45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

4. A country need not impose a separate licensing or registration system with respect to natural
or legal persons already licensed or registered as financial institutions (as defined by the FATF
Recommendations) within that country, which, under such license or registration, are
permitted to perform VASP activities and which are already subject to the full range of
applicable obligations under the FATF Recommendations.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The FATF Standards (Regime A) establish a minimum standard and allow countries to extend their regimes beyond the FATF definition of a VASP (chunk 85240528438654b9::1cd::07d7, chunk 94). The Singapore foundational legislation (Regime B) explicitly references the FATF standards and indicates an intention to expand the scope of legislation to align with international AML/CFT requirements (chunk b49627bb889ef1d9::3ef::7168, chunk d6f4be6b9d136778::467::12af). Furthermore, the FATF guidance notes that countries need not impose a separate licensing system for entities already licensed as financial institutions (chunk ba862e1f095bceac::1a6::1f0e). These passages demonstrate that the regimes are aligned and complementary, with Singapore seeking to implement the FATF standards rather than conflict with them.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (chunk_ids c0300673081f7232::320::7b46, c0300673081f7232::498::163c). In contrast, the SG Foundational Legislation passages describe MAS's enforcement actions against ICO issuers and exchanges for regulatory breaches, and its intention to align with international AML/CFT standards (chunk_ids b49627bb889ef1d9::3ef::7168, d6f4be6b9d136778::467::12af). These obligations regulate different domains—tax reporting versus market conduct and AML enforcement—and do not impose conflicting requirements on the same specific activity.


1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (Recital 19, 498, 3d8). The INT_FATF_GENERAL regime focuses on anti-money laundering (AML) and counter-terrorist financing (CFT) standards, risk assessment, and the supervision of financial institutions (Recital 59a4, 4ad, 215). The cited passages from FATF discuss general principles for assessing ML/TF risks and the global standard for AML/CFT, which are distinct from the specific tax reporting obligations of DAC8. While both regimes apply to the crypto-asset sector, they regulate different domains (tax transparency vs. financial crime prevention) and do not impose conflicting obligations on the same specific action.


Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Issuers of e-money tokens shall notify their crypto-asset white paper to their competent authority at least 20
working days before the date of their publication. Competent authorities shall not require prior approval of crypto-asset white papers before their publication.
12. Any significant new factor, any material mistake or any material inaccuracy that is capable of affecting the
assessment of the e-money token shall be described in a modified crypto-asset white paper drawn up by the issuers,
notified to the competent authorities and published on the issuers' websites.
13. Before offering the e-money token to the public in the Union or seeking an admission to trading of the e-money
token, the issuer of such e-money token shall publish a crypto-asset white paper on its website. EN
L 150/109 14. The issuer of the e-money token shall together with the notification of the crypto-asset white paper pursuant to
paragraph 11 of this Article provide the competent authority with the information referred to in Article 109(4).

Explanation: The EU MICA Title IV EMT passages regulate the disclosure and liability obligations of issuers of e-money tokens, specifically regarding the content of crypto-asset white papers and notification to competent authorities (chunk_ids 491a2f0014d56ffb::702::05e4, 491a2f0014d56ffb::408::740e). In contrast, the FATF VASP passages focus on the definition of Virtual Asset Service Providers (VASPs) and the application of AML/CFT standards, noting that countries may extend their regimes beyond the minimum FATF standard and that existing financial institution licenses may cover VASP activities (chunk_ids 85240528438654b9::1cd::07d7, ba862e1f095bceac::1a6::1f0e). The obligations in the EU regime relate to product disclosure and issuer liability, while the FATF regime relates to the licensing and AML/CFT obligations of service providers. These are distinct regulatory domains that do not impose conflicting obligations on the same specific activity.


FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Notabene commend's the Monetary Authority of Singapore (MAS) for proposing a
comprehensive and detailed regulatory approach for Digital Token Service Providers
(DTSPs) under the Financial Services and Markets Act 2022. Our comments focus on
the alignment of these notices and guidelines with international standards,
particularly in light of Financial Action Task Force (FATF) Recommendations,
including the Travel Rule.

(Please refer to paragraph 12 of the draft FSM Notice). The proposed requirements for Correspondent Account Services (CAS) in paragraph
5.6 of the draft FSM Notice are both applicable and appropriate for the digital token
service provider (DTSP) sector. Given the inherent cross-border nature and rapid
transactions within digital token services, the FATF-aligned risk mitigation measures
ensure that DTSPs are aligned with global AML/CFT standards, providing a secure
framework for correspondent services while addressing potential ML/TF risks. Applicability of Risk Mitigation Measures
The requirement for DTSPs to assess the suitability of financial institutions when
providing or receiving CAS, including evaluating their AML/CFT controls, is essential
for preventing potential misuse of these services. The dynamic and often cross-
jurisdictional interactions in digital token services make these standards particularly
relevant to ensuring consistent risk management. MAS could consider offering
guidance on specific factors DTSPs should evaluate, such as transaction monitoring
capabilities and the jurisdiction's regulatory reputation, to better equip licensees in
applying a comprehensive assessment.

Explanation: The FATF passages (Regime A) provide general international standards for AML/CFT and correspondent banking services. The Singapore DTSP passages (Regime B) describe the licensing and regulatory framework for Digital Token Service Providers (DTSPs) and explicitly state that the proposed regulations are aligned with international standards, including FATF Recommendations. Specifically, Regime B cites the FATF Travel Rule and notes that FATF-aligned risk mitigation measures are being applied to ensure DTSPs are aligned with global AML/CFT standards. There is no evidence of a specific obligation in Regime A that conflicts with a specific obligation in Regime B; rather, Regime B confirms it is implementing Regime A standards.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Article 1
Subject matter
This Regulation establishes a common regulatory framework on insider dealing, the unlawful disclosure of inside
information and market manipulation (market abuse) as well as measures to prevent market abuse to ensure the
integrity of financial markets in the Union and to enhance investor protection and confidence in those markets.

Explanation: The Australian regime (AU_ATO_CRYPTO) focuses on the taxation of crypto assets and the regulatory framework for their treatment, including token mapping and consumer interest (chunk_id e6bb47e92e88e16c::567::36c4). The European regime (EU_MAR) establishes a common regulatory framework for market abuse, specifically insider dealing and market manipulation in financial instruments (chunk_id 5cc4a27bc578287a::165::3333). The obligations and subject matter of the two regimes are distinct; one governs tax compliance and asset classification, while the other governs market integrity and conduct. There is no specific obligation in the Australian tax regime that conflicts with the European market abuse regime.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers (specifically platform providers and intermediaries) in Australia, focusing on financial product obligations and AFSL requirements (chunk 550958b067dc6726::709::b159). The EU_AMLA regime establishes an institutional framework for Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) obligations across the European Union (chunk df546f2364aaf9e2::25a::6ab3). The obligations in the AMLA text relate to cooperation with authorities, information exchange, and supervisory powers, which are distinct from the financial services licensing and conduct obligations detailed in the AFSL text. Therefore, the regimes regulate different domains and do not impose conflicting obligations.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The evidence from APRA CPS 230 focuses on operational risk management, business continuity, and the management of service providers to ensure resilience (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The evidence from the Singapore Stablecoin regime focuses on the regulatory perimeter for Single-Currency Stablecoins (SCS), distinguishing them from other digital payment tokens and outlining the scope of MAS' regulatory approach (chunk_ids 58f45cd2ef3de201::36c::e2f6, 33d059aa86716ddd::4ed::8511). The obligations in CPS 230 regarding operational resilience and service provider management do not directly oppose the Singapore regime's classification of SCS or its proposed reserve asset requirements. Therefore, the regimes regulate different domains and do not conflict.


Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Reporting structuring Related legislation Part 3, Division 3 (Sections 43 and 44) of the AML/CTF Act (latest version) - Threshold
transactions Chapter 19 of the AML/CTF Rules (latest version) - Reportable details for threshold
transactions The content on this website is general and is not legal advice. Before you make a decision or
take a particular action based on the content on this website, you should check its accuracy,
completeness, currency and relevance for your purposes. You may wish to seek independent
professional advice. https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 2/3 https://www.austrac.gov.au/business/core-guidance/reporting/reporting-transactions-10000-and-over-threshold-transaction-reports-ttrs 3/3

EN
L 150/21 2. The crypto-asset service provider of the originator shall ensure that transfers of crypto-assets are accompanied by
the following information on the beneficiary:
(a) the name of the beneficiary;
(b) the beneficiary's distributed ledger address, in cases where a transfer of crypto-assets is registered on a network using
DLT or similar technology, and the beneficiary's crypto-asset account number, where such an account exists and is
used to process the transaction;
(c) the beneficiary's crypto-asset account number, in cases where a transfer of crypto-assets is not registered on a
network using DLT or similar technology; and
(d) subject to the existence of the necessary field in the relevant message format, and where provided by the originator
to its crypto-asset service provider, the current LEI or, in its absence, any other available equivalent official identifier
of the beneficiary.
3. By way of derogation from paragraph 1, point (c), and paragraph 2, point (c), in the case of a transfer of crypto-
assets not registered on a network using DLT or similar technology and not made to or from a crypto-asset account, the
crypto-asset service provider of the originator shall ensure that the transfer of crypto-assets is accompanied by a unique
transaction identifier.
4.

Article 19
Retention of information on the originator and the beneficiary accompanying the transfer
Intermediary crypto-asset service providers shall ensure that all the information received on the originator and the
beneficiary that accompanies a transfer of crypto-assets is transmitted with the transfer and that records of such
information are retained and made available on request to the competent authorities.

Explanation: AUSTRAC's TTR threshold regime is a domestic Australian cash-transaction reporting obligation tied to the A$10,000 threshold. The EU TFR is a crypto-asset and fiat wire-transfer travel-rule regime for EU CASPs and PSPs. The two regimes operate in different jurisdictions and address different transaction types (cash threshold vs wire-transfer information). No obligation collision possible. Hard negative.

An Australian-EU dual-regulated entity processed transactions hitting both regimes — they would apply cumulatively on their respective jurisdictional surfaces.


means to identify and verify the
identification of the customer if previously undertaken by the first
reporting entity:
(a) a prescribed verification procedure;
(b) an identification reference; or
(c) a procedure approved by the AUSTRAC CEO; and
(d) any relevant identification obtained by the second reporting
entity in regard to subparagraph 50.4(2)(a)-(c)(if applicable); or
(3) collect any KYC information in respect of the customer; or
(4) verify, from a reliable and independent source, KYC information that
has been obtained in respect of the customer;
for the purpose of enabling the second reporting entity to be reasonably
satisfied that the customer is the person that he or she claims to be.
50.9 For the purposes of paragraph 50.8, the following circumstances are specified:
(1) a suspicious matter reporting obligation arises in relation to the
customer to which the second reporting entity has commenced to
provide a

'@ Australian Government Cee ee
ahem 8 eporting Home / Business / Core guidance / Reporting As a reporting entity you must report certain transactions and suspicious matters, and
submit compliance reports to AUSTRAC. Everyone, including reporting entities, must
report cross-border movements of physical currency. Ongoing reporting obligations Threshold transaction reports You must submit threshold transaction reports (TTR) for transfers of A$10,000 or more
in cash (or the foreign currency equivalent). TTRs are due within 10 business days after
the date of the transaction. International funds transfer instruction reports (IFTIs) You must submit international funds transfer instruction reports (IFTIs) for transfers of
funds of any value into or out of Australia, made either electronically or under a
designated remittance arrangement. IFTIs are due within 10 business days after the
transfer instruction is sent or received. Suspicious matter reports (SMRs) You must submit suspicious matter reports (SMRs) when you have a suspicion that a
customer or transaction is related to criminal activity.

Operational risk is inherent
in all products, activities, processes and systems.
14. An APRA-regulated entity must, to the extent practicable, prevent disruption to
critical operations, adapt processes and systems to continue to operate within
tolerance levels in the event of a disruption and return to normal operations
promptly once a disruption is over.
15. An APRA-regulated entity must not rely on a service provider unless it can ensure
that in doing so it can continue to meet its prudential obligations in full and
effectively manage the associated risks. Risk management framework
16. As part of its risk management framework required under Prudential Standard
CPS 220 Risk Management (CPS 220) and Prudential Standard SPS 220 Risk
Management (SPS 220), an APRA-regulated entity must develop and maintain:
governance arrangements for the oversight of operational risk;
an assessment of its operational risk profile, with a defined risk appetite
supported by indicators, limits and tolerance levels;
internal controls that are designed and operating effectively for the
management of operational risks;
appropriate monitoring, analysis and reporting of operational risks and
escalation processes for operational incidents and events;
business continuity plan(s) (BCPs) that set out how the entity would
identify, manage and respond to a disruption within tolerance levels and are
regularly tested with severe but plausible scenarios; and
processes for the management of service provider arrangements.
17.

Explanation: AUSTRAC AML/CTF guidance covers customer due diligence, transaction monitoring and reporting; CPS 230 is the APRA operational-risk standard. The two regimes co-apply to APRA-regulated reporting entities but address disjoint subject matters. Operational-risk failures may have AML implications and vice versa, but the regimes' obligations are cumulative, not conflicting. Hard negative.

CPS 230 BCP timelines required disruption of AML transaction monitoring during incident handling — designed to be coordinated.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1 and Article 25). The FATF_R16 passages regulate Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards, focusing on digital identity and virtual assets. The obligations in MIFID2 regarding client suitability and information disclosure do not conflict with the FATF's AML/CFT obligations regarding customer due diligence or digital identity verification. Instead, they operate in complementary domains: MIFID2 ensures the suitability of financial instruments for the client, while FATF ensures the identity of the client to prevent financial crime. There is no specific obligation in MIFID2 that pushes against a specific obligation in FATF, nor is there evidence that one regime renders the other inapplicable.


1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

Explanation: FATF_R16 (FATF Recommendation 16 — international AML travel-rule standard) and INT_BASEL_GENERAL (Basel III prudential framework). Both are international standards bodies; FATF addresses AML/CFT, Basel addresses banking prudential. Coordinated pillars of international financial regulation.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: Regime A (INT_BASEL_CRYPTO) regulates the capital adequacy and risk-weighting of bank exposures to financial institutions, including securities firms and central counterparties. Regime B (SG_PSA_DPT) regulates the licensing and Anti-Money Laundering (AML) obligations of entities providing Digital Payment Token (DPT) services in Singapore. The obligations in Regime A relate to prudential capital standards for banking institutions, while the obligations in Regime B relate to the conduct and licensing of payment service providers. The passages confirm that these regimes govern distinct domains: one focuses on banking sector stability and capital requirements, while the other focuses on the AML/CFT compliance of digital payment token service providers. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

Article 24
General principles and information to clients
1. Member States shall require that, when providing investment services or, where appropriate, ancillary services to
clients, an investment firm act honestly, fairly and professionally in accordance with the best interests of its clients and
comply, in particular, with the principles set out in this Article and in Article 25.
2. Investment firms which manufacture financial instruments for sale to clients shall ensure that those financial
instruments are designed to meet the needs of an identified target market of end clients within the relevant category
of clients, the strategy for distribution of the financial instruments is compatible with the identified target market, and the
investment firm takes reasonable steps to ensure that the financial instrument is distributed to the identified target
market. An investment firm shall understand the financial instruments they offer or recommend, assess the compatibility of the
financial instruments with the needs of the clients to whom it provides investment services, also taking account of the
identified target market of end clients as referred to in Article 16(3), and ensure that financial instruments are offered or
recommended only when this is in the interest of the client.
3.

Explanation: The evidence from AU_FEDREG_AML (chunk cf7cefacba3f94bc::49a::f39e) outlines obligations for reporting entities regarding customer identification, suspicious activity reporting, and transaction monitoring. The evidence from EU_MIFID2 (chunk 28dfda0f6a6539b6::514::0ca0) outlines principles for investment firms regarding acting in the best interests of clients and ensuring financial instruments are designed to meet client needs. The obligations in the AML regime focus on preventing financial crime and monitoring transactions, while the MIFID II obligations focus on client suitability and product governance. These are distinct regulatory domains with no apparent overlap or conflict in obligations.


2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

1.1 The Guidelines on Licensing for Digital Token Service Providers (the "Guidelines")
are intended to provide guidance on the application procedures, licensing criteria and
ongoing requirements for Digital Token Service Providers under Part 9 of the Financial
Services and Markets Act 2022 (the "FSM Act"). Under this, digital token service providers are
defined as individuals, partnerships or Singapore corporations that are operating from a place
of business in Singapore or formed or incorporated in Singapore but carry on a business of
providing digital token services outside Singapore ("DTSPs").

1.2 These Guidelines should be read in conjunction with the provisions of the FSM Act,
the Financial Services and Markets (Digital Token Service Provider) Regulations (the "FSM
Regulations") and other relevant legislation, notices, guidelines and FAQs issued by the
Monetary Authority of Singapore ("MAS").

1.3 MAS will update these Guidelines periodically to provide further guidance.
2. Licence under the FSM Act

3.1 DTSPs are susceptible to higher money laundering, terrorism financing and
proliferation financing ("ML/TF") risks due to the internet-based and cross-border nature of
such services. This would result in a greater risk of such providers being engaged in or
misused for illicit purposes to the detriment of Singapore's reputation. In light of these risks,
MAS approaches the licensing of DTSPs in a prudent and cautious manner, and there will be
extremely limited circumstances under which MAS will consider granting an applicant a DTSP
licence under the FSM Act. The extremely limited circumstances include:
• The applicant has a business model that makes economic sense, and is able to
demonstrate to MAS' satisfaction that it has valid reasons as to why it does not
intend to carry on a business of providing digital token services in Singapore
despite operating in or being formed or incorporated in Singapore;
• The applicant does not operate in a manner that is of concern to MAS and is
already regulated and supervised for its compliance with relevant internationally
agreed standards, such as standards established by the Financial Stability
Board, the International Organisation of Securities Commissions and the
Financial Action Task Force ("FATF"); and
• MAS does not have concerns with the business structure of the applicant in
relation to, for example, its ability to comply with regulatory obligations.

Part 2 Identification procedures etc. Division 2 Identification procedures for certain pre-commencement customers
Section 29
(b) after the commencement of this section, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer. Note 1: For suspicious matter reporting obligation, see section 41. Note 2: For tipping-off offences, see section 123. Requirement
(2) The reporting entity must:
(a) take such action as is specified in the AML/CTF Rules; and
(b) do so within the time limit allowed under the AML/CTF
Rules. Civil penalty
(3) Subsection (2) is a civil penalty provision. Interpretation
(4) For the purposes of this section, assume that Part 1 had been in
force at all material times before the commencement of this
section.
80 Anti-Money Laundering and Counter-Terrorism Financing Act 2006 Identification procedures etc.

Part 2
Identification procedures for certain low-risk services Division 3
Section 30
Division 3-Identification procedures for certain low-risk
services
30 Identification procedures for certain low-risk services
Scope
(1) This section applies to the provision by a reporting entity of a
designated service to a customer if, under the AML/CTF Rules, the
service is taken to be a low-risk designated service. (2) Sections 32 and 34 do not apply to the provision by the reporting
entity of the designated service to the customer. Note: For special rules about verification of identity etc., see section 31.
31 Verification of identity of low-risk service customer etc. Scope
(1) This section applies to a reporting entity if:
(a) at a particular time (the relevant time), the reporting entity
commences to provide a designated service to a customer;
and
(b) under the AML/CTF Rules, the service is taken to be a
low-risk designated service; and
(c) at the relevant time or a later time, a suspicious matter
reporting obligation arises for the reporting entity in relation
to the customer.

Note: Where a reporting entity is unable to ascertain whether the circumstances in
19.3(17)(a) applies, the reporting entity can assume that the transaction was
carried out by the customer.
19.4 If the threshold transaction arises under a designated service that is of a kind
described in item 3 of table 1 in subsection 6(2) of the AML/CTF Act, the
reference to 'customer' in subparagraphs 19.3(2) to 19.3(14) inclusive will
be taken, in the first instance, to refer only to the holder of the account and
the signatory (if any) conducting the transaction in relation to the account,
provided that:
(1) if there are other signatories to the account, the AUSTRAC CEO may
require the reporting entity to give to the AUSTRAC CEO, in the
form of a supplement to the subsection 43(2)

Explanation: FSMA Part 9 establishes an *extraterritorial* SG licensing regime for digital token service providers (DTSPs): an SG-incorporated entity providing DT services *outside Singapore* must hold a DTSP licence. The AU AML/CTF Act 2006 is *territorial* but applies to designated services provided in Australia or to Australian residents. The two regimes therefore overlap when an SG-incorporated DTSP services Australian customers — both jurisdictions assert AML/CFT-style obligations on the same service flow. Unlike the structural non-transit conflicts (e.g. MiCA-vs-DAP), this overlap is *operationally resolvable*: the AU and SG AML frameworks are not contradictory — they impose parallel CDD, transaction-monitoring and reporting obligations that a well-designed compliance programme can satisfy simultaneously. The resolution is compliance-engineering: implement a single CDD pipeline that meets both the SG DTSP guidelines and the AUSTRAC-administered AML/CTF Rules (operational floor), and submit reports to both AUSTRAC and MAS. Severity is medium because the duplication is real (two licences, two supervisors, two reporting cadences) but not legally irreconcilable.

Operate a unified CDD policy that meets the higher floor of both regimes (typically AUSTRAC's prescriptive Rules) and report into each supervisor separately.

Where possible, rely on AUSTRAC–MAS information-sharing arrangements to avoid double-reporting of suspicious-matter equivalents.

SG entity is genuinely SG-incorporated and within FSMA's extraterritorial scope (not merely SG-marketed).

AU customers receiving the service are AU residents — purely AU-tourist outbound transactions are out of scope.


Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

181. Countries should ensure that ordering institutions (whether a VASP or other
obliged entity such as a FI) involved in a VA transfer, obtain and hold required and
accurate originator information and required beneficiary information and submit
the information to beneficiary institutions (whether a VASP or other obliged entity,
such as a FI), if any. Further, countries should ensure that beneficiary institutions
(whether a VASP or other obliged entity, such as a FI) obtain and hold required (but
not necessarily accurate44) originator information and required and accurate
beneficiary information, as set forth in INR. 16 (see Box 4 below).
Box 4. Specific wording definition
Wire transfer rules for VAs/VASPs in INR. 15-7(b)
"Recommendation 16": "Countries should ensure that originating
VASPs obtain and hold required and accurate originator information and
required beneficiary information on virtual asset transfers".
Footnote: "As defined in INR. 16, paragraph 6, or the equivalent
information in a virtual asset context."
Glossary of specific terms used in INR. 16
Accurate: is used to describe information that has been verified for
accuracy.
Interpretive Note to Recommendation 16

Explanation: DORA governs ICT risk management, operational resilience and third-party ICT risk for EU financial entities. FATF Recommendation 16 is an AML/CFT standard on wire/VA transfer originator and beneficiary information. The two cover disjoint subject matters; no plausible single-firm obligation under one contradicts an obligation under the other. Textbook easy negative.

DORA's ICT operational requirements rendered FATF travel-rule data transmission technically infeasible — not the case; travel-rule transmission is an ordinary application-layer obligation.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

LTD Question 1. MAS seeks comments on the proposed amendments to the Payment Services
Regulations.
1. The term safeguarding institution needs to be defined for the purposes of
Regulation16C. Since DPTSP can self custodize it would be good to have a clear
definition of safeguarding customer's assets. The term "safeguarding" is also not
used/defined in Securities and Futures Act or in the Securities and Futures
(licensing and conduct of business) regulations in the context of customer
assets.
2. It is not clear in these amendments whether a PSA license is a blanket license
that will allow the licensee to conduct all of the digital payment token services
(i.e. broking dealing in DPT, DPT Exchange, DPT Custody) under one PSA license 2 April 2024 | 26
or would a licensee be granted a PSA license for specific digital payment token
services? Trying to draw an analogy here from the Capital Market Services
License (CMSL) where each CMSL holder is given a license outlining the activities
that they can do under the CMSL license.
8 Interactive Brokers Question 1.

Explanation: EU_PSD2 (Article 97 strong customer authentication for payment service providers in the EU) and SG_PSA_GENERAL (Singapore Payment Services Act regulations / safeguarding consultation). Both broadly regulate payment services but apply in non-overlapping jurisdictions and address different specific obligations (SCA vs safeguarding of customer assets). No obligation conflict on the cited evidence.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Explanation: The evidence for the Australian regime (AU_ATO_CRYPTO) focuses on the taxation of crypto assets and general regulatory reform (chunk_id e6bb47e92e88e16c::567::36c4). The evidence for the European regime (EU_PSD2) focuses on payment service provider authentication and security standards for electronic payments (chunk_id adb1a81b9cecaf8c::64f::f5ad). The obligations and subject matter of the two regimes are distinct; one regulates tax compliance for crypto assets, while the other regulates security and authentication for payment services. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


3.1 Standard AFSL Obligations
Australian financial services licence
(a) A platform provider must hold an AFSL authorising them to issue and deal in digital asset facilities.
(b) A platform provider is exempt from holding an AFSL for digital asset facilities if:
(i) the total value of platform entitlements held by any one client of the platform provider does
not exceed $1,500 at any one time; and
(ii) the total amount of assets held by the platform provider does not exceed $5 million at any
time.
Info Box 3 Low value exemption
The risks with digital asset facilities are correlated to the size and scale of the asset holding role of
the platform provider. Accordingly, a 'low-value facility' exemption would be introduced, similar to
the 'low value facility' exemption for non-cash payment facilities. It would apply to digital asset
facilities holding less than $1,500 per customer and less than $5 million in total.40 This exemption
is intended to allow for innovation and experimentation in the early stages of developing a novel
service offering.

2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

30 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). monitoring the risks posed by these new business models, and will take the
necessary steps to mitigate the risks posed. III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The Australian regime (Regime A) focuses on the licensing requirements for financial services providers (AFSL) and specific obligations for platform providers, brokers, and intermediaries dealing in digital asset facilities within Australia. The Singaporean regime (Regime B) discusses MAS enforcement actions against ICO issuers and exchanges, and the intention to expand legislation to align with international AML/CFT standards. The passages describe distinct regulatory actions and enforcement contexts (MAS warnings vs. AFSL licensing obligations) rather than conflicting obligations. The Australian text outlines a specific exemption for 'low value facility' providers (chunk 550958b067dc6726::41f::546c), which is a design choice rather than a conflict with Singaporean law. Therefore, the regimes regulate different aspects of the digital asset ecosystem and do not impose conflicting obligations.


Article 16
Prevention and detection of market abuse
1. Market operators and investment firms that operate a trading venue shall establish and maintain effective arrange
ments, systems and procedures aimed at preventing and detecting insider dealing, market manipulation and attempted
insider dealing and market manipulation, in accordance with Articles 31 and 54 of Directive 2014/65/EU. A person referred to in the first subparagraph shall report orders and transactions, including any cancellation or
modification thereof, that could constitute insider dealing, market manipulation or attempted insider dealing or
market manipulation to the competent authority of the trading venue without delay.
2. Any person professionally arranging or executing transactions shall establish and maintain effective arrangements,
systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable
suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a trading
venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the
person shall notify the competent authority as referred to in paragraph 3 without delay.
3.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: The EU_MAR regime regulates market abuse, specifically insider dealing and market manipulation (chunk 5cc4a27bc578287a::4ee::5950). The SG_AML regime regulates money laundering and terrorism financing (chunk 3d521e61e49aaf46::38f::e615). The obligations in the EU_MAR passage relate to detecting and reporting suspicious orders and transactions that constitute market abuse, whereas the SG_AML passage requires officers and employees to be trained on AML/CFT laws and detecting suspicious transactions. These are distinct regulatory domains; the EU_MAR obligations do not impose a specific conflict with the SG_AML training requirements, nor do they overlap in a way that creates a structural or operational conflict.


Harmonizing compliance standards for both financial institutions and payment
service providers is the best way to combat the global rise in money laundering,
terrorism financing, and sanctions evasion, to plug gaps in overseeing transfers of
value. Preventing SG-licensed entities from relying on foreign-licensed institutions 30 May 2025 | 40
with only money-transmitter-type licenses would be a useful step towards those
larger goals. Question 7. Reliance on Third Party. MAS seeks comments on the proposed amendments to
the other AML/CFT notices. No comment. Question 8. Correspondent Account Services. MAS seeks comments on whether the proposed
requirements for Correspondent Account Services set out in paragraph 5.6 would
be applicable to the sector. (Please refer to paragraph 12 of the draft FSM Notice). For correspondent account services, the licensee is relying on their client's standard
of compliance in a manner similar to the "Reliance on Third Party" issues discussed
in previous questions.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The EU_PSD2 passages focus on technical security standards for payment authentication (strong customer authentication, personalised security credentials) and governance requirements for payment institutions (Article 97, Article 98, Article 11). In contrast, the SG_MAS_AML_GENERAL passages discuss the regulatory framework for combating money laundering and terrorism financing, specifically targeting Digital Payment Token (DPT) providers and financial institutions. The SG passages reference 'AML/CFT compliance function,' 'targeted financial sanctions,' and 'robust licensing fit and proper checks,' which are distinct from the technical authentication obligations in EU_PSD2. The obligations in the EU regime do not push against the obligations in the SG regime; rather, they regulate different domains (payment security vs. financial crime prevention).


6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Explanation: EU_MICA_RTS (EU technical standards for CASP authorisation under MiCA) and SG_PSA_DPT (MAS's PSN02 AML notice for DPT licensees under Singapore's PSA). Both apply to crypto-asset service providers but in non-overlapping jurisdictions; the cited passages address different specific obligations (CASP authorisation requirements vs PSN02 AML obligations).


45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

94. The FATF Standards, including the definitions of virtual assets and VASPs, represent
a minimum standard for countries to introduce. In line with the RBA, countries may
choose to extend their AML/CFT regimes to include other digital assets and entities,
beyond the FATF definition of virtual asset and VASP. Such a determination should
be made on the basis of a ML/TF risk assessment, with consideration of the
challenges associated with regulatory divergence.

UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS  37
PART THREE:
APPLICATION OF FATF STANDARDS TO COUNTRIES AND
COMPETENT AUTHORITIES

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

3.5 A wide range of stablecoins currently exist, varying in terms of their asset-
pegging, as well as the mechanism that upholds the stability of the stablecoins' value
against the pegged asset(s). MAS intends to focus its regulatory regime on:
Single-currency pegged stablecoins (SCS) - As compared to other types of
stablecoins (such as those pegged to a basket of currencies or other
assets such as commodities), SCS has a stronger use case for payment and
settlement.
Non-SCS will continue to be subject to the existing DPT regime under the
PS Act. MAS views such stablecoins as being less stable in nominal value
and should be treated differently from SCS.
In addition, even among SCS, there is variation in the stabilisation
mechanism. MAS views stablecoins which are algorithmically-pegged,
unbacked or backed by other cryptocurrencies to be more susceptible to
volatility in value. Correspondingly, such stablecoins will also continue to
be treated as DPTs.
SCS issued in Singapore - The immediate priority of MAS is to elevate the
standard of SCS issued in Singapore. Our regulatory perimeter is thus
scoped based on MAS' ability to directly impose requirements on the
reserve management, redemption policies and prudential standards of
the SCS issuer.

Explanation: The FATF VASP regime (Regime A) establishes a global minimum standard for Virtual Asset Service Providers (VASPs) and Virtual Assets (VAs), emphasizing a risk-based approach and technology neutrality. The Singapore Stablecoin regime (Regime B) focuses specifically on regulating Single-Currency Stablecoins (SCS) issued in Singapore under the Payment Services Act. The passages show that Regime B applies a specific, narrower regulatory perimeter to SCS (chunk_id 58f45cd2ef3de201::36c::e2f6, chunk_id 33d059aa86716ddd::4ed::8511) while noting that non-SCS remain under the Digital Payment Token (DPT) regime. Regime A allows countries to extend their AML/CFT obligations beyond the minimum FATF definition of VASP (chunk_id 85240528438654b9::284::b4a8) and permits countries to not impose a separate licensing system for entities already licensed as financial institutions performing VASP activities (chunk_id ba862e1f095bceac::1a6::1f0e). The regimes are aligned in their intent to regulate digital assets and service providers, but Regime B's specific focus on SCS and its application within the existing PS Act framework does not create a structural conflict with the FATF's general VASP standards. Instead, the Singapore regime appears to be implementing the FATF standards within its specific stablecoin context.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

Explanation: The EU MiCA passages (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::34a::74e3) regulate the authorisation, information requirements, and public register obligations for Crypto-Asset Service Providers (CASPs). The Basel III passages (32afd37cade34f84::34b::8d30, 32afd37cade34f84::34e::4d5c) regulate banking sector capital adequacy, leverage ratios, and the treatment of provisions and expected losses. The obligations in MiCA regarding CASP licensing and reporting do not overlap with the Basel III framework's banking capital and risk management requirements. Therefore, the regimes are in different domains and do not conflict.


(27) Directive (EU) 2022/2556 of the European Parliament and of the Council of 14 December 2022 amending Directives 2009/65/EC,
2009/138/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU, 2014/65/EU, (EU) 2015/2366 and (EU) 2016/2341 as regards digital
operational resilience for the financial sector (see page 153 of this Official Journal).

Explanation: EU_EMD2 (EU E-Money Directive 2 — EMI authorisation for issuance/redemption of e-money) and SG_PSA_DPT (SG Payment Services Act DPT-service licensing). Both regulate issuer/service-provider licensing for similar payment instruments but in non-transitable jurisdictional frameworks. An EU EMI cannot issue under SG's PSA framework without separate authorisation. Same non-transit pattern. Severity medium because the instruments (e-money vs DPT) are not directly equivalent; the structural conflict is narrower than CASP-vs-CASP.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

Explanation: AU_AML_CTF (Australian AML/CTF Act — AUSTRAC reporting framework) and INT_FATF_VASP (FATF VASP guidance — AML/CFT standards for VAs and VASPs). Australia's AML/CTF Act applies FATF-aligned obligations on digital-currency exchanges (VASP equivalent). Reinforcing.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Licensees should also establish internal processes to determine the impact of the
inaccuracies on its customers to determine whether additional actions should be taken. For
example, licensees may wish to inform customers of the inaccuracy. MAS does not intend to propose
additional requirements in FSM-N33 Notice relating to inaccurate representations regarding the
scope of a licensee's regulation by MAS at this juncture. 30 May 2025 | 21
8. Guidelines applicable to licensees
8.1. MAS proposed for guidelines that apply to all financial institutions to also be applied to all licensees. This includes the Guidelines on Fit and Proper Criteria ("F&P Guidelines"), TRM Guidelines,
Guidelines on Business Continuity Management and Guidelines on Outsourcing.
8.2. Respondents are generally supportive of the application of the aforementioned guidelines on
licensees.
8.3. Several respondents suggested to expand the cybersecurity component within the TRM Guidelines
to include specific risks associated with digital tokens.
8.4.

Explanation: The evidence from the AU_ATO_CRYPTO regime focuses on the Australian Taxation Office's (ATO) approach to token mapping, tax compliance, and the regulation of crypto assets within Australia (chunk_id e6bb47e92e88e16c::567::36c4). The evidence from the MAS_TRM regime focuses on the Monetary Authority of Singapore's (MAS) response to feedback regarding guidelines for licensees, including the application of Fit and Proper Criteria and Business Continuity Management (chunk_id 20d526d712753652::403::be97). The two regimes regulate distinct geographic jurisdictions (Australia vs. Singapore) and address different regulatory domains (taxation vs. financial services licensing and conduct). There is no evidence of a specific obligation in one regime conflicting with a specific obligation in the other.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access control policies and cryptography (chunk_id 3c9eb3a25c93f394::474::4786). The SG_PDPA passage outlines the requirements for consent in the collection, use, and disclosure of personal data (chunk_id 0e996ae99839f19e::37b::85a8). The obligations in NIS2 relate to ICT security measures, while the obligations in the PDPA relate to data protection and consent. These are distinct regulatory domains; there is no specific obligation in NIS2 that pushes against a specific obligation in the PDPA.


2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: EU_MICA_RTS (technical standards for CASP authorisation/notification under MiCA) and SG_FSMA_DTSP (Singapore's DTSP licensing under the FSM Act) both regulate crypto-asset service providers but in non-overlapping jurisdictions. The MiCA RTS apply to EU CASPs; the SG DTSP framework to SG-licensed digital token service providers. Different jurisdictional perimeters; no obligation conflict on cited passages.


Article 63
Cooperation with AMLA
FIU and supervisory authorities shall cooperate with AMLA and shall provide it with all the information necessary to allow
it to carry out its duties under this Directive and under Regulations (EU) 2024/1624 and (EU) 2024/1620.
SECTION 2
Cooperation with other authorities and exchange of confidential information

Article 62
Communication of the list of the competent authorities
1. In order to facilitate and promote effective cooperation, and in particular the exchange of information, Member States
shall communicate to the Commission and AMLA:
(a) the list of supervisors responsible for overseeing the compliance of the obliged entities with Regulation (EU)
2024/1624, as well as, where relevant, name of the public authority overseeing self-regulatory bodies in their
performance of supervisory functions under this Directive, and their contact details;
(b) the contact details of their FIU;
(c) the list of other competent national authorities.
2. For the purposes of paragraph 1, the following contact details shall be provided:
(a) a contact point or, failing that, the name and role of a contact person;
(b) the email and phone number of the contact point or, failing that, the professional email address and phone number of
the contact person.
ELI: http://data.europa.eu/eli/dir/2024/1640/oj 79/94

EN
3. Member States shall ensure that the information provided to the Commission and AMLA pursuant to paragraph 1 is
updated as soon as a change takes place.
4. AMLA shall publish a register of the authorities referred to in paragraph 1 on its website and facilitate the exchange of
information referred to in paragraph 2 between competent authorities. The authorities in the register shall, within the scope
of their powers, serve as a contact point for the counterpart competent authorities. FIUs and supervisory authorities shall
also serve as a contact point for AMLA.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

3.1 This Notice is based on the following principles, which shall serve as a guide for all banks
in the conduct of their operations and business activities:
(a) A bank shall exercise due diligence when dealing with customers, natural persons
appointed to act on the customer's behalf, connected parties of the customer and
beneficial owners of the customer.
(b) A bank shall conduct its business in conformity with high ethical standards, and
guard against establishing any business relations or undertaking any transaction,
including a digital token transaction, that is or may be connected with, or facilitates
or may facilitate money laundering or terrorism financing.
(c) A bank shall, to the fullest extent possible, assist and cooperate with the relevant
law enforcement authorities in Singapore to prevent money laundering and
terrorism financing.

Explanation: EU_AMLA (EU's new Anti-Money Laundering Authority under AMLD6 — supervisory cooperation framework) and SG_AML (MAS Notice 314 + MAS Notice 626 AML/CFT frameworks for life insurers and banks). Both implement AML/CFT supervisory architecture in their respective jurisdictions consistent with FATF standards. Reinforcing rather than conflicting.