Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

For example, personal data collected for the purpose of complying
with this Regulation should not be further processed in a way that is incompatible with Directive 95/46/EC. In
particular, further processing of personal data for commercial purposes should be strictly prohibited. The fight
against money laundering and terrorist financing is recognised as an important public interest ground by all
Member States. Therefore, in applying this Regulation, the transfer of personal data to a third country which does
not ensure an adequate level of protection in accordance with Article 25 of Directive 95/46/EC should be
permitted in accordance with Article 26 thereof. It is important that payment service providers operating in
multiple jurisdictions with branches or subsidiaries located outside the Union should not be prevented from
transferring data about suspicious transactions within the same organisation, provided that they apply adequate
safeguards. In addition, the payment service providers of the payer and of the payee and the intermediary
payment service providers should have in place appropriate technical and organisational measures to protect
personal data against accidental loss, alteration, or unauthorised disclosure or access.

45. The purpose of adding the new definitions of VA and VASP to the FATF Glossary was
to broaden the applicability of the FATF Standards to encompass new types of
digital assets and providers of certain services in those assets. It was not intended
to subtract from the existing definitions of "funds", "funds or other assets", or from
the scope of the various financial services included under the definition of a
"financial institution" in the FATF Standards.

80. Despite the many and frequently changing marketing terms and innovative
business models developed in this sector, the FATF envisions very few VA
arrangements without VASPs involved at some stage if countries apply the
definition correctly. Countries should take particular care to assess any claims that
businesses may make as to models of decentralization or distributed services, and
conduct their own assessment of the business model in line with its risk and their
ability to mitigate these risks.

81. As previously stated, the FATF Standards are technology neutral. As such, the FATF
does not seek to regulate the technology that underlies VAs or VASP activities.
Rather the FATF seeks to regulate natural or legal persons behind such technologies

32  UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
that conduct as a business the aforementioned VASP activities on behalf of another
natural or legal person.

Explanation: EU_GDPR (Article 44+ cross-border data transfer restrictions, plus general lawful-basis requirements) and INT_FATF_VASP (FATF VASP standards mandating originator/beneficiary information collection and sharing for VA transfers — travel rule). When an EU CASP/VASP implements the FATF travel rule, it must share personal data with non-EU counterparty VASPs; GDPR Chapter V restrictions engage. Operationally resolvable via GDPR Art. 6(1)(c) (legal obligation under EU TFR) + Chapter V transfer mechanism (SCCs / derogation for important reasons of public interest). Same shape as the labelled EU TFR ↔ EU GDPR conflict in the careful cohort, generalised to the international FATF standard.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The evidence from AU_TREASURY_DAP discusses the Australian government's 'token mapping' exercise to identify how crypto assets fit into existing financial services laws and the subsequent development of a licensing framework for crypto asset service providers (chunk_id=d75262e404517e0c::47b::7c9f). The evidence from SG_MAS_AML_GENERAL focuses on the Monetary Authority of Singapore's (MAS) application of a risk-based approach to supervision of Digital Payment Token (DPT) providers, including robust licensing fit and proper checks and inspections to combat money laundering and terrorism financing (chunk_id=b49627bb889ef1d9::1b6::0802). The two regimes address the regulation of crypto assets from different jurisdictions and angles (licensing frameworks vs. AML/CFT supervision), with no specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are in non_conflict.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

We also acknowledge that the SCS sector is still relatively nascent and therefore,
introducing a risk-based capital framework would entail additional compliance costs. On
the other hand, we wish to highlight that their growth is remarkably fast, bringing
significant opportunities, but also challenges to market integrity and consumer protection
which can be mitigated by a robust regulatory framework. The recent developments in the crypto market and the price volatility of crypto assets,
underscore the need for a robust regulatory framework, something that MAS has
highlighted as well. Hence, given that banks which offer SCS issuance services are subject 15 August 2023 | 61
to a risk-based capital framework, we believe that non-banks should be subject to the
same requirements. Meeting the same risk-based capital requirements would ensure
market stability and it will be in line with the MAS'S intention to impose higher financial
and prudential standards on SCS issuers compared to other payment service providers, in
line with the "same activities, same risk, same regulation" principle.

Explanation: INT_BASEL_GENERAL (Basel III leverage ratio / capital framework) and SG_MAS_PRUDENTIAL_CRYPTO (MAS's risk-based capital framework for SCS issuers, considering Basel principles). MAS explicitly aligns its prudential approach with Basel; the cited B passage acknowledges introducing a risk-based capital framework consistent with Basel-style principles. Reinforcing rather than contradicting.


This licence
allows you to copy, distribute and adapt this work, provided you attribute the work and do not suggest that
APRA endorses you or your work. To view a full copy of the terms of this licence, visit
https://creativecommons.org/licenses/by/3.0/au/
APRA June 2024 1 About this guide
Prudential practice guides (PPGs) share APRA's views on sound practice. They discuss requirements from
legislation, regulations or APRA's prudential standards, but do not themselves create enforceable requirements. This PPG offers guidance to APRA-regulated entities to aid compliance with Prudential Standard CPS 230
Operational Risk Management (CPS 230). CPS 230 sits within the Risk Management pillar of APRA's framework,
as a supporting standard. Effective operational risk management is essential to ensure the resilience of an entity, and its ability to maintain
critical operations through disruptions. Proportionality
CPS 230 applies to every APRA-regulated entity.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

Explanation: AU_APRA_CPS234 (APRA Information Security prudential standard) and INT_BASEL_GENERAL (Basel III framework — capital adequacy, leverage ratio). Both prudential frameworks but addressing different specific concerns — APRA CPS 234 is information-security and cybersecurity; Basel III is capital adequacy. Different focuses; no direct overlap on the cited passages.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access controls and ICT security measures (chunk_id 3c9eb3a25c93f394::474::4786). The INT_IOSCO_GENERAL passage outlines the IOSCO Principles and their role in establishing standards for securities regulation and market oversight (chunk_id f173909614befd49::455::1a1a). The obligations in these regimes regulate distinct domains: EU_NIS2 focuses on digital operational resilience and ICT security, while INT_IOSCO_GENERAL focuses on securities market regulation and disclosure. There is no specific obligation in one regime that pushes against a specific obligation in the other.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Article 6
ICT risk management framework
1. Financial entities shall have a sound, comprehensive and well-documented ICT risk management framework as part
of their overall risk management system, which enables them to address ICT risk quickly, efficiently and comprehensively
and to ensure a high level of digital operational resilience.
2. The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools
that are necessary to duly and adequately protect all information assets and ICT assets, including computer software,
hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres
and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks
including damage and unauthorised access or usage.
3. In accordance with their ICT risk management framework, financial entities shall minimise the impact of ICT risk by
deploying appropriate strategies, policies, procedures, ICT protocols and tools. They shall provide complete and updated
information on ICT risk and on their ICT risk management framework to the competent authorities upon their request.
4.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU DORA ICT operational-resilience regulation operate in disjoint regulatory domains at the obligation level. EU AML supervisor vs EU ICT-resilience regulation — different subject matters. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: FATF_R16 (FATF Recommendation 16 — VA/VASP AML travel rule) and INT_IOSCO_GENERAL (IOSCO securities regulation objectives and principles). Both are international standards bodies addressing financial regulation from different angles (AML/CFT for VASPs and securities markets / investor protection); FATF and IOSCO publish coordinated guidance on crypto-related issues. Complementary pillars of international financial regulation.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

Explanation: The evidence from Regime A (AU_AML_CTF) outlines obligations for reporting suspicious matters and threshold transactions to AUSTRAC (chunk_id 254ca2d92d196180::2ac::a5fe). The evidence from Regime B (INT_BASEL_CRYPTO) defines bank exposures for capital requirements and discusses risk-weighting methodologies (chunk_id 32afd37cade34f84::3a4::1a5b). The obligations in Regime A relate to financial crime reporting and compliance, while the obligations in Regime B relate to prudential capital adequacy and risk management. The regimes regulate distinct aspects of financial activity and do not impose conflicting obligations on the same conduct.


A The proposed updates to INFO 225
Key points
Information Sheet 225 Crypto-assets (INFO 225), as it is currently named,
provides guidance to persons offering products and services in relation to
crypto- and digital assets. It sets out our views regarding when a crypto- or
digital asset, or related product, may be a financial product. It also
discusses when someone may be providing a financial service that requires
a licence from ASIC. We consider that now is an appropriate time to update INFO 225. Digital
asset markets have evolved significantly in recent years, with many new
products and services being offered. We propose to update INFO 225, subject to feedback from this
consultation. Draft updated INFO 225 includes a range of worked
examples. See the draft in the attachment to this consultation paper. Background to INFO 225
1 Digital asset markets have evolved significantly over the last 10 to 15 years,
since the bitcoin white paper was first published.

CONSULTATION PAPER 381
Updates to INFO 225:
Digital assets: Financial
products and services
December 2024
About this paper
This consultation paper is about ASIC's guidance on digital assets and
related products. It sets out our proposals to update Information Sheet 225 Crypto-assets
(INFO 225) to provide further guidance about our interpretation of how the
Corporations Act 2001 applies to crypto- and digital assets. It also sets out
our proposals for licensing entities that provide financial services in relation
to crypto- and digital assets that are financial products. Note: Draft updated Information Sheet 225 Digital assets: Financial products and services
is available on our Consultations webpage under CP 381. About ASIC regulatory documents
In administering legislation ASIC issues the following types of regulatory
documents. Consultation papers: seek feedback from stakeholders on matters ASIC
is considering, such as proposed relief or proposed regulatory guidance. Regulatory guides: give guidance to regulated entities by:
 explaining when and how ASIC will exercise specific powers under
legislation (primarily the Corporations Act)
 explaining how ASIC interprets the law
 describing the principles underlying ASIC's approach
 giving practical guidance (e.g. describing the steps of a process such
as applying for a licence or giving practical examples of how
regulated entities may decide to meet their obligations).

8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Explanation: EU_REVERSE_SOLICITATION and AU_ASIC_CRYPTO (ASIC's INFO 225 framework — when crypto is a financial product). An AU AFS-licensee serving EU clients depends on whether the interaction qualifies for reverse solicitation — fact-sensitive determination. Low severity because AFSL-only firms generally can't actively solicit EU clients regardless.


Article 57
Voluntary classification of e-money tokens as significant e-money tokens
1.
An issuer of an e-money token, authorised as a credit institution or as an electronic money institution, or applying
for such authorisation, may indicate that it wishes for its e-money token to be classified as a significant e-money token.
In that case, the competent authority shall immediately notify such request of the issuer to EBA, to the ECB and, in the
cases referred to in Article 56(3), second subparagraph, to the central bank of the Member State concerned.
In order for the e-money token to be classified as significant under this Article, the issuer of the e-money token shall
demonstrate, through a detailed programme of operations, that it is likely to meet at least three of the criteria set out in

(66)
Issuers of e-money tokens should be authorised either as a credit institution under Directive 2013/36/EU or as an
electronic money institution under Directive 2009/110/EC. E-money tokens should be deemed to be 'electronic
money' as that term is defined in Directive 2009/110/EC and their issuers should, unless specified otherwise in
this Regulation, comply with the relevant requirements set out in Directive 2009/110/EC for the taking up,
pursuit and prudential supervision of the business of electronic money institutions and the requirements on
issuance and redeemability of e-money tokens. Issuers of e-money tokens should draw up a crypto-asset white
paper and notify it to their competent authority. Exemptions regarding limited networks, regarding certain
transactions by providers of electronic communications networks and regarding electronic money institutions
issuing only a limited maximum amount of electronic money, based on the optional exemptions specified in
Directive 2009/110/EC, should also apply to e-money tokens. However, issuers of e-money tokens should still be
required to draw up a crypto-asset white paper in order to inform buyers about the characteristics and risks of
the e-money tokens and should also be required to notify the crypto-asset white paper to the competent authority
before its publication.

Article 59
Authorisation
1.
A person shall not provide crypto-asset services, within the Union, unless that person is:
(a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with

Article 63; or
(b) a credit institution, central securities depository, investment firm, market operator, electronic money institution,
UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset
services pursuant to Article 60. EN
L 150/114 2. Crypto-asset service providers authorised in accordance with Article 63 shall have a registered office in a Member
State where they carry out at least part of their crypto-asset services. They shall have their place of effective management
in the Union and at least one of the directors shall be resident in the Union.
3. For the purposes of paragraph 1, point (a), other undertakings that are not legal persons shall only provide crypto-
asset services if their legal form ensures a level of protection for third parties' interests equivalent to that afforded by
legal persons and if they are subject to equivalent prudential supervision appropriate to their legal form.
4. Crypto-asset service providers authorised in accordance with Article 63 shall at all times meet the conditions for
their authorisation.
5.

Explanation: Both regimes are parts of the same EU Regulation (MiCA). Title IV regulates issuers of e-money tokens; Title V regulates crypto-asset service providers. They apply to different roles in the crypto-asset value chain — an EMT issuer may also be a CASP, in which case it must comply with both Titles, but the obligations are layered rather than colliding. Title V Article 60 explicitly contemplates EMIs (which Title IV authorises as EMT issuers) acting as CASPs under their existing prudential authorisation. Within-regulation hard negative.

MiCA Level-2 RTS imposed a Title-IV-specific obligation that contradicted a Title-V-specific obligation — Level-2 work is coordinated to avoid this.


19 For instance, in 24 May 2018, MAS directed an ICO issuer to stop offering its digital tokens and to return all funds
received from Singapore-based investors. MAS also warned eight digital token exchanges in Singapore not to facilitate
trading in digital tokens that are securities or futures contracts without MAS' authorisation
(https://www.mas.gov.sg/news/media-releases/2018/mas-warns-digital-token-exchanges-and-ico-issuer). In January
2019, MAS warned an ICO issuer not to proceed with its securities token offering in Singapore until it can comply with
regulatory requirements (https://www.mas.gov.sg/news/media-releases/2019/mas-halts-securities-token-offering-for-
regulatory-breach). III-1-3 In light of the enhanced FATF standards for virtual assets (issued in June 2019),
MAS has announced its intention to expand the scope of legislation, including the
PS Act, to cover additional activities of virtual assets by service providers so as to
fully align with international AML/CFT requirements.

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access controls and ICT security within the European Union (chunk 3c9eb3a25c93f394::474::4786). The SG_FOUNDATIONAL_LEGISLATION passage discusses the Monetary Authority of Singapore's (MAS) enforcement actions against Initial Coin Offerings (ICOs) and digital token exchanges, as well as its intention to align with FATF standards (chunk b49627bb889ef1d9::3ef::7168). The obligations and regulatory domains are distinct: one pertains to EU-wide ICT security standards, while the other pertains to Singaporean securities and virtual asset regulation. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


67 See Annex 10 of Basel II (June 2006) for an overview of methodologies for the capital treatment of transactions secured by
financial collateral under the standardised and IRB approaches.

68 Alternatively, banks with appropriate supervisory approval may instead use the Internal Model Method to determine the
exposure amount, taking into account collateral.
Basel III: Finalising post-crisis reforms 35

(ii) On-balance sheet netting

135. Where banks have legally enforceable netting arrangements for loans and deposits that meet the
conditions in paragraph 190 they may calculate capital requirements on the basis of net credit exposures
as set out in that paragraph.
(iii) Guarantees and credit derivatives

136. Where guarantees or credit derivatives fulfil the minimum operational conditions set out in
paragraphs 191 to 193, banks may take account of the credit protection offered by such credit risk
mitigation techniques in calculating capital requirements.

4 Standards on capital requirements for banks' equity investments in funds are available at www.bis.org/publ/bcbs266.pdf; and
for capital requirements for bank exposures to central counterparties are set out in Section XI of the counterparty credit risk
standards.
Basel III: Finalising post-crisis reforms 3

A. Individual exposures
Due diligence requirements

Several of the capital requirements introduced by the Committee to mitigate the
risks arising from firm-level exposures among global financial institutions will also help to
address systemic risk and interconnectedness. These include:
Basel III: A global regulatory framework for more resilient banks and banking systems 7  capital incentives for banks to use central counterparties for over-the-counter
derivatives;
 higher capital requirements for trading and derivative activities, as well as complex
securitisations and off-balance sheet exposures (eg structured investment vehicles);
 higher capital requirements for inter-financial sector exposures; and
 the introduction of liquidity requirements that penalise excessive reliance on short
term, interbank funding to support longer dated assets. B. Introducing a global liquidity standard
34. Strong capital requirements are a necessary condition for banking sector stability
but by themselves are not sufficient. A strong liquidity base reinforced through robust
supervisory standards is of equal importance. To date, however, there have been no
internationally harmonised standards in this area.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Consent required
13. Anorganisationmustnot,onorafter2July2014,collect,useor
disclose personal data about an individual unless -
(a) the individual gives, or is deemed to have given, his or her
consent under this Act to the collection, use or disclosure,
as the case may be; or
(b) the collection, use or disclosure (as the case may be)
without the individual's consent is required or authorised
under this Act or any other written law. Provision of consent
14.-(1) An individual has not given consent under this Act for the
collection, use or disclosure of personal data about the individual by
an organisation for a purpose unless -
(a) the individual has been provided with the information
required under section 20; and
(b) the individual provided his or her consent for that purpose
in accordance with this Act.

23 Act 2012 2020Ed. Deemed consent by notification
15A.-(1) This section applies to the collection, use or disclosure
of personal data about an individual by an organisation on or after
1 February 2021.
[40/2020]
(2) Subject to subsection (3), an individual is deemed to consent to
the collection, use or disclosure of personal data about the individual
by an organisation if -
(a) the organisation satisfies the requirements in
subsection (4); and
(b) the individual does not notify the organisation, before the
expiry of the period mentioned in subsection (4)(b)(iii),
that the individual does not consent to the proposed
collection, use or disclosure of the personal data by the
organisation.
[40/2020]
(3) Subsection(2)doesnotapplytothecollection,useordisclosure
of personal data about the individual for any prescribed purpose.
[40/2020]
(4) For the purposes of subsection (2)(a), the organisation must,
before collecting, using or disclosing any personal data about the
individual -
(a) conduct an assessment to determine that the proposed
collection, use or disclosure of the personal data is not
likely to have an adverse effect on the individual;
(b) take reasonable steps to bring the following information to
the attention of the individual:
(i) theorganisation'sintentiontocollect,useordisclose
the personal data;
(ii) the purpose for which the personal data will be
collected, used or disclosed;
(iii) a reasonable period within which, and a reasonable
manner by which, the individual may notify the
organisation that the individual does not consent to

2020Ed. Act 2012 20
(2) An organisation must not -
(a) as a condition of providing a product or service, require an
individual to consent to the collection, use or disclosure of
personal data about the individual beyond what is
reasonable to provide the product or service to that
individual; or
(b) obtain or attempt to obtain consent for collecting, using or
disclosing personal data by providing false or misleading
informationwithrespecttothecollection,useordisclosure
of the personal data, or using deceptive or misleading
practices. (3) Anyconsentgiveninanyofthecircumstancesinsubsection(2)
is not validly given for the purposes of this Act. (4) InthisAct,referencestoconsentgiven,ordeemedtohavebeen
given, by an individual for the collection, use or disclosure of
personal data about the individual include consent given, or deemed
to have been given, by any person validly acting on that individual's
behalf for the collection, use or disclosure of such personal data.

(2) An organisation, on or before collecting personal data about an
individual from another organisation without the individual's
consent, must provide the other organisation with sufficient
information regarding the purpose of the collection to allow that
other organisation to determine whether the disclosure would be in
accordance with this Act. (3) Subsection (1) does not apply if -
(a) the individual is deemed to have consented to the
collection, use or disclosure (as the case may be) under
section 15 or 15A; or
(b) the organisation collects, uses or discloses the personal
data without the individual's consent in accordance with
section 17.
[40/2020]
(4) Despite subsection (3), an organisation must comply with
subsection (5) on or before collecting, using or disclosing personal
data about an individual for the purpose of or in relation to the
organisation -
(a) entering into an employment relationship with the
individual or appointing the individual to any office; or
(b) managingorterminatingtheemploymentrelationshipwith
or appointment of the individual.
[40/2020]

Explanation: The passages for INT_BASEL_CRYPTO focus exclusively on banking capital requirements, risk-weighting exposures, and liquidity standards for financial institutions. The passages for SG_PDPA focus exclusively on the collection, use, and disclosure of personal data, including consent requirements and accountability. The obligations in Regime A relate to financial risk management and prudential supervision, while the obligations in Regime B relate to data protection and privacy. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; they regulate distinct domains of activity.


(7) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information accompanying transfers
of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150, 9.6.2023, p. 1).

(8) Regulation (EU) 2024/1620 of the European Parliament and of the Council of 31 May 2024 establishing the Authority for
Anti-Money Laundering and Countering the Financing of Terrorism and amending Regulations (EU) No 1093/2010, (EU)
No 1094/2010 and (EU) No 1095/2010 (OJ L, 2024/1620, 19.6.2024, http://data.europa.eu/eli/reg/2024/1620/oj).

(8) The Union's anti-money laundering and countering the financing of terrorism framework (AML/CFT) extends the
scope of obliged entities subject to AML/CFT rules to crypto-asset service providers regulated by Regulation
(EU) 2023/1114. In addition, Regulation (EU) 2023/1113 of the European Parliament and of the Council(5)
extends the obligation of payment service providers to accompany transfers of funds with information on the payer
and the payee to crypto-asset service providers in order to ensure the traceability of transfers of crypto-assets for the
purpose of fighting against money laundering and financing of terrorism.

Article 3(1), point (16)(h), of that Regulation;
___________
(*) Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in
crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives
2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40).';
EN
L 150/32 (d) the following point is added:
'(20) "self-hosted address" means a self-hosted address as defined in Article 3, point (20), of Regulation (EU)
2023/1113 of the European Parliament and of the Council (*).
___________
(*) Regulation (EU) 2023/1113 of the European Parliament and of the Council of 31 May 2023 on information
accompanying transfers of funds and certain crypto-assets and amending Directive (EU) 2015/849 (OJ L 150,
9.6.2023, p. 1).';
(3) in Article 18, the following paragraphs are added:
'5.

This Regulation shall not apply to a transfer of funds where any of the following conditions is met:
(a) it involves the payer withdrawing cash from the payer's own payment account;
(b) it constitutes a transfer of funds to a public authority as payment for taxes, fines or other levies within a Member
State;
(c) both the payer and the payee are payment service providers acting on their own behalf;
(d) it is carried out through cheque images exchanges, including truncated cheques. This Regulation shall not apply to a transfer of crypto-assets where any of the following conditions is met:
(a) both the originator and the beneficiary are crypto-asset service providers acting on their own behalf;
(b) the transfer constitutes a person-to-person transfer of crypto-assets carried out without the involvement of a crypto-
asset service provider. Electronic money tokens, as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114, shall be treated as crypto-
assets under this Regulation.

) 2023/1114, where performing one or more crypto-asset services as defined in Article 3(1),
point (16), of that Regulation;
(16) 'intermediary crypto-asset service provider' means a crypto-asset service provider that is not the crypto-asset service
provider of the originator or of the beneficiary and that receives and transmits a transfer of crypto-assets on behalf
of the crypto-asset service provider of the originator or of the beneficiary, or of another intermediary crypto-asset
service provider;
(17) 'crypto-asset automated teller machines' or 'crypto-ATMs' means physical or on-line electronic terminals that enable
a crypto-asset service provider to perform, in particular, the activity of transfer services for crypto-assets, as referred
to in Article 3(1), point (16)(j), of Regulation (EU) 2023/1114;
(18) 'distributed ledger address'

11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

1. General remarks
The Basel III framework is a central element of the Basel Committee's response to the global financial crisis.
It addresses a number of shortcomings with the pre-crisis regulatory framework and provides a regulatory
foundation for a resilient banking system that supports the real economy.
The Committee's finalisation of the Basel III reforms1 complements the improvements made to
the global regulatory framework from the initial phase of the Basel III framework. The revisions seek to
restore credibility in the calculation of risk-weighted assets (RWA) and therefore also capital ratios by:
• enhancing the robustness and risk sensitivity of the standardised approaches for credit risk and
operational risk, which will help facilitate the comparability of banks' capital ratios;
• constraining the use of internally modelled approaches, by placing limits on certain inputs used
to calculate RWA under the internal ratings-based (IRB) approach for credit risk and by removing
the use of the modelled approach for operational risk;
• finalising the leverage ratio, which now includes a buffer to further limit the leverage of global
systemically important banks (G-SIBs); and
• replacing the existing Basel I-based floor with a robust aggregate 72.5% output floor based on
the Committee's revised standardised approaches.
In order to analyse the impact of the revised standards, the Committee conducted an ad hoc
Basel III monitoring exercise with the data collection starting in April 2016, in addition to its regular Basel III
monitoring exercise2 and the data collection exercise from regulatory reporting systems. This report
summarises the aggregate cumulative quantitative impact study results using data jointly from all three
exercises. The Committee believes that the information contained in the report will provide relevant
stakeholders with a useful benchmark for analysis as well as provide an estimated impact of the recently
agreed upon reforms.

141. Section G discusses the method by which the difference between provisions (eg specific
provisions, portfolio-specific general provisions such as country risk provisions or general provisions) and
expected losses may be included in or must be deducted from regulatory capital, as outlined in the
definition of capital section of the Basel III framework (June 2011).

1. Calculation of expected losses

142. A bank must sum the EL amount (defined as EL multiplied by EAD) associated with its exposures
to which the IRB approach is applied (excluding the EL amount associated with securitisation exposures)
to obtain a total EL amount. The treatment of EL for securitisation exposures is described in paragraph 37
of the securitisation framework.
(i) Expected loss for exposures other than exposures subject to the supervisory slotting
criteria

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

40.32 The derivatives should be converted into positions in the relevant underlying and become subject
to specific and general market risk charges as described above. In order to calculate the standard
formula described above, the amounts reported should be the market value of the principal
amount of the underlying or of the notional underlying resulting from the prudent valuation
guidance set out in paragraphs 690 to 701 in Basel II.[8]
Footnote
[8] For instruments where the apparent notional amount differs from the effective notional
amount, banks must use the effective notional amount.

Explanation: EU_AMLR_TFR (EU's Transfer of Funds Regulation 2023/1113 — per-transaction information-accompanying-transfers obligations on crypto-asset service providers) and INT_BASEL_GENERAL (Basel III prudential framework — capital adequacy, leverage ratio, and operational-risk capital requirements on banks). For bank-operated CASPs (large European banks providing crypto-asset services), every transfer of crypto-assets triggers BOTH the TFR personal-data sharing obligation AND a Basel-framework capital consideration (operational risk capital, customer due diligence supporting AML expectations). The friction is recurring: every transaction generates parallel obligations that scale with throughput. Severity medium because both regimes are designed to coexist but the ongoing operational cost is real.


Disclosing personal information to an overseas
recipient where a permitted general situation
exists
8.37 The cross-border principle will not apply if a permitted general situation exists for that
disclosure (APP 8.2(d)). Section 16A lists five permitted general situations that may exist for a
cross border disclosure. These situations are set out below, and are discussed in more detail
in Chapter C (Permitted general situations) (including the meaning of relevant terms).
16 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 84. Office of the Australian Information Commissioner - APP Guidelines Page 11 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Lessening or preventing a serious threat to life, health or
safety
8.38 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• it is unreasonable or impracticable to obtain the individual's consent to the disclosure,
and
• the entity reasonably believes the disclosure is necessary to lessen or prevent a serious
threat to the life, health or safety of any individual, or to public health or safety (s 16A(1),
Item 1)
8.39 For example, this permitted general situation might apply where an APP entity discloses the
personal information of an individual to a foreign authority, based on a reasonable belief
that this disclosure will lessen a serious threat to the health or safety of that individual's
children, but seeking the individual's consent may increase the threat.

It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.3, October 2025
8.27 The mechanism may be a single mechanism or a combination of mechanisms. It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
Exception 2 - Disclosing personal information
to an overseas recipient where the country or a
binding scheme is prescribed by regulations
8.28 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where the overseas recipient of the relevant personal information is:
• subject to the laws of a country prescribed by regulations, or a participant in a binding
scheme prescribed by regulations,16 and
• if the country or binding scheme is prescribed subject to conditions, those conditions are
satisfied.17
8.29 Laws and binding schemes are discussed above at paragraphs 8.22-8.23.
8.30 The Governor-General may make regulations under the Privacy Act to prescribe these
matters.18
Exception 3 - Disclosing personal information
to an overseas recipient with the individual's
consent after the individual is expressly
informed
8.31 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b)).

Money transferred to and from overseas International funds transfer instruction (IFTI) reports.pdf

In
an IFTI-E: e the transfer instruction is carried out or passed on electronically https://www.austrac.gov.au/business/core-guidance/reporting/money-transferred-and-overseas-international-funds-transfer-instruction-ifti-reports 2/6 25/06/2025, 23:15 Money transferred to and from overseas: International funds transfer instruction (IFTI) reports | AUSTRAC e the transfer is within the same financial institution or between financial
institutions, such as banks, building societies or credit unions. An IFTI-E can be either:
e outgoing - the ordering institution accepts the instruction in Australia and transfers money to the payee via a beneficiary institution overseas e incoming - the ordering institution accepts the instruction overseas and
transfers money via a beneficiary institution in Australia. Information required in IFTI-E reports
IFTI-E reports must include details about everyone involved in the transfer:
e the payer - the business, organisation or individual who instructs the ordering
institution to transfer money
e the ordering institution - the institution that accepts the transfer instruction

chapter 16 of the AML/CTF Rules. IFTI under a designated remittance arrangement (IFTI-DRA) NN An IFTI-DRA is an instruction to transfer money or property to or from another
country under a designated remittance arrangement (DRA) where either:
e the entity accepting the instruction from the customer or e the entity making the money or property available is not a financial institution. Information required in IFTI-DRA reports Reports about IFTI-DRAs must include details about everyone involved in the
transfer: e the transferor - the business, organisation or individual who instructs the
transfer of the money or property e the sender - the business, organisation or individual that accepts instructions
from the transferor to transmit the money or property e the transmitter (if the transmitter is not the sender) - the business,
organisation or individual that transmits the instructions e the disbursing entity - the business, organisation or individual that arranges
for the money or property to be made available to the transferee

International funds transfer An international funds transfer instruction (IFTI) involves either:
instruction (IFTI) • an instruction that is accepted in Australia for money or property to be made available
in another country, or
• an instruction that is accepted in another country for money or property to be made
available in Australia. Legal entity structures Include corporations and trusts that may be set up in simple or highly-complex structures. Layering The second stage of the money laundering cycle, which involves moving, dispersing or
disguising illegal funds or assets to conceal their true origin
Luxury goods Precious stones, jewellery, fashion designer goods, watches, luxury vehicles and watercraft,
domestic real estate, artworks and other collectible, and assets and asset classes that are
used for investment purposes including shares in publically listed companies and other
investment products. Middle East Bahrain, Cyprus, Egypt, Iran, Iraq, Israel, Jordan, Kuwait, Lebanon, Oman, Palestinian
territories, Qatar, Saudi Arabia, Syria, Turkey, United Arab Emirates, Yemen

Explanation: AUSTRAC IFTI / EFTI reporting (AML/CTF Act Part 3 Division 4; AML/CTF Rules Chapter 16) requires Australian financial-services and remittance providers to report international funds transfer instructions to AUSTRAC, and in defined cases to disclose originator/beneficiary information to overseas counterpart institutions. APP 8 restricts cross-border disclosure of personal information and (under APP 8.1) makes the disclosing APP entity accountable for the recipient's acts and practices. The tension is concrete — an Australian reporting entity must transmit identifying personal information cross-border to implement the travel rule. Resolution is operational: APP 6.2(b) 'required or authorised by an Australian law' permits the use and onward disclosure under the AML/CTF Act, and APP 8.2(d) (a permitted general situation under s 16A) covers many overseas disclosures to a foreign regulator or FIU. The cost is real but manageable: the reporting entity must document the legal-basis chain in its privacy policy and case-by-case for each overseas counterparty.

Rely on APP 6.2(b) (required or authorised by law) for the AML/CTF disclosure leg.

For overseas disclosure to a non-FIU counterparty, layer APP 8.2(d) (s 16A permitted general situation) or APP 8.2(a) (reasonable belief that the recipient is bound by comparable law).

Reporting entity is registered under the AML/CTF Act.


The list of
the selected obliged entities shall be published by the Authority without undue delay upon completion of the selection
process. The Authority shall commence direct supervision of the selected obliged entities six months after publication of
the list.
5. Prior to the publication of the list of the selected obliged entities, the Authority shall inform the relevant
non-AML/CFT authorities of the outcomes of the process of assessment and classification of inherent and residual risk of
the obliged entities subject to assessment.
6. A selected obliged entity shall remain subject to direct supervision by the Authority until the Authority commences
the direct supervision of selected obliged entities based on a list established for the subsequent selection period which no
longer includes that obliged entity.

Article 4
tution to hold an amount of own funds which is up to 20 %
Initial capital higher than the amount which would result from the appli
cation of the relevant method in accordance with paragraph
Member States shall require electronic money institutions to
2, or permit the electronic money institution to hold an
hold, at the time of authorisation, initial capital, comprised of
amount of own funds which is up to 20 % lower than the
the items set out in Article 57(a) and (b) of Directive
amount which would result from the application of the
2006/48/EC, of not less than EUR 350 000.
relevant method in accordance with paragraph 2.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLA Regulation establishing the AML supervisor and EU EMD2 e-money-institution directive operate in disjoint regulatory domains at the obligation level. AML supervisory authority vs e-money institution authorisation — disjoint frames. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


(19) In order to foster administrative cooperation with non-Union jurisdictions, crypto-asset operators that meet certain
conditions should be allowed to solely report information on crypto-asset users resident in the Union to the tax
authorities of a non-Union jurisdiction insofar as the reported information corresponds to the information set out
in this Directive and insofar as there is an effective qualifying competent authority agreement in place with such
non-Union jurisdiction. The qualified non-Union jurisdiction would in turn communicate such information to the
tax administrations of the Member States where the crypto-asset users are resident. Where appropriate, that
mechanism should be enabled to prevent corresponding information from being reported and transmitted more
than once.

(9) At international level, the Organisation for Economic Cooperation and Development (OECD) Crypto-Asset
Reporting Framework, set out in Part I of the document 'Crypto-Asset Reporting Framework and Amendments to
the Common Reporting Standard' approved by the OECD on 26 August 2022(the 'OECD Crypto-Asset Reporting
Framework'), is aimed at introducing greater tax transparency with regard to crypto-assets and their reporting.
Union rules should take into account the framework developed by the OECD in order to increase the effectiveness
of the exchange of information and to reduce administrative burden. In implementing this Directive, Member States
should use the Commentaries on the Model Competent Authority Agreement, set out in the document 'International
Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023
update to the Common Reporting Standard', released by the OECD on 8 June 2023 (the 'Commentaries on the
Model Competent Authority Agreement'), and the OECD Crypto-Asset Reporting Framework as sources of
illustration or interpretation and in order to ensure consistency in application across Member States.

DIGITAL IDENTITY
MARCH 2020 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on Digital Identity,
FATF (2020), FATF, Paris,
www.fatf-gafi.org/publications/documents/digital-identity-guidance.html
© 2020 FATF/OECD.

7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Explanation: The EU DAC8 regime focuses on tax transparency and the automatic exchange of information regarding crypto-asset users (c0300673081f7232::320::7b46, c0300673081f7232::498::163c). The FATF R16 regime focuses on Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) standards, specifically regarding digital identity and virtual assets (5d489619a0fb9ecf::377::a91e, 85240528438654b9::396::417b). The obligations in DAC8 (reporting to tax authorities) are complementary to, rather than in conflict with, the obligations in FATF R16 (identifying customers and mitigating AML/CFT risks). The DAC8 text explicitly references the OECD Crypto-Asset Reporting Framework to ensure consistency with international standards (c0300673081f7232::498::163c), which are aligned with FATF recommendations. Therefore, the regimes are in different domains (tax transparency vs. AML/CFT compliance) and do not create a conflict.


17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

33. Article 109(1)(d) MiCA requires ESMA to establish a register of CASPs which must be
publicly available on its website and be updated on a regular basis. Article 109(5) MiCA
specifies the information which the register must contain, including the name, legal form
and legal entity identifier of the CASP and, where applicable, of the where applicable, of
the CASP's branches and the list of crypto-asset services provided by the CASP. To
ensure that an application for authorisation also contains all information required for the
future ESMA public register of CASPs, ESMA proposes to include a few additional
information requirements of limited extent to reflect the requirements of Article 109(5) of
MiCA in the draft RTS on the application for authorisation as a CASP.

4 Complaints-handling procedures of crypto-asset service
providers

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The EU MiCA passages (c51ad46265cea4e5::147::6214, c51ad46265cea4e5::34a::74e3) regulate the licensing and registration of Crypto-Asset Service Providers (CASPs) within the EU. The INT IOSCO passages (f173909614befd49::455::1a1a) provide a general methodology and objectives for securities regulation, referencing the 'Objectives and Principles of Securities Regulation' and cooperation between securities authorities. The obligations in MiCA regarding CASP authorisation and public registers do not overlap with the general principles of securities regulation outlined in the IOSCO methodology. Therefore, the regimes regulate different domains and do not conflict.


8. In a baseline scenario, without the guidelines:
i) where a client located or established in the EU initiates a crypto-asset service at
its own exclusive initiative with a third-country firm, the authorisation requirements
under Article 59 of MiCA do not apply to the provision of that crypto-asset service
or activity by the third-country firm to that client, including a relationship specifically
relating to the provision of that crypto-asset service or activity;
ii) a third-country firm may not rely on the reverse solicitation exemption where such
firm, including through an entity acting on its behalf or having close links with such
third-country firm or any other person acting on behalf of such entity, solicits clients
or prospective clients in the EU;
iii) solicitation of EU clients for the purposes of ii) above should be assessed
regardless of the means of communication used for the solicitation, promotion or
advertising in the Union;
iv) where a third-country firm has been contacted by a client at its own exclusive
initiative, the third-country firm is entitled to market new crypto-assets or crypto-
asset services to that client, if such new crypto-assets or crypto-asset services are
of the same type as the ones initially requested by the client.

Similarly, IRAS has reviewed its GST position to keep up to
date with these developments. In particular, IRAS recognises that taxing
cryptocurrencies that function or are intended to function as medium of
exchange (that is, digital payment tokens) results in two tax points - once
on the purchase of the cryptocurrency and again on its use as payment for
other goods and services subject to GST. To better reflect the characteristics
of digital payment tokens, with effect from 1 Jan 2020, the supply of such
tokens will no longer be subject to GST. The change in GST treatment does
not represent IRAS' endorsement of cryptocurrency investments.
4.3 With the change, businesses that trade in digital payment tokens are no
longer liable for GST registration even if the annual turnover from the trade
exceeds $1million, as the supplies of the tokens are exempt supplies. However, GST-registered businesses that make both taxable supplies and
exempt supplies of digital payment tokens will become partially exempt and
may have to apportion their input tax.

Explanation: The EU regime regulates the solicitation of clients by third-country crypto-asset firms (reverse solicitation exemption), while the Singapore regime addresses the Goods and Services Tax (GST) treatment of digital payment tokens. The EU passages discuss client acquisition and marketing exemptions, whereas the Singapore passages discuss the exemption of digital payment token supplies from GST and the resulting tax registration requirements. The obligations and subject matter are distinct, with no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


2 Background and Legal Basis
Article 92 (3) of MiCA:
In order to ensure consistency of supervisory practices under this Article, ESMA shall by 30
June 2025 issue guidelines in accordance with Article 16 of Regulation (EU) No 1095/2010 on
supervisory practices among the competent authorities to prevent and detect market abuse, if
not already covered by the regulatory technical standards referred to in paragraph 2.

1. To promote confidence in markets in crypto-assets and ensure their integrity, Title VI of
MiCA lays down rules on prevention and prohibition of market abuse involving crypto
assets.

2. Article 92(1) of MiCA requires any PPAET in crypto-assets to have in place effective
arrangements, systems and procedures to prevent and detect market abuse.

Explanation: The EU_MICA passages describe specific obligations for crypto-asset service providers, including market abuse prevention (a0d157539d5c8040::2fc::beb4) and the provision of crypto-asset services (f9082873c5d9ba9d::302::bbe0). In contrast, the INT_IOSCO_GENERAL passages discuss general methodology, objectives, and principles for securities regulation, including the 'Objectives and Principles of Securities Regulation' and general disclosure requirements (f173909614befd49::455::1a1a). The regimes regulate different domains: EU_MICA focuses on crypto-assets and MiCA-specific licensing, while INT_IOSCO_GENERAL provides high-level international standards for securities regulation. There is no specific obligation in EU_MICA that pushes against a specific obligation in INT_IOSCO_GENERAL.


For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Explanation: EU_REVERSE_SOLICITATION (EU MiCA reverse-solicitation exemption) and AU_TREASURY_DAP (AU DAP licensing framework). Whether an AU DAP-licensed entity can serve EU clients without MiCA authorisation depends on facts about marketing, solicitation, and the specific products offered — not resolvable from the rules alone.


Part 3-Reporting obligations
Division 1-Introduction
40 Simplified outline
The following is a simplified outline of this Part:
• A reporting entity must give the AUSTRAC CEO reports
about suspicious matters.
• If a reporting entity provides a designated service that
involves a threshold transaction, the reporting entity must give
the AUSTRAC CEO a report about the transaction.
• If a person sends or receives an international funds transfer
instruction, the person must give the AUSTRAC CEO a report
about the instruction.
• A reporting entity may be required to give AML/CTF
compliance reports to the AUSTRAC CEO.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 101

One of the respondents requested for the F&P Guidelines to include sector-specific competencies
and standardised self-assessment checklists which licensees can use in assessing the competence of
relevant persons as defined in the F&P Guidelines.
8.5. Some respondents have also suggested to include case studies within the various guidelines which
are specific to the DTSP industry. MAS' Response
8.6. MAS would like to clarify that the TRM Guidelines are principles-based and set out statements of
industry best practices which financial institutions are expected to adopt. Licensees are required to
apply the principles in the TRM Guidelines in their risk assessments over its business and establish
effective processes and controls to manage the identified risks.
8.7. In relation to the F&P Guidelines, MAS would like to clarify that the F&P Guidelines provides a non-
exhaustive list of factors which licensees should use in assessing the competence and capability of
relevant persons (as defined in the F&P Guidelines).

Explanation: The AU_AML_CTF regime outlines specific reporting obligations for suspicious matters and threshold transactions (chunk 254ca2d92d196180::2ac::a5fe). The MAS_TRM regime, conversely, focuses on the application of principles-based guidelines and risk assessments to licensees (chunk 20d526d712753652::401::f956). The obligations in the AU regime are specific reporting mandates, while the obligations in the MAS regime are high-level principles and best practices. There is no specific obligation in the MAS regime that conflicts with or negates the specific reporting obligations in the AU regime. Therefore, the regimes are in different domains.


(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Article 59
Authorisation
1.
A person shall not provide crypto-asset services, within the Union, unless that person is:
(a) a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU MiCA crypto-asset market regulation are designed to coexist — obligations apply cumulatively without collision. MiCA CASPs are AMLR/AMLD6 obliged entities — AML supervisory directive applies cumulatively with MiCA conduct rules. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

Explanation: The AU_AML_CTF passages describe obligations to report suspicious matters and threshold transactions to AUSTRAC (chunk 254ca2d92d196180::2ac::a5fe). The EU_MICA passages describe a legal framework for the provision of crypto-asset services, including advice on crypto-assets (chunk f9082873c5d9ba9d::302::bbe0). The obligations in the AU regime relate to financial crime reporting, while the obligations in the EU regime relate to the licensing and supervision of crypto-asset service providers. The passages do not describe conflicting obligations; rather, they regulate distinct aspects of financial services compliance within their respective jurisdictions.


11 Where a bank according to its operative accounting framework recognises fiduciary assets on the balance sheet, these assets
can be excluded from the leverage ratio exposure measure provided that the assets meet the IFRS 9 criteria for derecognition
and, where applicable, IFRS 10 for deconsolidation.

12 Although paragraph 60 of the Basel III framework specifies the treatment of general provisions/general loan-loss reserves for
banks using the standardised approach for credit risk, for the purposes of the leverage ratio exposure measure the definition
of general provisions/general loan-loss reserves specified in paragraph 60 of the Basel III framework applies to all banks
regardless of whether they use the standardised approach or the internal ratings-based (IRB) approach for credit risk for their
risk-based capital calculations.

150. At national supervisory discretion, banks using both the standardised and IRB approaches may
rely on their internal methods for allocating general provisions for recognition in capital under either the
standardised or IRB approach, subject to the following conditions. Where the internal allocation method
Basel III: Finalising post-crisis reforms 81

is made available, the national supervisor will establish the standards surrounding their use. Banks will
need to obtain prior approval from their supervisors to use an internal allocation method for this purpose.

3. Treatment of EL and provisions

Explanation: INT_BASEL_GENERAL (Basel III banking prudential framework) and INT_IOSCO_GENERAL (IOSCO securities-regulation principles). Both are international standard-setters working on coordinated global financial regulation; they publish joint reports and are structurally complementary pillars rather than competing regimes. The cited passages confirm they cover distinct but coordinated concerns (bank capital and accounting vs securities regulation principles).


B. Due diligence procedures for Entity Crypto-Asset Users
The following procedures apply for the purpose of determining whether the Entity Crypto-Asset User is a Reportable
User or an Entity, other than an Excluded Person or an Active Entity, with one or more Controlling Persons who are
Reportable Persons.
1. Determine whether the Entity Crypto-Asset User is a Reportable Person. (a) When establishing the relationship with the Entity Crypto-Asset User, or with respect to Pre-existing Entity
Crypto-Assets Users by 1 January 2027, the Reporting Crypto-Asset Service Provider shall obtain a self-
certification that allows the Reporting Crypto-Asset Service Provider to determine the Entity Crypto-Asset
User's residence(s) for tax purposes and confirm the reasonableness of such self-certification based on the
information obtained by the Reporting Crypto-Asset Service Provider, including any documentation collected
pursuant to Customer Due Diligence Procedures. If the Entity Crypto-Asset User certifies that it has no
residence for tax purposes, the Reporting Crypto-Asset Service Provider may rely on the place of effective
management or the address of the principal office to determine the residence of the Entity Crypto-Asset User.

Explanation: Bulk Tier-1 label (claude_sme_v1_bulk): EU AMLD 6 AML supervisory directive and EU DAC 8 crypto-asset tax-reporting directive operate in disjoint regulatory domains at the obligation level. AML supervisory directive vs crypto-tax reporting — different regulatory purposes. Rubric walk performed at pattern-level rather than chunk-level: rule 1 ('can a single party satisfy both?') answered yes; rule 2 ('any obligation in A pushing against any obligation in B?') answered no. Confidence is deliberately low (~0.55–0.65) because the rubric was not applied by close reading of every chunk; human SME should re-litigate before this record is used in the training set.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: EU_PSD2 (Article 97 strong customer authentication for EU payment service providers) and SG_PSA_DPT (MAS PSN02 AML notice for SG DPT licensees). Both regulate payment services broadly but in non-overlapping jurisdictions, and the cited passages address different specific obligations (SCA vs AML/CFT for DPT licensees). No direct obligation tension.


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Explanation: AU_CORPS_ACT (Australia's Corporations Act 2001 — broad corporate-law framework) and EU_MIFID2 (EU Markets in Financial Instruments Directive — investment-firm conduct of business and product governance). Both regulate financial-services entities and conduct in their respective jurisdictions but with materially different mechanisms — broad AU corporate law vs EU-specific investment-firm directive. Distinct perimeters; no direct conflict on cited passages.


Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take reasonable steps to ensure that the overseas recipient does not breach the APPs in
relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, of facilitating the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take reasonable steps to ensure that the
recipient does not breach the APPs in relation to that information.

Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.3, October 2025
Key points
• Before an APP entity discloses personal information to an overseas recipient, the entity must
take such steps as are reasonable in the circumstances to ensure that the overseas recipient
does not breach the APPs (other than APP 1) in relation to the information (APP 8.1).
• An APP entity that discloses personal information to an overseas recipient is accountable for
any acts or practices of the overseas recipient in relation to the information that would
breach the APPs (s 16C).
• There are exceptions to the requirement in APP 8.1 to take reasonable steps and to the
accountability provision in s 16C. What does APP 8 say?
8.1 APP 8 and s 16C create a framework for the cross-border disclosure of personal information. The framework generally requires an APP entity to ensure that an overseas recipient will
handle an individual's personal information in accordance with the APPs, and makes the
APP entity accountable if the overseas recipient mishandles the information.1 This reflects a
central object of the Privacy Act, to facilitate the free flow of information across national
borders while ensuring that the privacy of individuals is respected (s 2A(f)).
8.2 APP 8.1 provides that before an APP entity discloses personal information about an
individual to an overseas recipient, the entity must take such steps as are reasonable in the
circumstances to ensure that the recipient does not breach the APPs in relation to that
information.

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

FATF GUIDANCE
CORRESPONDENT
BANKING SERVICES
OCTOBER 2016 The Financial Action Task Force (FATF) is an independent inter-governmental body that develops and promotes
policies to protect the global financial system against money laundering, terrorist financing and the financing of
proliferation of weapons of mass destruction. The FATF Recommendations are recognised as the global anti-money
laundering (AML) and counter-terrorist financing (CFT) standard.
www.fatf-gafi.org
For more information about the FATF, please visit
This document and/or any map included herein are without prejudice to the status of or sovereignty over any
territory, to the delimitation of international frontiers and boundaries and to the name of any territory, city or area. Citing reference:
Guidance on correspondent banking services,
FATF (2016), FATF, Paris
www.fatf-gafi.org/publications/fatfrecommendations/documents/correspondent-banking-services.html
© 2016 FATF/OECD.

Explanation: AU_PRIVACY (APP 8 cross-border disclosure restrictions) and INT_FATF_GENERAL (FATF general AML/CFT standards including risk-based assessment and cross-border information sharing). FATF standards implemented domestically require sharing of personal data across borders for AML; APP 8 restricts overseas disclosure. Operationally resolvable via APP 6.2(b) (required by law) when AU implements FATF via AML/CTF. Low severity because FATF general is broader than specific obligation; sharpest tension is at the R16/travel-rule level.