisdiction.

Explanation: The EU MICA Title IV EMT passages regulate the content and liability of crypto-asset white papers for issuers of e-money tokens (e.g., Article 51 notification requirements and Article 52 liability for misleading information). The SG MAS Prudential Crypto passages discuss the submission of consultation papers, the submission of written comments, and the general prudential treatment of cryptoasset exposures (e.g., paragraph 4.21). There is no specific obligation in the SG MAS passages that creates a conflict with the specific obligations in the EU MICA passages regarding white paper content, notification, or liability. The SG passages focus on the regulatory process and prudential standards, whereas the EU passages focus on the specific disclosure requirements for issuers. Therefore, the regimes do not conflict.


33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

Explanation: EU_MICA_TITLE_V_CASP (EU MiCA Article 62+ — CASP authorisation framework requiring customer due diligence, AML data collection, and information accompanying crypto-asset transfers under the linked TFR) and SG_PDPA (Singapore PDPA Part 4 — consent-based collection, use, and disclosure restrictions). When EU CASPs serve SG-resident clients or transmit data to SG-licensed counterparty CASPs, the MiCA/TFR-mandated personal-data transmission engages PDPA's consent/disclosure restrictions on the SG side. Operationally resolvable via PDPA s.13(b) ('required or authorised under any other written law') carve-out plus the SG MAS AML/CFT framework as the SG-side legal authorisation. Same shape as the labelled EU TFR ↔ EU GDPR conflict in the careful cohort, scaled to the EU↔SG cross-jurisdictional framing.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The AU_TTR_THRESHOLD regime regulates the reporting of physical cash transfers exceeding A$10,000 to AUSTRAC under the AML/CTF Act. The SG_FSMA_DTSP regime regulates the licensing and conduct of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022. The evidence shows that the SG regime applies to individuals, partnerships, or corporations conducting digital token services (chunk_id cc1be49e9cf8c821::2f4::ea8f), whereas the AU regime applies to reporting entities providing designated services involving physical currency transfers (chunk_id 6dfe4e63b9fb3c74::3bc::1a3f). The obligations are distinct: one concerns the reporting of physical cash thresholds, and the other concerns the licensing of digital token service providers. There is no specific obligation in the SG regime that conflicts with the AU reporting obligation, nor do the regimes regulate the same subject matter. Therefore, the regimes are in non_conflict.


Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 230 operational-risk management standard and AUSTRAC IFTI / EFTI travel-rule reporting operate in disjoint regulatory domains at the obligation level. Operational risk vs AML wire-transfer information rules — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The Basel III framework (Regime A) regulates banking capital adequacy, leverage ratios, and risk-weighted assets (RWA) for banks, including the treatment of fiduciary assets and general provisions (chunk_ids 32afd37cade34f84::34b::8d30, 32afd37cade34f84::25d::6825). In contrast, the Singapore foundational legislation (Regime B) focuses on the regulation of digital tokens, securities token offerings, and the Payment Services Act (chunk_ids b49627bb889ef1d9::3ef::7168, d6f4be6b9d136778::467::12af). The obligations in Regime A relate to financial accounting and capital management for banks, while Regime B addresses consumer protection and AML/CFT compliance for digital asset service providers. There is no specific obligation in the Basel framework that conflicts with the obligations in the Singapore foundational legislation regarding digital tokens or payment services. Therefore, the regimes regulate different domains.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The regimes regulate distinct aspects of the digital asset ecosystem. Regime A (AU_TREASURY_DAP) focuses on the 'token mapping' exercise and the development of a licensing and custody framework for crypto asset service providers to fit assets within the financial services framework. Regime B (SG_IRAS_TAX) focuses on the Goods and Services Tax (GST) treatment of digital payment tokens, specifically that their supply is exempt from GST and that businesses trading in them are no longer liable for GST registration. The obligations in Regime A regarding licensing and perimeter demarcation do not conflict with the GST treatment obligations in Regime B; they address different regulatory domains (financial services regulation vs. tax treatment).


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

(69)
The crypto-asset white paper drawn up by an issuer of e-money tokens should contain all information concerning
that issuer and the offer of e-money tokens or their admission to trading that is necessary to enable prospective
buyers to make an informed purchase decision and understand the risks relating to the offer of e-money tokens.
The crypto-asset white paper should also expressly refer to the right of holders of e-money tokens to redeem their
e-money tokens for funds denominated in the official currency that the e-money tokens reference at par value
and at any time.

(70)
Where an issuer of e-money tokens invests the funds received in exchange for e-money tokens, such funds should
be invested in assets denominated in the same official currency as the one that the e-money token is referencing
in order to avoid cross-currency risks.

Explanation: The evidence for APRA CPS234 (chunk 4b6fab404e7acfca::3c4::1564) establishes that the guide is a non-binding 'Prudential Practice Guide' offering guidance on Operational Risk Management for APRA-regulated entities. The evidence for EU MICA Title IV EMT (chunk 491a2f0014d56ffb::353::debc) outlines the content requirements for a 'crypto-asset white paper' for issuers of e-money tokens. The obligations in the EU regime relate to the disclosure of information in a white paper to prospective buyers, whereas the APRA regime addresses operational risk management frameworks. These are distinct regulatory domains; the EU obligations do not impose a specific operational risk management framework on the issuer that conflicts with the APRA guidance.