33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

1.4 Please submit written comments through the link below by 21 December 2022:
https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your
enquiry to capital_markets@mas.gov.sg.

1 These include persons who are currently operating under the transitional exemption as they have been
providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment
Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but
are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.
Monetary Authority of Singapore 3

2 Introduction
Digital Asset Ecosystem and Cryptocurrencies

Explanation: EU_MICA_TITLE_V_CASP (EU CASP authorisation requirements under MiCA Article 62) and SG_PSA_GENERAL (Singapore Payment Services Act regulations and amendments). Both regulate crypto/payment service providers but in different jurisdictions; the cited passages address different specific obligations (EU CASP authorisation and ESMA register vs SG PS Regulation amendments on safeguarding). An entity operating across both jurisdictions must comply with each separately.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The EU_MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1 and Article 25). The SG_MAS_AML_GENERAL passages regulate Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) compliance, including targeted financial sanctions and the supervision of Digital Payment Token (DPT) providers. The obligations in MIFID2 relate to the suitability of financial instruments for clients, whereas the obligations in the MAS passages relate to the prevention of money laundering and terrorism financing. These are distinct regulatory domains; there is no specific obligation in MIFID2 that pushes against a specific obligation in the MAS AML/CFT regime. Therefore, the regimes are non-conflicting.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

Explanation: The evidence for the Australian regime (Regime A) focuses on token mapping, tax compliance, and general crypto ecosystem regulation (chunk_id e6bb47e92e88e16c::567::36c4). The evidence for the Singaporean regime (Regime B) focuses on the licensing requirements and operational definitions for Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022 (chunk_id 20d526d712753652::404::80be). The passages describe distinct regulatory frameworks and compliance approaches for the crypto sector in their respective jurisdictions. There is no evidence of a specific obligation in one regime that directly conflicts with a specific obligation in the other; rather, they regulate different domains (tax vs. financial services licensing).


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 234 information security standard and Australian AML/CTF Act + Rules (binding instruments) operate in disjoint regulatory domains at the obligation level. Info-sec capability vs AML obligations — disjoint, both apply to overlapping regulated population cumulatively. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: The obligations in Regime A (AU_TTR_THRESHOLD) relate to the reporting of physical cash transactions exceeding A$10,000 to AUSTRAC. The obligations in Regime B (EU_MICA_TITLE_IV_EMT) relate to the liability of issuers of e-money tokens for information provided in crypto-asset white papers and the notification of these white papers to competent authorities. The two regimes regulate distinct transaction types (physical cash vs. e-money tokens) and distinct reporting obligations (AUSTRAC TTRs vs. white paper notifications), with no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The AU_AML_CTF regime focuses on reporting obligations for suspicious matters and threshold transactions (chunk 254ca2d92d196180::2ac::a5fe). The SG_STABLECOIN regime outlines a regulatory perimeter for Single-Currency Stablecoins (SCS) issued in Singapore, distinguishing them from other digital payment tokens (chunk 58f45cd2ef3de201::36c::e2f6). The obligations in the AU regime relate to financial crime reporting, while the SG regime addresses the scope and classification of stablecoin products. There is no specific obligation in the AU regime that conflicts with the specific obligations in the SG regime regarding stablecoin issuance or classification.


Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

(18) Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and
amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349).

27.12.2022 EN Official Journal of the European Union L 333/11
changes following post ICT-related incident reviews; to monitor on a continuous basis relevant technological
developments, to establish a comprehensive digital operational resilience testing programme as an integral part of
the ICT risk management framework provided for in this Regulation, or to adopt and regularly review a strategy on
ICT third-party risk. In addition, microenterprises should only be required to assess the need to maintain such
redundant ICT capacities based on their risk profile. Microenterprises should benefit from a more flexible regime as
regards digital operational resilience testing programmes. When considering the type and frequency of testing to be
performed, they should properly balance the objective of maintaining a high digital operational resilience, the
available resources and their overall risk profile. Microenterprises and financial entities subject to the simplified ICT
risk management framework under this Regulation should be exempted from the requirement to perform advanced
testing of ICT tools, systems and processes based on threat-led penetration testing (TLPT), as only financial entities
meeting the criteria set out in this Regulation should be required to carry out such testing. In light of their limited
capabilities, microenterprises should be able to agree with the ICT third-party service provider to delegate the
financial entity's rights of access, inspection and audit to an independent third-party, to be appointed by the ICT
third-party service provider, provided that the financial entity is able to request, at any time, all relevant information
and assurance on the ICT third-party service provider's performance from the respective independent third-party.

(24) Where provisions of a sector-specific Union legal act require essential or important entities to comply with reporting
obligations that are at least equivalent in effect to the reporting obligations laid down in this Directive, the
consistency and effectiveness of the handling of incident notifications should be ensured. To that end, the
provisions relating to incident notifications of the sector-specific Union legal act should provide the CSIRTs, the
competent authorities or the single points of contact on cybersecurity (single points of contact) under this Directive
with an immediate access to the incident notifications submitted in accordance with the sector-specific Union legal
act. In particular, such immediate access can be ensured if incident notifications are being forwarded without undue
delay to the CSIRT, the competent authority or the single point of contact under this Directive. Where appropriate,
Member States should put in place an automatic and direct reporting mechanism that ensures systematic and
immediate sharing of information with the CSIRTs, the competent authorities or the single points of contact
concerning the handling of such incident notifications. For the purpose of simplifying reporting and of
implementing the automatic and direct reporting mechanism, Member States could, in accordance with the sector-
specific Union legal act, use a single entry point.

(15) Entities falling within the scope of this Directive for the purpose of compliance with cybersecurity risk-management
measures and reporting obligations should be classified into two categories, essential entities and important entities,
reflecting the extent to which they are critical as regards their sector or the type of service they provide, as well as
their size. In that regard, due account should be taken of any relevant sectoral risk assessments or guidance by the
competent authorities, where applicable. The supervisory and enforcement regimes for those two categories of
entities should be differentiated to ensure a fair balance between risk-based requirements and obligations on the one
hand, and the administrative burden stemming from the supervision of compliance on the other.

Explanation: NIS 2 Recital 24 contains an explicit lex specialis clause: 'Where provisions of a sector-specific Union legal act require essential or important entities to comply with reporting obligations that are at least equivalent in effect to the reporting obligations laid down in this Directive, the consistency and effectiveness of the handling [should be preserved]'. DORA is precisely such a sector-specific Union legal act for EU financial entities, with ICT incident reporting obligations under Articles 17–18. The result is alignment by design: financial entities comply with DORA's regime for ICT-related incidents, NIS 2 applies to non-financial essential / important entities, and the two are coordinated rather than colliding. A labeller might initially see overlap; on close reading, the regulations explicitly carve out their respective scopes.

Implementing acts under one regime created a stricter or earlier reporting timer that the other prohibited — Recital 24 is designed to forestall this.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: The AU_TRAVEL_RULE passages discuss the Australian regulatory framework for digital currency exchanges (DCEs), specifically noting that Australia has not yet implemented the FATF 'Travel Rule' for digital currency exchanges and is currently consulting on extending these requirements. In contrast, the SG_PSA_GENERAL passage discusses the definition of 'safeguarding institution' and the licensing of Digital Payment Token Service Providers (DPTSPs) under the Payment Services Act. The two regimes regulate distinct aspects of the digital asset ecosystem—Australia's pending implementation of the Travel Rule versus Singapore's licensing and asset safeguarding framework for DPTSPs. Therefore, the obligations do not conflict.


Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): APRA CPS 234 information security standard and AUSTRAC TTR $10k cash threshold reporting operate in disjoint regulatory domains at the obligation level. Info-sec vs AML threshold reporting — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: EU_AMLA (EU's new Anti-Money Laundering Authority under Directive 2024/1640 — Article 62-63 cooperation with FIU/supervisory authorities) and FATF_R16 (FATF travel-rule standard). The EU AMLA framework is the EU's institutional implementation arm for AML/CFT, including R16-aligned obligations on CASPs via the TFR. AMLA explicitly cooperates with international AML frameworks. Reinforcing relationship.


6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

8.7 Annex VII: Draft RTS pursuant to Article 68(10)(b) of MiCA
COMMISSION DELEGATED REGULATION (EU) 2024/...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying records to be kept of
all crypto-asset services, activities, orders and transactions undertaken
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193774, and in particular
Article 68(10), first subparagraph, point (b) thereof,
Whereas:
(1) The records a crypto-asset service provider is required to keep should be adapted to the
type of business and the range of crypto-asset services, activities, orders, and
transactions undertaken by them, provided that the record-keeping obligations set out in
Regulation (EU) 2023/1114, Regulation (EU) [Delegated Regulation xx/xxx on RTS on
complaints handling], Regulation (EU) [Delegated Regulation xx/xxx RTS on conflicts of
interest], Regulation (EU) 2023/1113 and this Regulation are fulfilled and that competent
authorities are able to fulfil their supervisory tasks and take enforcement measures in
view of ensuring both investor protection and market integrity. (2) Crypto-asset service providers should be free to determine the manner in which they
keep records of relevant data relating to all orders and transactions in crypto-assets.

Note 1: Failure to comply with this subsection is an offence (see
subsection 1311(1)). Note 2: Failure to comply with this subsection may also lead to civil liability
under section 1041I.
1041H Misleading or deceptive conduct (civil liability only)
(1) A person must not, in this jurisdiction, engage in conduct, in
relation to a financial product or a financial service, that is
misleading or deceptive or is likely to mislead or deceive. Note 1: Failure to comply with this subsection is not an offence. Note 2: Failure to comply with this subsection may lead to civil liability under
section 1041I. For limits on, and relief from, liability under that
section, see Division 4. (2) The reference in subsection (1) to engaging in conduct in relation
to a financial product includes (but is not limited to) any of the
following:
(a) dealing in a financial product;
(b) without limiting paragraph (a):
(i) issuing a financial product;
(ii) publishing a notice in relation to a financial product;
(iii) making, or making an evaluation of, an offer under a
takeover bid or a recommendation relating to such an
offer;
(iv) applying to become a standard employer-sponsor of a
superannuation entity;
(v) permitting a person to become a standard
employer-sponsor of a superannuation entity;
(vi) a trustee of a superannuation entity dealing with a
beneficiary of that entity as such a beneficiary;
Corporations Act 2001 211

Part 7.10-Market misconduct and other prohibited conduct
relating to financial products and financial services 204
Division 1-Preliminary 204
1040A Content of Part................................................................204
1040B Treat certain instruments as if they were financial
products and Division 3 financial products....................204
Division 2-The prohibited conduct (other than insider trading
prohibitions) 205
1041A Market manipulation......................................................205
1041B False trading and market rigging-creating a false
or misleading appearance of active trading etc..............205
1041C False trading and market rigging-artificially
maintaining etc. trading price.........................................207
1041D Dissemination of information about illegal
transactions.....................................................................208
1041E False or misleading statements.......................................209
1041F Inducing persons to deal.................................................210
1041G Dishonest conduct..........................................................211
1041H Misleading or deceptive conduct (civil liability
only)................................................................................211
viii Corporations Act 2001

Explanation: EU_MICA_RTS (EU MiCA regulatory technical standards, including Article 84 qualifying-holding-acquisition information requirements — direct and indirect acquirers must submit detailed personal/corporate data to the home NCA) and AU_CORPS_ACT (Australian Corporations Act substantial-holdings disclosure under Chapter 6C — beneficial owners of 5%+ stakes in AU-listed entities must disclose to ASIC). When an entity acquires qualifying holdings in both EU CASPs and AU-listed financial entities, the two frameworks impose parallel notification obligations on materially the same persons. Operationally resolvable through parallel compliance with each notification regime; severity low because the obligations are reporting-only (not in direct contradiction).


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): ASIC's crypto-asset INFO 225 / RG 282 guidance and AUSTRAC TTR $10k cash threshold reporting operate in disjoint regulatory domains at the obligation level. ASIC crypto vs AML threshold reporting — disjoint domains. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

5.10.2 Material outsourcing arrangements with service providers located outside Singapore
should be conducted in a manner so as not to hinder MAS' efforts to supervise the Singapore
business activities of the institution (i.e., from its books, accounts and documents) in a timely
manner, in particular:
(a) An institution should, in principle, enter into outsourcing arrangements only
with service providers operating in jurisdictions that generally uphold
confidentiality clauses and agreements.

(b) An institution should not enter into outsourcing arrangements with service
providers in jurisdictions where prompt access to information by MAS or
agents appointed by MAS to act on its behalf, at the service provider, may
be impeded by legal or administrative restrictions. An institution must at
least commit to retrieve information readily from the service provider
should MAS request for such information. The institution should confirm in
writing to MAS, that the institution has provided, in its outsourcing
agreements, for MAS to have the rights of inspecting the service provider,
as well as the rights of access to the institution and service provider's
information, reports and findings related to the outsourcing arrangement,
as set out in paragraph 5.9.
(c) An institution should notify MAS if any overseas authority were to seek
access to its customer information or if a situation were to arise where the
rights of access of the institution and MAS set out in paragraph 5.9, have
been restricted or denied.

1.2 These Guidelines1 on Outsourcing ("Guidelines") set out the Monetary Authority of
Singapore's ("MAS") expectations of an institution that has entered into any outsourcing
arrangement or is planning to outsource its business activities2 to a service provider. An
institution should conduct a self-assessment of all existing outsourcing arrangements against
these Guidelines3.

Explanation: MAS_TRM (MAS Technology Risk Management Guidelines) and SG_MAS_OUTSOURCING (MAS Outsourcing Guidelines). Both are MAS guidelines for SG financial institutions — TRM addresses ICT/tech risk, outsourcing addresses third-party arrangements. Coordinated parts of MAS's broader operational-risk supervisory architecture.


CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: AU_ASIC_CRYPTO (ASIC INFO 225 — financial-product classification of crypto-assets under Corporations Act) and EU_MICA_TITLE_IV_EMT (EU MiCA Title IV — e-money token classification). Whether a given token is classified as a 'financial product' under AU law vs as an 'electronic money token' under EU MiCA turns on FACTS about the token's design, peg mechanism, and use — not pinned down in either regime. Different facts can produce different classifications and therefore different obligations.


1.4 The revised MAS Technology Risk Management Guidelines set out technology
risk management principles and best practices for the financial sector, to guide FIs in the
following:
(a) Establish Sound and Robust Technology Risk Governance and Oversight
The board of directors and senior management at an FI play an integral part in
the oversight and management of technology risk. The board of directors and
senior management should cultivate a strong risk culture, and ensure the
establishment of a sound and robust technology risk management framework.
(b) Maintain Cyber Resilience
Strong cyber resilience is critical for sustaining trust and confidence in financial
services. FIs should adopt a defence-in-depth approach to strengthening cyber
resilience. It is also important that FIs establish and continuously improve their
IT processes and controls to preserve confidentiality, integrity and availability of
data and IT systems.
Monetary Authority of Singapore 5

3.4.1 The use of certain third party services by FIs may not always constitute
outsourcing. However, as many of these services are provisioned or delivered using IT, or
may involve confidential or sensitive customer information being stored or processed
electronically by the third party, the FI's operations and its customers may be adversely
impacted if there is a system failure or security breach at the third party.

3.4.2 The FI should assess and manage its exposure to technology risks that may affect
the confidentiality, integrity and availability of the IT systems and data at the third party
before entering into a contractual agreement or partnership.

3.4.3 On an ongoing basis, the FI should ensure the third party employs a high standard
of care and diligence in protecting data confidentiality4 and integrity as well as ensuring
system resilience.

(a) a digital payment token service;
(b) a digital payment token transfer service;
(c) a custodian wallet service;
"STR" means suspicious transaction report;
"STRO" means the Suspicious Transaction Reporting Office, Commercial Affairs
Department of the Singapore Police Force;
"trust relevant party" has the same meaning as defined in paragraph 2.1 of MAS Notice
TCA-N03;
"TSOFA" means the Terrorism (Suppression of Financing) Act 2002;
"value transfer" refers to any transaction carried out on behalf of a value transfer originator
through a financial institution with a view to making one or more digital tokens available
to a beneficiary person at a beneficiary institution, irrespective of whether the originator
and the beneficiary are the same person; and
"wire transfer" refers to any transaction carried out on behalf of a wire transfer originator
through a financial institution by electronic means with a view to making an amount of
funds available to a beneficiary person at a beneficiary institution, irrespective of whether
the originator and the beneficiary are the same person.

2 In the case of a limited liability partnership or a limited partnership. Securities Regulation issued by the International Organisation of Securities
Commissions, or the Insurance Core Principles issued by the International Association of
Insurance Supervisors;
"cross-border wire transfer" means a wire transfer where the ordering institution and the
beneficiary institution are located in different countries or jurisdictions and also refers to
any chain of wire transfer in which at least one of the financial institutions involved is
located in a different country or jurisdiction;
"custodian wallet service" means the service of safekeeping and administration of digital
payment tokens or instruments enabling control over digital payment tokens;
"customer", in relation to a bank, means a person (whether a natural person, legal person
or legal arrangement) -
(a) with whom business relations are established or with whom the bank intends to
establish business relations; or
(b) for whom the bank undertakes or intends to undertake any transaction without an
account being opened;
[MAS Notice 626 (Amendment) 2025]
"digital CMP token" means a digital representation of a capital markets product which can
be transferred, stored or traded electronically;
"digital payment token" has the same meaning as defined in section 2(1) of the PS Act;
"digital payment token service" has the same meaning as defined in section 2(1) of the
PS Act;
"digital payment token transfer service" means the service of accepting digital payment
token from one digital payment token address or account, whether in Singapore or outside
Singapore, as principal or agent, for the purposes of transferring, or arranging for the
transfer of, the digital payment token to another digital payment token address or account,
whether in Singapore or outside Singapore;
"digital token" means -
(a) a digital payment token; or
(b) a digital CMP token;
"digital token transaction" means -
(a) a payment service transaction; or

Explanation: MAS TRM Guidelines and the SG PSA DPT regime co-apply to MAS-supervised DPT service providers but operate in disjoint domains. TRM governs technology risk management (ICT governance, outsourcing, cybersecurity); the PSA DPT regime governs payment-token service authorisation and AML/CFT controls. Obligations are cumulative — a DPT service provider must comply with both, but neither pushes against the other.

TRM third-party outsourcing rules conflicted with PSA DPT licensee restrictions on outsourcing — both regimes treat outsourcing as a controlled activity with similar safeguards.


1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The MAS TRM passages discuss the application of general guidelines (TRM Guidelines, F&P Guidelines) to licensees and the inclusion of cybersecurity components for digital tokens. The SG_PSA_DPT passages discuss the issuance of a specific Notice (PSN02) under the Payment Services Act to holders of payment service licences providing digital payment token services, focusing on AML/CFT requirements and licensing. The regimes regulate different aspects of the digital token ecosystem: MAS TRM focuses on general licensing and operational guidelines, while SG_PSA_DPT focuses on specific AML/CFT obligations and licensing for DPT service providers. There is no specific obligation in MAS TRM that conflicts with a specific obligation in SG_PSA_DPT; rather, they address distinct regulatory domains.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

Explanation: The EU_EMD2 passage (chunk 85307f9e2a040982::14a::134d) discusses the Digital Operational Resilience Act (DORA) and its application to the financial sector. The SG_FSMA_DTSP passage (chunk 20d526d712753652::404::80be) discusses the definition and licensing of Digital Token Service Providers (DTSPs) under the Financial Services and Markets Act 2022. The obligations regarding operational resilience (EU) and licensing of digital token service providers (SG) regulate distinct aspects of financial services operations and do not impose conflicting requirements on the same specific obligation. Therefore, the regimes are in different domains.


Article 1
Subject matter
1. In order to achieve a high common level of digital operational resilience, this Regulation lays down uniform
requirements concerning the security of network and information systems supporting the business processes of financial
entities as follows:
(a) requirements applicable to financial entities in relation to:
(i) information and communication technology (ICT) risk management;
(ii) reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the
competent authorities;
(iii) reporting of major operational or security payment-related incidents to the competent authorities by financial
entities referred to in Article 2(1), points (a) to (d);
(iv) digital operational resilience testing;
(v) information and intelligence sharing in relation to cyber threats and vulnerabilities;
(vi) measures for the sound management of ICT third-party risk;
(b) requirements in relation to the contractual arrangements concluded between ICT third-party service providers and
financial entities;
(c) rules for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when
providing services to financial entities;
(d) rules on cooperation among competent authorities, and rules on supervision and enforcement by competent
authorities in relation to all matters covered by this Regulation.
2. In relation to financial entities identified as essential or important entities pursuant to national rules transposing

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The EU DORA regime regulates the digital operational resilience and ICT risk management of financial entities and their third-party service providers (chunk 85307f9e2a040982::5f2::974e). The SG_STABLECOIN regime regulates the issuance and reserve requirements of Single Currency Stablecoins (SCS) issued in Singapore (chunk 58f45cd2ef3de201::36c::e2f6). The obligations in DORA relate to the internal risk management and resilience of financial entities, whereas the obligations in SG_STABLECOIN relate to the asset backing and issuance of specific digital tokens. These are distinct regulatory domains; there is no specific obligation in DORA that conflicts with the specific obligations in SG_STABLECOIN regarding SCS issuance or reserve management.


Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

2 The FSM Sanctions Regulations include the regulations issued under section 192 read with sections 15(1)(b) and 219(d)
of the FSM Act. Please refer to the following link for the FSM Sanctions Regulations:
https://www.mas.gov.sg/regulation/anti-money-laundering/targeted-financial-sanctions/regulations-for-targeted-financial-
sanctions. Currently, the relevant FSM Sanctions Regulations are those relating to the Democratic People's Republic of
Korea and Iran. concerns. Other support functions such as operations, human resource or
technology also play a role to help mitigate the ML/TF risks that the CMI faces. The AML/CFT compliance function is typically the contact point regarding all
AML/CFT issues for domestic and foreign authorities, including supervisory
authorities, law enforcement authorities and financial intelligence units.
1-4-14 As the third line of defence, the CMI's internal audit function or an equivalent
function plays an important role in independently evaluating the AML/CFT risk
management framework and controls for purposes of reporting to the audit
committee of the CMI's board of directors, or a similar oversight body.

Explanation: The EU MICA Title IV EMT regime regulates the disclosure and liability obligations of issuers of e-money tokens and asset-referenced tokens (e.g., Article 51 and 52 regarding white papers and liability). The SG MAS AML General regime regulates Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) compliance, supervision of financial institutions and digital payment token (DPT) providers, and targeted financial sanctions. The obligations in the EU regime (disclosure of information to enable informed decisions) are distinct from the obligations in the SG regime (preventing money laundering and terrorism financing). There is no specific obligation in the EU regime that pushes against a specific obligation in the SG regime; rather, they regulate different domains of financial activity. Therefore, the regimes are in non-conflict.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Explanation: The Australian passages discuss the general tax treatment and adoption of crypto assets (chunk_id e6bb47e92e88e16c::567::36c4), while the EU passages focus on Anti-Money Laundering (AML) obligations for crypto-asset service providers (chunk_id c0300673081f7232::279::1918). The regimes regulate distinct aspects of the crypto ecosystem—taxation versus AML/CFT compliance—and do not impose conflicting obligations on the same specific activity. Therefore, the relationship is non-conflict.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU MiFID II investment-firm conduct directive operate in disjoint regulatory domains at the obligation level. AML supervisor vs investment-firm conduct rules — disjoint subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU MICA Title IV EMT passages regulate the specific disclosure obligations of issuers of e-money tokens, including the content of crypto-asset white papers and liability for misleading information (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). The INT IOSCO GENERAL passages provide a general methodology and list of international standards and reports, including resolutions and technical committee reports on disclosure and securities regulation (chunk_id f173909614befd49::455::1a1a). The IOSCO documents do not impose specific, binding obligations on issuers of e-money tokens; rather, they serve as a framework of principles and international standards. Therefore, the regimes regulate different domains: EU MICA imposes specific regulatory requirements, while INT IOSCO provides general international guidance. There is no specific obligation in IOSCO that conflicts with the specific obligations in EU MICA.


Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

(66)
Issuers of e-money tokens should be authorised either as a credit institution under Directive 2013/36/EU or as an
electronic money institution under Directive 2009/110/EC. E-money tokens should be deemed to be 'electronic
money' as that term is defined in Directive 2009/110/EC and their issuers should, unless specified otherwise in
this Regulation, comply with the relevant requirements set out in Directive 2009/110/EC for the taking up,
pursuit and prudential supervision of the business of electronic money institutions and the requirements on
issuance and redeemability of e-money tokens. Issuers of e-money tokens should draw up a crypto-asset white
paper and notify it to their competent authority. Exemptions regarding limited networks, regarding certain
transactions by providers of electronic communications networks and regarding electronic money institutions
issuing only a limited maximum amount of electronic money, based on the optional exemptions specified in
Directive 2009/110/EC, should also apply to e-money tokens. However, issuers of e-money tokens should still be
required to draw up a crypto-asset white paper in order to inform buyers about the characteristics and risks of
the e-money tokens and should also be required to notify the crypto-asset white paper to the competent authority
before its publication.

Article 57
Voluntary classification of e-money tokens as significant e-money tokens
1.
An issuer of an e-money token, authorised as a credit institution or as an electronic money institution, or applying
for such authorisation, may indicate that it wishes for its e-money token to be classified as a significant e-money token.
In that case, the competent authority shall immediately notify such request of the issuer to EBA, to the ECB and, in the
cases referred to in Article 56(3), second subparagraph, to the central bank of the Member State concerned.
In order for the e-money token to be classified as significant under this Article, the issuer of the e-money token shall
demonstrate, through a detailed programme of operations, that it is likely to meet at least three of the criteria set out in

Article 49
Issuance and redeemability of e-money tokens
1.
By way of derogation from Article 11 of Directive 2009/110/EC, in respect of the issuance and redeemability of e-
money tokens only the requirements set out in this Article shall apply to issuers of e-money tokens.
2.
Holders of e-money tokens shall have a claim against the issuers of those e-money tokens.
3.
Issuers of e-money tokens shall issue e-money tokens at par value and on the receipt of funds.
EN
L 150/107

4.
Upon request by a holder of an e-money token, the issuer of that e-money token shall redeem it, at any time and
at par value, by paying in funds, other than electronic money, the monetary value of the e-money token held to the
holder of the e-money token.
5.
Issuers of e-money tokens shall prominently state the conditions for redemption in the crypto-asset white paper as
referred to in Article 51(1), first subparagraph, point (d).
6.
Without prejudice to Article 46, the redemption of e-money tokens shall not be subject to a fee.

Explanation: EMT issuers under MiCA Title IV (operating as credit institutions or EMIs) process customer personal data for issuance, redemption-at-par (Article 49) and reserve-asset management, plus the prudential-supervisor reporting cycle. GDPR data minimisation, purpose limitation and cross-border transfer rules apply to all of this processing. The tension is operational: GDPR Article 6(1)(b)/(c) supplies the lawful basis for issuance-redemption customer processing, and the underlying EMD2 / CRD IV authorisation provides the parent framework. Practitioners must integrate the EMT-specific redemption obligations with GDPR purpose-specification and retention limits. Severity medium because the personal-data surface for EMT issuers is meaningful but more contained than for full-CASP operations.

Use Art. 6(1)(b) (contract) for issuance/redemption customer processing under MiCA Art 49.

Use Art. 6(1)(c) (legal obligation) for supervisory-reporting personal data.

Integrate EMT redemption record-keeping with GDPR Art 5(1)(e) retention windows tied to the AML record-retention chain.

EMT issuer is EU-authorised as a credit institution or EMI; non-EU EMT issuance is structurally blocked (separate structural conflict labelled).


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

RG 105.62 We will accept a standard set by APRA if you are a body regulated by APRA
and the standard is relevant to your responsible manager's role. For example,
if you are a general insurer regulated by APRA, we will accept that a person
who is a 'responsible person' for the purposes of APRA's Prudential Standard
CPS 520 Fit and proper has appropriate knowledge about dealing in general
insurance products.
Option 2: Individual assessment

RG 105.63 Individual assessment means an assessment of a person's capability to
undertake their current duties, taking into account their previous work
experience. This type of assessment does not necessarily include a formal
written examination. It may take the form of an oral or practical test, on-the-
job assessment or some other form.

Explanation: AU_APRA_CPS230 (APRA Operational Risk Management prudential standard for AU-regulated entities) and SG_PSA_GENERAL (Singapore Payment Services Act — note: B-side citation is RG 105 which is actually AU not SG; cross-jur retrieval mismatch). Even setting aside the retrieval issue, both broadly touch on regulated entity operational requirements but in materially different perimeters — APRA's prudential standards for AU-regulated entities vs SG's payment-service licensing.


EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 16
Detection of missing information on the originator or the beneficiary
1.
The crypto-asset service provider of the beneficiary shall implement effective procedures, including, where appro
priate, monitoring after or during the transfers, in order to detect whether the information referred to in Article 14(1)
and (2) on the originator and the beneficiary is included in, or follows, the transfer or batch file transfer of crypto-assets.
2.
In the case of a transfer of crypto-assets made from a self-hosted address, the crypto-asset service provider of the
beneficiary shall obtain and hold the information referred to in Article 14(1) and (2) and shall ensure that the transfer of
crypto-assets can be individually identified.
Without prejudice to specific risk mitigating measures taken in accordance with Article 19b of Directive (EU) 2015/849,
in the case of a transfer of an amount exceeding EUR 1 000 from a self-hosted address, the crypto-asset service provider
of the beneficiary shall take adequate measures to assess whether that address is owned or controlled by the beneficiary.
3.
Before making the crypto-assets available to the beneficiary, the crypto-asset service provider of the beneficiary
shall verify the accuracy of the information on the beneficiary referred to in Article 14(2) on the basis of documents,
data or information obtained from a reliable and independent source.
4.
Verification as referred to in paragraphs 2 and 3 of this Article shall be deemed to have taken place where one of
the following applies:
(a) the identity of the beneficiary has been verified in accordance with Article 13 of Directive (EU) 2015/849 and the
information obtained pursuant to that verification has been retained in accordance with Article 40 of that Directive;
(b) Article 14(5) of Directive (EU) 2015/849 applies to the beneficiary.

(30) The personalised security credentials used for secure customer authentication by the payment service user or by the
payment initiation service provider are usually those issued by the account servicing payment service providers.
Payment initiation service providers do not necessarily enter into a contractual relationship with the account
servicing payment service providers and, regardless of the business model used by the payment initiation service
providers, the account servicing payment service providers should make it possible for payment initiation service
providers to rely on the authentication procedures provided by the account servicing payments service providers to
initiate a specific payment on behalf of the payer.

(31) When exclusively providing payment initiation services, the payment initiation service provider does not at any
stage of the payment chain hold the user's funds. When a payment initiation service provider intends to provide
payment services in relation to which it holds user funds, it should obtain full authorisation for those services.

Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

Explanation: The EU TFR explicitly applies to payment service providers and crypto-asset service providers; PSD2 authorises and regulates the same PSPs. The two regimes layer cleanly: PSD2 supplies the payments-conduct overlay (authorisation, SCA, open banking); AMLR/TFR supplies the AML / travel-rule overlay on top. No obligation in one pushes against any obligation in the other; a PSP must comply with both, but the obligations are cumulative.

PSD2 SCA rules required disclosure of authentication details that AMLR confidentiality limited — designed as separate compliance surfaces.