Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

Explanation: The EU MICA Title IV EMT passages regulate the disclosure obligations of issuers of e-money tokens, specifically regarding the content and notification of crypto-asset white papers and liability for misleading information (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The INT Basel General passages regulate the accounting treatment of fiduciary assets and the calculation of regulatory capital, including leverage ratio exposure measures and expected losses (chunk_id 32afd37cade34f84::34b::8d30). The obligations in the EU regime relate to consumer disclosure and issuer liability, while the obligations in the Basel regime relate to banking supervision and capital adequacy. These are distinct regulatory domains with no apparent overlap of obligations.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

Explanation: The EU AMLD6 passage (chunk 85307f9e2a040982::14a::134d) discusses the scope of Directive (EU) 2022/2556 regarding digital operational resilience for the financial sector. The MAS TRM passage (chunk 20d526d712753652::403::be97) discusses internal processes for inaccurate representations and the application of guidelines (including TRM Guidelines) to licensees. The obligations in the EU passage relate to sector-wide digital operational resilience, while the MAS passage relates to customer communication regarding inaccuracies and the application of principles-based guidelines. These are distinct regulatory domains with no apparent overlap of obligations.


Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): AUSTRAC IFTI / EFTI travel-rule reporting and AUSTRAC TTR $10k cash threshold reporting are designed to coexist — obligations apply cumulatively without collision. Both reporting components of the AUSTRAC AML/CTF regime — different obligations but same statutory parent. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

Explanation: AU_FEDREG_AML (Australian AML/CTF statutory regime — reporting entity obligations including KYC information collection and cross-border movement reporting) and EU_GDPR (GDPR cross-border data transfer principles, processing of personal data in compliance with Directive 95/46/EC successor framework). When AU reporting entities have EU-resident customers, the data collection and transmission required by AML/CTF engages GDPR's cross-border transfer restrictions. Operationally resolvable via GDPR Art. 6(1)(c) plus Chapter V instruments. Same conflict shape as the labelled cross-jurisdictional AML ↔ GDPR pattern.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: The evidence for AU_ATO_CRYPTO focuses on token mapping, tax compliance, and the crypto ecosystem in Australia (chunk e6bb47e92e88e16c::567::36c4). The evidence for EU_AMLD6 references Directive (EU) 2022/2556 regarding digital operational resilience for the financial sector (chunk 85307f9e2a040982::14a::134d). The two regimes regulate distinct domains: Australian tax and crypto regulation versus EU financial sector operational resilience. There is no evidence of a specific obligation in one regime conflicting with a specific obligation in the other.


2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: The EU_EMD2 passages describe the regulatory framework for digital operational resilience in the financial sector (Directive 2022/2556 and Regulation 2022/2554). The INT_FATF_GENERAL passages describe the general principles and standards for Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT), including risk assessment methodologies and specific reporting requirements like CTRs and STRs. The obligations in the EU_EMD2 regime (operational resilience, recovery plans) are distinct from the obligations in the INT_FATF regime (AML/CFT risk assessment, reporting). There is no specific obligation in the EU_EMD2 text that conflicts with a specific obligation in the INT_FATF text; rather, they regulate different domains of financial stability and compliance.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU DORA ICT operational-resilience regulation operate in disjoint regulatory domains at the obligation level. AML supervision vs ICT operational resilience — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: The EU_EMD2 passage discusses the Digital Operational Resilience Act (DORA) and financial rules for the European Authority (chunk 85307f9e2a040982::14a::134d). The SG_MAS_PRUDENTIAL_CRYPTO passage discusses the 'Prudential Treatment & Disclosures of Cryptoasset Exposures' and the 'same activities, same risk, same regulation' principle for Stablecoin Issuers (chunk 7c04f2a0bd85290a::449::02f2). The obligations regarding operational resilience and financial rules in the EU regime do not directly oppose the prudential capital requirements for cryptoasset exposures in the Singapore regime. The regimes regulate different aspects of financial stability (operational resilience vs. prudential capital treatment) and reinforce the need for a robust framework rather than conflicting with one another.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

(6) Member States have put in place rules and guidance, which differ from Member State to Member State, to tax income
derived from crypto-asset transactions. However, the decentralised nature of crypto-assets makes it difficult for
Member States' tax administrations to ensure tax compliance.

(1) Opinion of 13 September 2023 (not yet published in the Official Journal).

(2) Opinion of 23 March 2023 (OJ C 184, 25.5.2023, p. 55).

(3) Council Directive 2011/16/EU of 15 February 2011 on administrative cooperation in the field of taxation and repealing
Directive 77/799/EEC (OJ L 64, 11.3.2011, p. 1).
ELI: http://data.europa.eu/eli/dir/2023/2226/oj 1/38

EN

Explanation: The AU_TREASURY_DAP passages discuss the Australian government's 'token mapping' exercise to identify how crypto assets fit within the financial services framework and the subsequent development of licensing and custody reforms (chunk_ids: d75262e404517e0c::47b::7c9f, e6bb47e92e88e16c::37a::29f6). In contrast, the EU_DAC8 passages focus on the reporting and exchange of information obligations for crypto-asset service providers to tax administrations to combat tax evasion (chunk_ids: c0300673081f7232::294::7f91, c0300673081f7232::3d8::ddf3). The obligations in the EU regime relate to tax reporting and administrative cooperation, whereas the Australian regime addresses the classification and licensing of crypto assets and service providers. These are distinct regulatory domains with no apparent specific obligation in one regime pushing against a specific obligation in the other.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

Explanation: The AU_TRAVEL_RULE passages discuss the Australian regulatory framework for remittance networks and virtual asset service providers, including the status of the FATF 'Travel Rule' for digital currency exchanges (c4a92930a8caf822::380::0a18, 30a32a386d15ba2b::4f3::edc3). The EU_MICA passages describe the European legal framework for crypto-asset service providers, including the provision of advice on crypto-assets and the requirements for authorisation (f9082873c5d9ba9d::302::bbe0, c51ad46265cea4e5::462::80d8). The obligations and regulatory scopes are distinct: one focuses on Australian remittance and virtual asset registration, while the other outlines European MiCA requirements for crypto-asset service provision. There is no specific obligation in one regime that pushes against a specific obligation in the other.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

1.2 These Guidelines1 on Outsourcing ("Guidelines") set out the Monetary Authority of
Singapore's ("MAS") expectations of an institution that has entered into any outsourcing
arrangement or is planning to outsource its business activities2 to a service provider. An
institution should conduct a self-assessment of all existing outsourcing arrangements against
these Guidelines3.

Explanation: AU_APRA_CPS234 (APRA's Information Security prudential standard — CPS 234 / CPG 230 operational risk context) and SG_MAS_OUTSOURCING (MAS Outsourcing Guidelines for material outsourcing arrangements). Both touch on operational-risk / third-party concerns but address different specific obligations — CPS 234 is information-security; MAS Outsourcing is supervision of outsourced business activities. Distinct mechanisms.


The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: INT_FATF_GENERAL (FATF general AML/CFT standards — risk-based approach) and SG_AML (MAS Notice 314 AML/CFT framework for life insurers + DPT-specific AML controls). Singapore's AML framework implements FATF standards through MAS notices. Reinforcing relationship.


(a) a digital payment token service;
(b) a digital payment token transfer service;
(c) a custodian wallet service;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
"TSOFA" means the Terrorism (Suppression of Financing) Act 2002;
"value transfer" refers to any transaction carried out on behalf of a value transfer originator
through a financial institution with a view to making one or more digital tokens available
to a beneficiary person at a beneficiary institution, irrespective of whether the originator
and the beneficiary are the same person; and
"wire transfer" refers to any transaction carried out on behalf of a wire transfer originator
through a financial institution by electronic means with a view to making an amount of
funds available to a beneficiary person at a beneficiary institution, irrespective of whether
the originator and the beneficiary are the same person.

15 August 2023 | 46
We believe that the proposed changes are sufficient. Under the current Payment Services
Act 2019 ("PS Act") framework, stablecoins are treated as DPTs. In accordance with the
current scope of the PS Act, entities that deal in and/or facilitate the exchange of
stablecoins therefore fall within the scope of regulated DPT services. However, stablecoin issuers are presently not regulated in terms of ensuring the value
stability of stablecoins. Accordingly, the "Stablecoin Issuance Service" will regulate entities
based in Singapore that perform the function of controlling the total supply, minting and
burning of a SCS. Such an SCS will be labelled using a specific term, such as "regulated
stablecoin", "qualifying stablecoin" or "securely-backed stablecoin". This is well balanced
with the PS Act as activities relating to other types of stablecoins, including algorithmic,
commodity-backed, multi-currency and other types of stablecoins, will continue to be
subject to the existing DPT regime under the PS Act.

The Stable coins (SCS) targeted/offered/sold/ exchange to Singapore residents and
businesses in
2. Any settlement /obligation/contracts for such entities or related group either have SG
as arbitration or under courts of Singapore
3. When such overseas issued Stablecoins in circulation with Singapore residents exceed a
risk threshold of say, S$3M or equivalent / month and particularly those which are
considered as designated payment system overseas. Question 2. MAS seeks comments on whether it is sufficient to introduce an additional regulated
payment service of stablecoin issuance, and whether there is a need to introduce any
other regulated services specific to stablecoins. ANZ suggests the additional regulation in PS to cover all aspects of Issuance, distribution,
circulation, and accessibility, including provision of custodial services for SCS with suitable
amount caps and withdrawal /exchange into pegged currency locally. Question 3. MAS seeks comments on whether the regulatory approach for bank and non-bank SCS
issuers is appropriate and achieves an equivalent regulatory outcome for SCS issued in
Singapore to be able to maintain a high degree of value stability of SCS.

23 November 2023 | 7
risk of DPTSPs setting up in Singapore with the intent to primarily serve foreign retail customers who
are not subject to MAS' consumer access measures. DPTSPs regulated in Singapore should therefore
apply the consumer access measures to all retail customers when offering DPT services.
Treatment of DPT Holdings for Determining AI Eligibility

Explanation: MAS's stablecoin framework (2022 CP; 2023 Response) explicitly states that, under the current Payment Services Act 2019 framework, stablecoins are treated as DPTs and entities dealing in or facilitating exchange of stablecoins fall within the PS Act DPT service regime (Annex Submissions §4.23). Whether a particular foreign stablecoin offering triggers MAS DPT obligations turns on fact-sensitive questions: does the issuer actively offer to Singapore residents? Does any SG arbitration or governing-law clause attach? Are settlement obligations directed into Singapore? (See industry submission 2023 Annex raising precisely these questions.) Two issuers with identical legal entities can reach opposite conclusions on PS Act scope depending on jurisdictional touchpoint facts.

Document marketing geography and customer-acquisition channels; restrict explicit Singapore-resident onboarding if seeking to remain outside the PS Act DPT regime.

Issuer is non-MAS-regulated and operating from offshore.


Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: The EU_MAR passages regulate market abuse, insider dealing, and market manipulation within financial markets (chunk_ids 5cc4a27bc578287a::165::3333, 5cc4a27bc578287a::4ee::5950). The INT_FATF_VASP passages regulate Anti-Money Laundering/CFT obligations for Virtual Asset Service Providers (VASPs) and Virtual Assets (chunk_ids 85240528438654b9::1cd::07d7, ba862e1f095bceac::1a6::1f0e). While a VASP may be subject to both regimes, the obligations are distinct: MAR focuses on market integrity and preventing manipulation, whereas FATF focuses on AML/CFT compliance. The passages do not describe a specific obligation in one regime that directly contradicts or invalidates an obligation in the other. Therefore, the regimes are in different domains.


'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

Explanation: AU_TTR_THRESHOLD (AUSTRAC threshold-transaction reports of AUD 10,000+ — AML data disclosure obligation) and EU_GDPR (Article 44+ restricting transfer of personal data to third countries). When an AU reporting entity has EU-resident customers and must report their transaction details to AUSTRAC, this constitutes a cross-border data transfer from the EU; GDPR Chapter V conditions apply. The tension is real but operationally resolvable via GDPR Article 6(1)(c) ('legal obligation' lawful basis) plus an appropriate Chapter V transfer mechanism (e.g. SCCs or derogation under Art. 49(1)(d) for important reasons of public interest). Severity low because the EU-data overlap is narrow (most TTRs concern AU-resident transactions) and the resolution path is well-established. Same shape as the labelled EU TFR ↔ GDPR conflict in the careful cohort, scaled down to the threshold-reporting subset.


As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

178. As set out in INR. 15, countries should apply Recommendation 16 to VA transfers
and VASPs. Countries should apply Recommendation 16 regardless of whether the
value of the traditional wire transfer or the VA transfer is denominated in fiat
currency or a VA. However, recognising the unique technological properties of VAs,
Recommendation 16 applies in an amended way to VAs as set out in paragraph 7(b)
of INR.15. The application of the FATF's wire transfer requirements in the VA
context is called the travel rule.

201. Given the 'sunrise issue' in relation to the travel rule, countries should adopt a RBA
in the assessment of the business models presented by VASPs. Countries should
consider the full context of travel rule compliance, including whether there are
sufficient risk mitigation measures taken by the VASP to adequately manage the
attendant ML/TF risks. Regardless of the regulation in a certain country, a VASP
may implement robust control measures to comply with the travel rule
requirements. Examples include VASPs restricting VA transfers to within their
customer base (i.e., internal transfers of VAs within the same VASP), only allowing
confirmed first-party transfers outside of their customer base (i.e., the originator
and the beneficiary are confirmed to be the same person) and enhanced monitoring
of transactions. See Section IV "Counterparty VASP Identification and Due
Diligence" for more risk remediation examples. While the introduction and
implementation of relevant regulations by countries is important in itself, the
absence of relevant regulations in one country does not necessarily preclude the
effectiveness of measures introduced by a VASP on its own.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  65
VA transfers to/from 'intermediary VASPs'

Explanation: AUSTRAC's AML/CTF regime broadly aligns with FATF standards (Australia is a FATF member and AUSTRAC's customer-identification, record-keeping and reporting obligations implement R.10–R.21 in substance). On Recommendation 16 specifically the alignment is currently partial: the AUSTRAC NRA explicitly notes that Australia's DCE regime applies only to digital-currency↔fiat exchanges and that the FATF Travel Rule has not yet been implemented for digital-currency exchanges. This is an implementation gap rather than a legal conflict — FATF Recommendation 16 is non-binding and FATF itself anticipates a 'sunrise' transition period (FATF VA/VASP guidance ¶201). The rubric resolves to No (no specific binding AU obligation pushes against any specific FATF expectation; the FATF expectation is that AU will close the gap). It is flagged borderline.

FATF rated Australia non-compliant on R.16 and AUSTRAC's primary law explicitly carved out crypto-to-crypto VASPs in a way that could not be remedied by rule-making.

The pair were narrowed to 'AUSTRAC current binding rules' vs 'FATF immediate-effect expectation' — there the friction is real but still not a structural conflict.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

Explanation: AU_AML_CTF (Australian AML/CTF Act — AUSTRAC reporting framework) and FATF_R16 (FATF Recommendation 16 — travel rule for VAs). Australia is moving toward implementing FATF R16 for digital-currency exchanges; the AU framework already incorporates FATF-aligned customer-identification and reporting obligations more broadly. Aligned direction (implementation of FATF standards in Australia).


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU MiCA Title V crypto-asset service provider regime are designed to coexist — obligations apply cumulatively without collision. CASPs under MiCA Title V are AMLR/AMLD6 obliged entities — aligned by design. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: AU_ATO_CRYPTO (regime A) and SG_IRAS_TAX (regime B) both relate to crypto taxation, but on close reading of the cited passages they address different specific actions. A's passage is the general Token Mapping consultation framing — broad regulatory mapping, not a tax obligation. B's passage is IRAS's GST treatment of digital payment tokens (exempting their supply from GST effective 2020). One is income-tax-regime framing, the other is consumption-tax treatment of the instrument — no obligation in A pushes against an obligation in B.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

Explanation: The AU_FEDREG_AML regime focuses on Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations for reporting entities, including customer identification, transaction monitoring, and suspicious activity reporting (chunk cf7cefacba3f94bc::49a::f39e). The EU_DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (chunk c0300673081f7232::320::7b46). While both regimes involve reporting obligations, they regulate distinct domains: one is a financial crime prevention regime, and the other is a tax information exchange regime. The obligations do not push against one another; rather, they operate in parallel to address different regulatory objectives.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

2 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational
resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU)
No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1).

3. Guidelines

EBA/GL/2024/07
13June 2024
Guidelines
on recovery plans under Articles 46 and 55 of the Regulation (EU)

1. Compliance and reporting
obligations
Status of these guidelines

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

Explanation: The EU_EMD2 passages discuss digital operational resilience and financial rules for the European Parliament and Council (Directive 2022/2556 and Regulation 2022/2554). The INT_BASEL_CRYPTO passages discuss Basel III capital requirements, risk-weighting exposures, and liquidity standards. The obligations in Regime A (operational resilience and financial administration) do not overlap with the obligations in Regime B (capital adequacy and risk management). Therefore, the regimes regulate different domains and do not conflict.


Explanation: The EU_EMD2 passages discuss digital operational resilience and financial rules for the European Parliament and Council (Directive 2022/2556 and Regulation 2022/2554). The INT_BASEL_CRYPTO passages discuss capital requirements, risk-weighting exposures, and prudential standards for banks. The obligations in Regime A (operational resilience) do not conflict with the obligations in Regime B (capital adequacy); rather, they regulate distinct aspects of financial institution management. The cited passages confirm no specific obligation in Regime A pushes against a specific obligation in Regime B.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards for access controls and cryptography under Directive (EU) 2022/2555 (NIS2) and Directive (EU) 2022/2557 (Critical Entities Regulation) (chunk_id 3c9eb3a25c93f394::474::4786). The INT_BASEL_CRYPTO passage defines 'bank exposure' for capital requirements and notes that internationally active banks must adhere to Basel framework standards (chunk_id 32afd37cade34f84::3a4::1a5b). The obligations in NIS2 relate to ICT security measures (access controls, cryptography), while the obligations in Basel relate to capital adequacy and prudential supervision. These are distinct regulatory domains with no apparent overlap of obligations or conflicting requirements.


Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: The Australian regime passage (e6bb47e92e88e16c::567::36c4) discusses the token mapping and tax compliance of crypto assets in Australia. The Singaporean regime passage (018117ef1e757630::428::d321) focuses on strengthening AML/CFT controls for Digital Payment Token (DPT) service providers. While both regimes address crypto assets, the obligations described are distinct: the Australian passage outlines a tax compliance and regulatory reform agenda, whereas the Singaporean passage outlines supervisory expectations and AML/CFT controls for DPT service providers. There is no specific obligation in one regime that directly conflicts with a specific obligation in the other; rather, they regulate different aspects of the crypto ecosystem (tax vs. AML/CFT controls). Therefore, the regimes are in non_conflict.


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: EU_MICA_RTS (EU MiCA regulatory technical standards — detailed CASP authorisation and qualifying-holding-acquisition information requirements, including personal data of directors, qualifying holders, and beneficial owners) and SG_PDPA (Singapore PDPA — consent and disclosure restrictions for personal data). When EU CASP authorisation applications involve persons resident in SG (e.g. SG-based qualifying holders), the RTS-mandated personal-data submission engages PDPA on the SG side. Operationally resolvable via PDPA s.13(b) carve-out + competent-authority cooperation arrangements.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

Explanation: The EU_EMD2 passages discuss the Digital Operational Resilience Act (DORA) and financial rules for the European Banking Authority, focusing on operational resilience and administrative compliance. In contrast, the INT_BASEL_GENERAL passages address banking capital adequacy, specifically the leverage ratio, expected losses, and provisions. The obligations in Regime A (operational resilience) do not impose requirements that conflict with the capital treatment rules in Regime B (Basel III leverage ratio and provisions). The regimes regulate distinct aspects of banking supervision—operational resilience versus capital adequacy—resulting in no friction between the specific obligations cited.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

mentioned in item 2 (ii) tracing information
do not apply
4 the transfer of value is a merchant payment card number of the card the payer used in
relation to the merchant payment
5 the transfer of value is a refund of a card number of the card the payer used in
merchant payment relation to the merchant payment that is
refunded
6 the instruction for the transfer of value is card number of the card the payer used in
given by the use of an ATM relation to the withdrawal
7 (a) the value being transferred is money; and tracing information
(b) the money is in a foreign country and, as
a result of the provision of an
international value transfer service, the
money will be in Australia; and
(c) the beneficiary institution receives the
transfer message for the transfer of value
through BECS
8 the value is transferred from a self-hosted (a) payer information; and
virtual asset wallet (b) the

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Specific disclosure requirements should be augmented by a general disclosure
requirement.
111 See Principles for Periodic Disclosure by Listed Entities, Final Report, Report of the Technical Committee
of IOSCO, February 2010, pp. 16-17, available at
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD317.pdf; see also Protection of Minority
Shareholders in Listed Issuers, Final Report, Report of the Technical Committee of IOSCO in consultation
with the OECD, June 2009, pp.10-14, available at
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD295.pdf; see also International Disclosure Standards
for Cross-Border Offerings and Initial Listings by Foreign Issuers, supra, Item VII at pp. 18-19;
Disclosure Principles for Public Offerings and Listings of Asset-backed Securities, supra, Principle III at
pp. 10-12; and International Disclosure Principles for Cross-Border Offerings and Listing of Debt
Securities by Foreign Issuers, Final Report, Report of the Technical Committee of IOSCO, March 2007,
Item XI at pp. 23-24, available at https://www.iosco.org/library/pubdocs/pdf/IOSCOPD242.pdf.
112 If there are classes of shares or other structural features that would affect share price, these should be
disclosed.

https://www.iosco.org/library/pubdocs/pdf/IOSCOPD120.pdf
19 Adapting IOSCO International Disclosure Standards for 16
Shelf Registration Systems, Report of the Technical
Committee of IOSCO, March 2001,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD118.pdf
20 Resolution on IASC Standards, Resolution of the Presidents' 16
Committee of IOSCO, May 2000, http://www.iosco.org/library/resolutions/pdf/IOSCORES19.pdf
21 Resolution on IOSCO Endorsement of Disclosure Standards 16
to Facilitate Cross-Border Offerings and Listings by
Multinational Issuers, Resolution of the Presidents'
Committee of IOSCO, September 1998,
https://www.iosco.org/library/resolutions/pdf/IOSCORES17.pdf
22 Securities Activity on the Internet, Report of the Technical 16 11
Committee of IOSCO, September 1998,

https://www.iosco.org/library/pubdocs/pdf/IOSCOPD184.pdf
13 Final Report on Elements of International Regulatory 29 24
Standards on Fees and Expenses of Investment Funds, Report of the Technical Committee of IOSCO, November 2004,
http://www.iosco.org/library/pubdocs/pdf/IOSCOPD178.pdf
14 Principles on Client Identification and Beneficial Ownership for 31 10
the Securities Industry, Report of IOSCO, May 2004,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD167.pdf
15 Report on Securities Activity on the Internet III, Report of the 31 11
Technical Committee of IOSCO, October 2003, https://www.iosco.org/library/pubdocs/pdf/IOSCOPD159.pdf 16 IOSCO Statement of Principles for Addressing Sell-Side Analyst 31 23
Conflicts of Interest, Report of the Technical Committee of
IOSCO, September 2003, available at
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD150.pdf

https://www.iosco.org/library/pubdocs/pdf/IOSCOPD83.pdf 23 International Disclosure Standards for Cross-Border 16
Offerings and Initial Listings by Foreign Issuer, Report of IOSCO, September 1998,
http://www.iosco.org/library/pubdocs/pdf/IOSCOPD81.pdf PRINCIPLES RELATING TO ISSUERS
Document Principles Other
Principles
24 International Equity Offers - Changes in Regulation Since 16
April 1996, Report of the Technical Committee of IOSCO,
September 1997,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD71.pdf
25 Reporting of Material Events in Emerging Markets, Report of 16
the Emerging Markets Committee of IOSCO, September
1996,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD62.pdf
26 International Equity Offers - Changes in Regulation Since 16
April 1994, Report of IOSCO, September 1996,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD61.pdf
27 Report on Disclosure and Accounting, Report of the 16
Technical Committee of IOSCO, October 1994,

Explanation: The AU_TRAVEL_RULE passages discuss Australia's regulatory framework for remittance networks, virtual asset service providers, and the specific implementation of FATF's 'Travel Rule' for digital currency exchanges (cf7cefacba3f94bc::383::7d9d; 30a32a386d15ba2b::4f3::edc3). In contrast, the INT_IOSCO_GENERAL passages focus on general securities regulation principles, disclosure standards, and cross-border offerings (f173909614befd49::455::1a1a; f173909614befd49::4bf::1d9e). The two regimes regulate distinct domains—financial services compliance and securities market regulation—and there is no evidence of a specific obligation in one regime conflicting with a specific obligation in the other. Therefore, the relationship is non-conflict.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: AU_ASIC_AFSL (Australian Financial Services Licence — entity-licensing framework for providing financial services in Australia, extended to crypto-as-financial-product per ASIC INFO 225) and SG_PSA_DPT (Singapore PSA DPT-service licence — MAS PSN02 framework). An entity providing crypto-asset services to clients in both AU and SG faces parallel licensing requirements — AU AFSL on the AU side and SG PSA DPT licence on the SG side. Operationally resolvable through dual authorisation; both regimes apply but neither prohibits compliance with the other. Severity medium because the licensing cost is real and recurring.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

Explanation: INT_BASEL_CRYPTO (Basel d424 — prudential treatment of crypto-asset exposures by banks) and INT_FATF_VASP (FATF VASP guidance — AML/CFT for VAs and VASPs). Both are international standards-setters addressing crypto regulation from different angles (prudential vs AML); they coordinate to provide complementary global frameworks. Aligned by design.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: The EU MICA Title IV EMT passages regulate the disclosure and liability obligations of issuers of e-money tokens, specifically regarding the content of crypto-asset white papers and notification to competent authorities (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). In contrast, the INT Basel Crypto passages define capital requirements, risk-weighting methodologies, and supervisory standards for banks' exposures to financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The obligations in MICA relate to consumer protection and market transparency for token issuers, while the obligations in Basel relate to prudential capital adequacy for banks. These are distinct regulatory domains with no apparent overlap of obligations.