Reporting transactions of 10,000 and over Threshold transaction reports (TTRs).pdf

'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

Explanation: AU_TTR_THRESHOLD (AUSTRAC threshold-transaction reporting framework — AUD 10,000+ cash transactions) and SG_AML (MAS Notice 314 AML/CFT framework for life insurers). Both jurisdictions implement comparable AML/CFT obligations consistent with FATF standards; entities operating across both face complementary duties.


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Explanation: The AU_ATO_CRYPTO passage discusses the Australian tax treatment and adoption of crypto assets (chunk_id e6bb47e92e88e16c::567::36c4). The EU_MIFID2 passage outlines product governance and suitability obligations for investment firms regarding financial instruments (chunk_id 28dfda0f6a6539b6::620::92ed). The obligations relate to distinct regulatory domains: taxation and crypto asset adoption in Australia versus investment services and product governance in the EU. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other. Therefore, the regimes are non-conflicting.


It may be
established by the law or binding scheme that contains the privacy or data protections, or by
another law or binding scheme. Alternatively, the mechanism may take effect through the
operation of cross-border enforcement arrangements between the OAIC and an appropriate
regulatory authority in the foreign jurisdiction.15
15 Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 83. Office of the Australian Information Commissioner - APP Guidelines Page 9 Chapter 8: Australian Privacy Principle 8 - Cross-border disclosure of personal information Version 1.2, July 2019
Disclosing personal information to an overseas
recipient with the individual's consent after the
individual is expressly informed
8.27 An APP entity may disclose personal information to an overseas recipient without complying
with APP 8.1 where:
• the APP entity expressly informs the individual that if they consent to the disclosure, this
principle will not apply, and
• the individual then consents to the disclosure (APP 8.2(b))
Expressly inform
8.28 An APP entity should provide the individual with a clear written or oral statement explaining
the potential consequences of providing consent.

Part 1-Consideration of personal information
privacy
1 Australian Privacy Principle 1-open and transparent
management of personal information
1.1 The object of this principle is to ensure that APP entities manage
personal information in an open and transparent way. Compliance with the Australian Privacy Principles etc.
1.2 An APP entity must take such steps as are reasonable in the
circumstances to implement practices, procedures and systems
relating to the entity's functions or activities that:
(a) will ensure that the entity complies with the Australian
Privacy Principles and a registered APP code (if any) that
binds the entity; and
(b) will enable the entity to deal with inquiries or complaints
from individuals about the entity's compliance with the
Australian Privacy Principles or such a code. APP Privacy policy
1.3 An APP entity must have a clearly expressed and up-to-date policy
(the APP privacy policy) about the management of personal
information by the entity.
1.4 Without limiting subclause 1.3, the APP privacy policy of the APP
entity must contain the following information:
(a) the kinds of personal information that the entity collects and
holds;
(b) how the entity collects and holds personal information;
(c) the purposes for which the entity collects, holds, uses and
discloses personal information;
358 Privacy Act 1988

5 KordaMentha, 'Token mapping: Response to Treasury consultation paper', March 2023. Introduction | 3 laws, digital asset platforms that do not deal in financial products are not subject to financial services
laws. The Government intends to introduce a regulatory framework aimed at addressing the significant risks
and potential harms associated with digital asset platforms, while fostering innovation and safe usage
of digital assets and distributed ledger technology. The framework outlined in this paper proposes to
regulate digital asset platforms within the existing Australian financial services laws, while ensuring all
consumers and businesses have the opportunity to safely explore and share in any benefits of the
technology. Key terms and concepts used throughout this paper
Understanding the policy problem and the proposed regulatory solution requires an understanding of
several key concepts and terms that are used throughout this paper. These concepts and terms aim to
reduce the complexity of the paper's content, which necessarily covers topics across industries,
technologies, and regulatory frameworks. They include some broad generalisations for descriptive
convenience and some precise technical descriptions for topics stakeholders have identified as causing
regulatory uncertainty.

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

Explanation: The Privacy Act / APPs govern personal information; Treasury's Digital Asset Platforms framework regulates platform-level conduct, custody and tokenisation. The two regimes co-apply to AU digital-asset platforms but address different subject matters. Personal-data handling within a DAP is governed by the Privacy Act; the platform's operational obligations under the DAP framework are independent. Easy hard negative.

DAP licensing required public disclosure of customer-level personal data — current framework limits public disclosure to the platform operator and aggregate metrics.


Consistent and
homogenous application of the rules for the protection of the fundamental rights and freedoms of natural
persons with regard to the processing of personal data should be ensured throughout the Union. Regarding the
processing of personal data for compliance with a legal obligation, for the performance of a task carried out in
the public interest or in the exercise of official authority vested in the controller, Member States should be
allowed to maintain or introduce national provisions to further specify the application of the rules of this
Regulation. In conjunction with the general and horizontal law on data protection implementing Directive
95/46/EC, Member States have several sector-specific laws in areas that need more specific provisions. This
Regulation also provides a margin of manoeuvre for Member States to specify its rules, including for the
processing of special categories of personal data ('sensitive data'). To that extent, this Regulation does not exclude
Member State law that sets out the circumstances for specific processing situations, including determining more
precisely the conditions under which the processing of personal data is lawful.

Article 44
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third
country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers
of personal data from the third country or an international organisation to another third country or to another internat
ional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of
natural persons guaranteed by this Regulation is not undermined.

4.5.2016 EN Official Journal of the European Union L 119/61

Article 25
Data protection by design and by default
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the
processing, the controller shall, both at the time of the determination of the means for processing and at the time of the
processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are
designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the
necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of
data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default,
only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies
to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
In particular, such measures shall ensure that by default personal data are not made accessible without the individual's
intervention to an indefinite number of natural persons.
3. An approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate
compliance with the requirements set out in paragraphs 1 and 2 of this Article.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

Member States shall require that investment firms and market operators operating an MTF or an OTF establish,
publish and maintain and implement transparent and non-discriminatory rules, based on objective criteria, governing
access to its facility.
4. Member States shall require that investment firms and market operators operating an MTF or an OTF have
arrangements to identify clearly and manage the potential adverse consequences for the operation of the MTF or OTF,
or for the members or participants and users, of any conflict of interest between the interest of the MTF, the OTF, their
owners or the investment firm or market operator operating the MTF or OTF and the sound functioning of the MTF or
OTF.
5. Member States shall require that investment firms and market operators operating an MTF or OTF comply with
Articles 48 and 49 and have in place all the necessary effective systems, procedures and arrangements to do so.
6. Member States shall require that investment firms and market operators operating an MTF or an OTF clearly inform
its members or participants of their respective responsibilities for the settlement of the transactions executed in that
facility.

Article 31
Monitoring of compliance with the rules of the MTF or the OTF and with other legal obligations
1. Member States shall require that investment firms and market operators operating an MTF or OTF establish and
maintain effective arrangements and procedures, relevant to the MTF or OTF, for the regular monitoring of the
compliance by its members or participants or users with its rules. Investment firms and market operators operating
an MTF or an OTF shall monitor the orders sent, including cancellations and the transactions undertaken by their
members or participants or users under their systems, in order to identify infringements of those rules, disorderly
trading conditions, conduct that may indicate behaviour that is prohibited under Regulation (EU) No 596/2014 or
system disruptions in relation to a financial instrument and shall deploy the resource necessary to ensure that such
monitoring is effective.
2. Member States shall require investment firms and market operators operating an MTF or an OTF to inform its
competent authority immediately of significant infringements of its rules or disorderly trading conditions or conduct that
may indicate behaviour that is prohibited under Regulation (EU) No 596/2014 or system disruptions in relation to a
financial instrument.

Explanation: MiFID II Article 25 (suitability and appropriateness assessments) requires investment firms to obtain extensive personal information about retail clients — investment objectives, financial situation, risk tolerance, knowledge and experience. Article 16 organisational requirements add record-keeping (typically five years, or longer at Member-State discretion). Articles 27 (best execution) and 31 (trading-venue surveillance) generate transactional data tied to identifiable clients. GDPR data minimisation and purpose limitation are in tension with the breadth of MiFID II data collection. Resolution is operational: GDPR Art 6(1)(b) (contract performance) covers suitability assessment and order execution; Art 6(1)(c) (legal obligation) covers MiFID-mandated record-keeping; Art 5(1)(e) retention windows tie to MiFID retention periods. Severity low because MiFID II has been operating alongside GDPR since 2018 and the practitioner playbook is mature.

GDPR Art 6(1)(b) for suitability and order-execution processing.

GDPR Art 6(1)(c) for MiFID-mandated record-keeping and transaction reporting.

Tie GDPR Art 5(1)(e) retention windows to MiFID II Art 16 minimum retention.

EU MiFID-authorised investment firm; third-country firms providing services under Article 46/47 have a Chapter V transfer overlay.


Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

1 See FATF (2006), FATF (2008) and FATF (2010).

2 See FATF (2013a). This document outlines general principles that may serve as a useful framework in
assessing ML/TF risks at the national level. However, these principles may also relevant when
conducting risk assessments of a more focussed scope. The guidance is also not intended to describe
how supervisors should assess risks in the context of risk-based supervision.

3 See FATF (2013b).
 2013 3

exclusion could undermine the effectiveness of an AML/CFT regime hence, financial inclusion and
AML/CFT should be seen as serving complementary objectives.

The guidance contained in this document takes into consideration previous FATF work , which is still valid reference material. The general
principles contained in this paper are also relevant when conducting risk assessments of a more
focussed scope, such as in assessments of a particular financial or DNFBP sector (for example, the
securities sector) or of thematic issues (for example, the proceeds of corruption related ML). All of
these types of assessments (comprehensive, sectoral or thematic) carried out at the national level
may also form the basis for determining whether to apply enhanced or specific measures, simplified
measures, or exemptions from AML/CFT requirements. Furthermore, while FATF
Recommendation 1 does not create specific risk assessment obligations regarding the financing of
proliferation of weapons of mass destruction, the general principles laid out in this guidance could
also be used in conducting a risk assessment for this area.
3. The guidance in this document is not intended to explain how supervisors should assess risks
in the context of risk-based supervision, although risk-based supervision will likely be informed by a
national-level risk assessment.

Explanation: The AU_TREASURY_DAP passages describe a domestic policy agenda focused on 'token mapping' and the development of a licensing framework for crypto assets to fit within existing financial services laws (chunk_ids d75262e404517e0c::4f1::4905, e6bb47e92e88e16c::37a::29f6). In contrast, the INT_FATF_GENERAL passages provide general guidance on anti-money laundering (AML) and counter-terrorist financing (CFT) risk assessment principles and standards (chunk_ids fe52dd87e13dba41::261::59a4, 75b61beed88910f9::4ad::debc). The regimes regulate different domains: one is a domestic regulatory reform initiative for crypto assets, while the other is an international standard-setting body's guidance on financial crime risks. There is no evidence of a specific obligation in one regime pushing against a specific obligation in the other.


AUSTRAC Proliferation Financing in Australia-National Risk Assessment.pdf

12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

1 Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens, Dec 2019 here.

2 Consultation on Proposed Regulatory Approach for Stablecoin-related Activities, Oct 2022 here.

15 August 2023 | 4

2. Overall Regulatory Approach for Stablecoins
Scope of MAS' stablecoin framework

2.1. In the consultation paper, MAS proposed to bring within the stablecoin regulatory regime, single-
currency stablecoins ("SCS") pegged to the Singapore dollar or Group of Ten ("G10") currencies3, that
are issued in Singapore - herein known as the "SCS framework". Non-SCS will continue to be subject to
the existing DPT regulatory regime under the Payment Services Act 2019 ("PS Act"). MAS sought
comments on whether the regulatory scope was adequate and whether there might be reasons for
MAS to extend its regulatory powers to SCS issued outside of Singapore.

Explanation: The Australian AML/CTF regime regulates reporting entities and their obligations to identify customers and report suspicious transactions (chunk cf7cefacba3f94bc::49a::f39e). The Singapore stablecoin regime regulates the issuance and reserve requirements of Single Currency Stablecoins (SCS) issued in Singapore (chunk 58f45cd2ef3de201::36c::e2f6). The passages describe distinct regulatory domains: one focuses on anti-money laundering compliance for financial service providers, while the other focuses on the issuance standards for specific digital assets. There is no evidence of a specific obligation in the Australian regime conflicting with a specific obligation in the Singapore stablecoin regime.


2.3 Overview of proposed framework
Licensing
The proposed framework would recognise certain asset holding arrangements as a financial product (a
digital asset facility). The existing AFSL framework would apply to any person 'carrying on a financial
services business in Australia' in relation to a digital asset facility. Examples of 'financial services'
include:
• dealing in a financial product (including applying for or acquiring, issuing, varying or disposing of a
financial product)
• making a market for a financial product
• providing a custodial or depository service, and
• providing financial product advice.
The issuer of a digital asset facility would be the person or persons responsible for the obligations
owed to customers under the terms of the asset holding arrangement (platform provider). Platform
providers and other intermediaries performing financial services in relation to digital asset facilities
(e.g. brokers, arrangers, agents, market makers, and advisers) would be required to hold an AFSL.
While the application of the AFSL regime would be jurisdictionally limited to Australia in the usual way,
an intermediary business in Australia, like a broker, would need to be licensed to provide services that
involve dealing in digital asset facilities generally (including those not licensed or located in Australia).
See Part 3 for further detail about licensing obligations.
Facility contracts
The proposed framework would permit digital asset facilities to be paired with other functions,
creating digital asset platforms. All arrangements involving digital asset facilities would be required to
be structured as non-discretionary arrangements.29 The term 'non-discretionary' means the
arrangements must operate according to pre-agreed and transparent rules and procedures.

See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

Explanation: The AU_ASIC_AFSL regime regulates the licensing and conduct of financial services providers in Australia, specifically regarding digital asset facilities (chunk 550958b067dc6726::709::b159). The INT_IOSCO_GENERAL regime provides a methodology for adopting IOSCO principles and standards, which are high-level objectives for securities regulation (chunk f173909614befd49::455::1a1a). The obligations in Regime A are specific operational and licensing requirements for entities operating in Australia, while Regime B outlines general international standards and principles. There is no specific obligation in Regime A that pushes against a specific obligation in Regime B; rather, Regime B provides the overarching framework that Regime A implements. Therefore, the regimes are in different domains and do not conflict.


Prudential Standard CPS 234
Information Security
Objectives and key requirements of this Prudential
Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes
measures to be resilient against information security incidents (including cyber-
attacks) by maintaining an information security capability commensurate with
information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security
incidents on the confidentiality, integrity or availability of information assets,
including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that
the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity
must:
 clearly define the information security-related roles and responsibilities of the
Board, senior management, governing bodies and individuals;
 maintain an information security capability commensurate with the size and
extent of threats to its information assets, and which enables the continued
sound operation of the entity;
 implement controls to protect its information assets commensurate with the
criticality and sensitivity of those information assets, and undertake
systematic testing and assurance regarding the effectiveness of those controls;
and
 notify APRA of material information security incidents.
CPS 234 - 1

Authority

11.8 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

11.9 Where the ordering institution is unable to comply with the requirements in paragraphs
11.3 to 11.8, it shall not execute the wire transfer.
Responsibility of the Beneficiary Institution

11.10 A bank that is a beneficiary institution shall take reasonable measures, including post-
event monitoring or real-time monitoring where feasible, to identify cross-border wire
transfers that lack the required wire transfer originator or required wire transfer beneficiary
information.

11.11 For cross-border wire transfers, a beneficiary institution shall identify and verify the
identity of the wire transfer beneficiary if the identity has not been previously verified.

Explanation: CPS 234 regulates information-security capability of APRA-regulated Australian financial entities; MAS AML/CFT Notices regulate AML/CFT operational controls (CDD, wire-transfer travel rule, transaction monitoring) on MAS-regulated Singapore FIs. Different jurisdictions, different domains, different regulated populations. There is no plausible mechanism by which one's obligations contradict the other's. This is a deliberate easy negative for the conflict-detector training set.

A single entity were dual-regulated and one regime mandated a control that the other prohibited — there is no such scenario in the cited text.


Several other EU Directives include pending technical standards or guidelines intended
to specify measures for access controls in the context of ICT security. Under the
Network and Information Security Directive (EU) 2022/2555 (NIS2), the Commission is
empowered to prepare implementing acts on the 'technical and methodological
requirements' for a range of measures, including access control policies (as well as
policies regarding the use of cryptography)19. Similarly, as part of Directive (EU)
2022/2557 (Critical Entities Regulation), the Commission is also responsible for the
19 Commission Implementing Act pursuant to Art. 21(5) of Directive (EU) 2022/2555 (NIS2) (link) preparation of guidelines on a range of resilience measures for so-called 'Critical
Entities' which would include 'access controls20'.
131. Although the draft level 2 and 3 measures under NIS2, which will enter into application
on 18 October 2024, are still unavailable as of the publication of this paper, ESMA will
consider alignment only insofar as those implementing measures are relevant to the
mandate and the area of financial services more broadly.
132.

Dealing with an entity that is not subject to AML/CFT regulation would also similarly
pose higher ML/TF risks. II-3-6 MAS will apply a risk-based approach to supervision of DPT providers. This will
include robust licensing fit and proper checks, and inspections to be conducted to
test FIs' effectiveness at combating ML/TF and PF. MAS' AML/CFT supervision
will also be supplemented by findings from MAS' surveillance of higher risk areas

Explanation: The EU_NIS2 passage discusses the preparation of technical standards and guidelines for access controls and ICT security measures (chunk_id 3c9eb3a25c93f394::474::4786). The SG_MAS_AML_GENERAL passage discusses the application of a risk-based approach to supervision of Digital Payment Token (DPT) providers, including robust licensing and inspections to combat money laundering and terrorism financing (chunk_id b49627bb889ef1d9::1b6::0802). The obligations in the EU_NIS2 passage relate to the technical implementation of ICT security (access controls), while the obligations in the SG_MAS_AML_GENERAL passage relate to the regulatory supervision and licensing of entities to prevent financial crime. These are distinct regulatory domains; the ICT security measures required by NIS2 do not conflict with the AML/CFT supervision requirements of MAS.


Part 1 Preliminary
Section 1-4
(a) in relation to registration or proposed registration of a person under Part 6
of the Act as a remittance network provider-registrable remittance
network services; or
(b) in relation to registration or proposed registration of a person under Part 6
of the Act as an independent remittance dealer or a remittance affiliate of a
registered remittance network provider-registrable remittance services; or
(c) in relation to registration or proposed registration of a person under Part 6A
of the Act as a virtual asset service provider-registrable virtual asset
services.
related body corporate has the same meaning as in the Corporations Act 2001.
super-agent has the meaning given by subsection 4-13(2).
tracing information, in relation to a transfer of value, means information that
satisfies both of the following:
(a) the information:
(i) for a transfer from an

Part 4-Registration
Division 1-Management of the Remittance Sector Register and the
Virtual Asset Service Provider Register
4-1 Correction of entries
(1) This section is made for the purposes of paragraphs 75(4)(a) and 76B(4)(a) of the
Act. (2) If the AUSTRAC CEO reasonably believes that there is an error in, or omission
from, an entry in the Remittance Sector Register or the Virtual Asset Service
Provider Register, the AUSTRAC CEO may correct the error or omission. (3) As soon as reasonably practicable after making a correction of an entry under
this section, the AUSTRAC CEO must give notice of the correction to:
(a) the person whose registration the entry relates to; and
(b) if the registration is of a person as a remittance affiliate of a registered
remittance network provider-the provider.
4-2 Publication of register information
(1) For the purposes of subsections 75(4) and 76B(4) of the Act, the AUSTRAC
CEO must publish the following on AUSTRAC's website:
(a) the details mentioned in paragraphs 75A(1)(a), (b), (c) and (f) of the Act on
the Remittance Sector Register;
(b) the details mentioned in paragraphs 76C(a) and (d) of the Act on the
Virtual Asset Service Provider Register;
(c) information mentioned in section 4-24 of this instrument (register entry in
relation to suspension of registration) on the Remittance Sector Register
and the Virtual Asset Service Provider Register.

6.1.2 RTS and ITS on the notification by certain financial entities to
provide crypto-asset services
Impact of the draft RTS and ITS under Article 60(13) and (14) of MiCA

21. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

22. MiCA sets out a new legal framework applicable to certain financial entities intending to
provide crypto-asset services, requiring such entities to notify all the information set out
in Article 60(7) of MiCA, as specified by the RTS on the notification by certain financial
entities to provide crypto-asset services.

57. ESMA is mandated in Article 84(4) of MiCA to develop, in close cooperation with EBA,
draft regulatory technical standards (RTS) on the detailed content of the information for
the assessment of proposed acquisitions of qualifying holdings in CASPs. The aim of
this draft RTS is to specify the detailed content of the information that direct or indirect
proposed acquirers must provide to national competent authorities (NCAs) when
notifying the intended acquisition. This should ensure a harmonised approach to the
assessment across Member States in the EU of the intended acquisition of qualifying
holdings in CASPs.

58. The RTSs are applicable to proposed acquirers of qualifying holdings in CASPs, as well
as NCAs as designated under Article 93(1) of MiCA that will conduct the assessment of
the intended acquisition in accordance with Article 83(4) of MiCA.

Explanation: The AU_TRAVEL_RULE passages describe the Australian regulatory framework for remittance networks and virtual asset service providers, including the correction of entries on registers and the definition of 'tracing information' for transfers of value. The EU_MICA_RTS passages describe the European regulatory framework for crypto-asset service providers (CASPs), specifically the notification requirements for entities providing crypto-asset services and the regulatory technical standards (RTS) for assessing proposed acquisitions of qualifying holdings in CASPs. The obligations in the AU regime relate to the registration and correction of entries for remittance and virtual asset providers, while the obligations in the EU regime relate to the notification of crypto-asset services and the assessment of acquisitions of CASPs. These are distinct regulatory domains with no apparent overlap of obligations or conflicting requirements.


Article 97
Authentication
1. Member States shall ensure that a payment service provider applies strong customer authentication where the payer:
(a) accesses its payment account online;
(b) initiates an electronic payment transaction;
(c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.
2. With regard to the initiation of electronic payment transactions as referred to in point (b) of paragraph 1, Member
States shall ensure that, for electronic remote payment transactions, payment service providers apply strong customer
authentication that includes elements which dynamically link the transaction to a specific amount and a specific payee.
3. With regard to paragraph 1, Member States shall ensure that payment service providers have in place adequate
security measures to protect the confidentiality and integrity of payment service users' personalised security credentials.
4. Paragraphs 2 and 3 shall also apply where payments are initiated through a payment initiation service provider.
Paragraphs 1 and 3 shall also apply when the information is requested through an account information service provider.
5. Member States shall ensure that the account servicing payment service provider allows the payment initiation
service provider and the account information service provider to rely on the authentication procedures provided by
the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and,
where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3.

23.12.2015 EN Official Journal of the European Union L 337/59
(30) 'strong customer authentication' means an authentication based on the use of two or more elements categorised as
knowledge (something only the user knows), possession (something only the user possesses) and inherence
(something the user is) that are independent, in that the breach of one does not compromise the reliability of
the others, and is designed in such a way as to protect the confidentiality of the authentication data;
(31) 'personalised security credentials' means personalised features provided by the payment service provider to a
payment service user for the purposes of authentication;
(32) 'sensitive payment data' means data, including personalised security credentials which can be used to carry out fraud.

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The EU PSD2 passages regulate the authentication of payment transactions and the authorisation of payment institutions (chunk_ids adb1a81b9cecaf8c::64f::f5ad, adb1a81b9cecaf8c::31a::3b3b). The SG FSMA DTSP passages regulate the licensing of Digital Token Service Providers (DTSPs) and the conduct of digital token services (chunk_ids 20d526d712753652::404::80be, cc1be49e9cf8c821::2f4::ea8f). The obligations in PSD2 regarding strong customer authentication and security credentials do not overlap with the obligations in the SG regime regarding licensing, exemptions, or the conduct of digital token services. Therefore, the regimes are in different domains and do not conflict.


Prudential Standard CPS 230
Operational Risk Management
Objectives and key requirements of this Prudential
Standard
The aim of this Prudential Standard is to ensure that an APRA-regulated entity is
resilient to operational risks and disruptions. An APRA-regulated entity must
effectively manage its operational risks, maintain its critical operations through
disruptions, and manage the risks arising from service providers.
An APRA-regulated entity's approach to operational risk must be appropriate to its
size, business mix and complexity. The key requirements of this Prudential Standard
are that an APRA-regulated entity must:
• identify, assess and manage its operational risks, with effective internal
controls, monitoring and remediation;
• be able to continue to deliver its critical operations within tolerance levels
through severe disruptions, with a credible business continuity plan (BCP); and
• effectively manage the risks associated with service providers, with a
comprehensive service provider management policy, formal agreements and
robust monitoring.
CPS 230 - 1

Authority
1. This Prudential Standard is made under:
section 11AF of the Banking Act 1959 (Banking Act);

15. An APRA-regulated entity must not rely on a service provider unless it can ensure that in doing so it can
continue to meet its prudential obligations in full and effectively manage the associated risks.

1. The aim of CPS 230 is to ensure that APRA-regulated entities ('entities') are resilient to operational risks and
disruptions. Operational resilience is the outcome of prudent operational risk management: the ability to
effectively manage and control operational risks; limit disruptions; and maintain critical operations through
disruptions.

2. APRA expects that, in implementing CPS 230, a prudent entity would start with the identification of its critical
operations. An entity would:
a) identify its critical operations (paragraph 36 of CPS 230 sets out the minimum list);
b) set tolerance levels for disruption of these critical operations; and
c) identify the processes and resources needed to deliver these critical operations, including material
service providers.

2. MiCA sets out a new legal framework which encompasses requirements for the provision
of ten different crypto-asset services. These services include the provision advice on
crypto-assets; defined in Article 3(1)(24) of MiCA as "offering, giving or agreeing to give
personalised recommendations to a client, either at the client's request or on the initiative
of the crypto-asset service provider providing the advice, in respect of one or more
transactions relating to crypto-assets, or the use of crypto-asset services". Article
81(15)(a) of MiCA gives a mandate to ESMA to issue guidelines in accordance with
Article 16 of Regulation (EU) No 1095/2010 specifying criteria for the assessment of
knowledge and competence in accordance with paragraph 7 of this Article.

6.5 Annex V - Draft RTS pursuant to Article 62(5) of MiCA
COMMISSION DELEGATED REGULATION (EU) .../...
of XXX
supplementing Regulation (EU) 2023/1114 of the European Parliament and of the
Council with regard to regulatory technical standards specifying the information to be
included in an application for authorisation as crypto-asset service provider
(Text with EEA relevance)
THE EUROPEAN COMMISSION,
Having regard to the Treaty on the Functioning of the European Union,
Having regard to Regulation (EU) 2023/1114 of the European Parliament and of the Council
of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2012
and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/193718, and in particular
Article 62(5), third subparagraph, thereof,
Whereas:
(1) The information to be provided in an application for authorisation as crypto-asset service
provider should be sufficiently detailed and comprehensive to enable competent
authorities to assess whether an applicant meets the applicable requirements laid down
in Title V and, where relevant, Title VI of Regulation (EU) 2023/1114.

Explanation: The obligations in APRA CPS 230 relate to operational risk management, business continuity, and the resilience of critical operations for APRA-regulated entities (chunk_ids f296a7e0bead93df::4a5::9828, 4b6fab404e7acfca::3d7::737c). The obligations in EU MiCA relate to the provision of crypto-asset services, market abuse prevention, and the authorisation of crypto-asset service providers (chunk_ids f9082873c5d9ba9d::302::bbe0, c51ad46265cea4e5::462::80d8). The regimes regulate distinct domains—prudential operational resilience versus crypto-asset market conduct and authorisation—resulting in no overlap of obligations.


'@ Australian Government
AUSTRAC Reporting transactions of
$10,000 and over:
Threshold transaction
reports (TTRs) transaction reports (TTRs) A 'threshold transaction' is the transfer of physical currency (cash) of A$10,000 or more
(or the foreign currency equivalent) as part of providing a designated service. A transfer
can include receiving or paying cash. If you provide a designated service that involves a threshold transaction, you must
report these transfers to AUSTRAC in a threshold transaction report (TTR) within 10
business days. TTRs help us detect, deter and disrupt criminal and terrorist activity. Who must submit TTRs Any business that provides a designated service that involves the transfer of A$10,000
or more (or the foreign currency equivalent) must submit a TTR to AUSTRAC. If you are an affiliate of a remittance network provider (RNP) and the threshold
transaction was made on your RNP's network, they must submit the TTR for you.

Part 3 Reporting obligations
Division 3 Threshold transactions
Section 43
Division 3-Threshold transactions
43 Reports of threshold transactions
Scope
(1) This section applies to a reporting entity if:
(a) the reporting entity commences to provide, or provides, a
designated service to a customer; and
(b) the provision of the service involves a threshold transaction. Report
(2) The reporting entity must, within 10 business days after the day on
which the transaction takes place, give the AUSTRAC CEO a
report of the transaction. (3) A report under subsection (2) must:
(a) be in the approved form; and
(b) contain such information relating to the transaction as is
specified in the AML/CTF Rules. Note 1: For additional rules about reports, see section 244. Note 2: Section 49 deals with the provision of further information, and the
production of documents, by the reporting entity.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

1. As per Article 10(1) of Regulation (EU) No 1095/2010, any draft regulatory technical
standards and implementing technical standards developed by ESMA shall be
accompanied by an analysis of 'the potential related costs and benefits' of the technical
standards.

2. MiCA sets out a new legal framework applicable to legal persons or other undertakings
intending to provide crypto-asset services, requiring such entities to submit an
application for authorisation containing all the information set out in Article 62(2) of MiCA,
as specified by the RTS on the information for authorisation as a CASP.

3. The next paragraphs present the cost-benefit analysis of the main policy options included
in this final report on the requirements for the application for authorisation as a CASP
under Article 62 of MiCA.
Problem identification

Explanation: The obligations in Regime A (AU_TTR_THRESHOLD) relate to the reporting of physical currency transactions exceeding A$10,000 to AUSTRAC. The obligations in Regime B (EU_MICA_TITLE_V_CASP) relate to the authorisation requirements for crypto-asset service providers (CASP) under the Markets in Crypto-Assets Regulation (MiCA). The passages confirm that Regime B governs the licensing and supervision of entities providing crypto-asset services, whereas Regime A governs the reporting of cash transactions. There is no specific obligation in MiCA that conflicts with the AUSTRAC reporting obligation; rather, they regulate distinct domains of financial activity. Therefore, the regimes are non-conflicting.


This obligation applies only to the
exchange of digital currency to fiat currency and the reverse. Australia has not yet implemented FATF's 'Travel Rule' for digital currency exchanges. The Travel Rule
would require businesses to identify all parties involved in transactions (for example, exchanges
between digital currencies), custodial wallet providers and transfers made on behalf of customers. These obligations would provide greater visibility of ultimate beneficial ownership of digital currency
assets, as well as parties to transactions. AUSTRAC provides guidance to digital currency exchange providers on assessing their risk exposure
and complying with their AML/CTF obligations. Regulation and guidance can help mitigate proliferation
financing risk exposure, to the extent that AML/CTF measures help protect businesses from a range of
criminal misuse, including proliferation financing.

As at March 2024, 389 DCE providers were registered with AUSTRAC.54
DCE providers must comply with AML/CTF obligations, including identifying their customers,
maintaining records and reporting transactions including suspicious matters to AUSTRAC. However, the regulatory framework only applies to the exchange of digital currency to fiat
currency, and vice versa. Australia is currently consulting on AML/CTF reforms, including
the range of digital currency services that are captured in legislation. In addition, Australia
is consulting on requirements that would extend FATF's 'Travel Rule' to digital currency
transactions. The Travel Rule would require regulated businesses to identify all parties
involved in transactions. Implementing this would provide greater visibility of the ultimate
beneficial ownership of digital currency assets, as well as parties to transactions. Risk rating
Digital currency exchanges are assessed as posing a medium and increasing money laundering
vulnerability. Key judgements
• Criminals exploit DCEs for money laundering as an extension of, and in addition to, traditional
layering methodologies.
• DCEs offer speed, global reach, pseudonymity and can facilitate funds flows to and from
foreign jurisdictions with low visibility.

Notabene commend's the Monetary Authority of Singapore (MAS) for proposing a
comprehensive and detailed regulatory approach for Digital Token Service Providers
(DTSPs) under the Financial Services and Markets Act 2022. Our comments focus on
the alignment of these notices and guidelines with international standards,
particularly in light of Financial Action Task Force (FATF) Recommendations,
including the Travel Rule.

Explanation: The evidence for AU_TRAVEL_RULE indicates that Australia is currently consulting on extending the FATF 'Travel Rule' to digital currency transactions, but notes that the rule has not yet been implemented for digital currency exchanges (chunk_ids cf7cefacba3f94bc::383::7d9d, 30a32a386d15ba2b::4f3::edc3). The evidence for SG_FSMA_DTSP confirms that the regime is aligned with FATF Recommendations, including the Travel Rule (chunk_id 20d526d712753652::1a4::2e6e). The regimes are not in conflict because one is a proposed future implementation (AU) while the other is an existing regulatory framework (SG) that is already aligned with the international standard. The tension is one of implementation timelines rather than a direct regulatory clash.


12 The AML/CTF regime applies to residents of Australia as well as Australia-based entities or subsidiaries of Australian companies abroad. The
AML/CTF Act requires reporting entities to identify customers' identities; mandates the collection of certain information for electronic funds
transfers; places restrictions on correspondent banking relationships; places certain reporting requirements for suspicious activity, transactions past
a certain threshold and cross-border movement of funds, physical currency and bearer negotiable instruments; and requires the establishment and
compliance of an AML and CTF programme that identifies and addresses institutional risk. The AML/CTF Act focuses on regulating businesses that provide a range of services (known as
designated services).13 Businesses that provide designated services are known as reporting entities. Reporting entities must comply with obligations under the AML/CTF legislative regime. There are
currently more than 17,000 reporting entities enrolled with AUSTRAC. All reporting entities must have risk-based systems and controls in their transaction monitoring
programs to identify and report suspicious matters.

(4) This Directive is part of a comprehensive package aiming at strengthening the Union's anti-money laundering and
countering the financing of terrorism ('AML/CFT') framework. Together, this Directive and Regulations (EU)
2023/1113 (6), (EU) 2024/1624 (7) and (EU) 2024/1620 (8) of the European Parliament and of the Council will form
the legal framework governing the AML/CFT requirements to be met by obliged entities and underpinning the
Union's AML/CFT institutional framework, including the establishment of an Authority for anti-money laundering
and countering the financing of terrorism (AMLA).

Explanation: AU_FEDREG_AML (Australian AML/CTF Act and Rules — AUSTRAC reporting-entity framework) and EU_AMLA (EU Anti-Money Laundering Authority — supervisory cooperation framework under AMLD6). Both implement AML/CFT supervisory architecture in their jurisdictions consistent with FATF standards. Reinforcing.


16. For the purposes of calculating capital requirements, a bank exposure is defined as a claim
(including loans and senior debt instruments, unless considered as subordinated debt for the purposes of
paragraph 53) on any financial institution that is licensed to take deposits from the public and is subject
to appropriate prudential standards and level of supervision. 13 The treatment associated with
subordinated bank debt and equities is addressed in paragraphs 49 to 53.
Risk weight determination

17. Bank exposures will be risk-weighted based on the following hierarchy:14

13 For internationally active banks, appropriate prudential standards (eg capital and liquidity requirements) and level of
supervision should be in accordance with the Basel framework. For domestic banks, appropriate prudential standards are
determined by the national supervisors but should include at least a minimum regulatory capital requirement.

37. Exposures to securities firms and other financial institutions will be treated as exposures to banks
provided that these firms are subject to prudential standards and a level of supervision equivalent to those
applied to banks (including capital and liquidity requirements). National supervisors should determine
whether the regulatory and supervisory framework governing securities firms and other financial
institutions in their own jurisdictions is equivalent to that which is applied to banks in their own
jurisdictions. Where the regulatory and supervisory framework governing securities firms and other
financial institutions is determined to be equivalent to that applied to banks in a jurisdiction, other national
supervisors may allow their banks to risk weight such exposures to securities firms and other financial
institutions as exposures to banks. Exposures to all other securities firms and financial institutions will be
treated as exposures to corporates.

7. Exposures to corporates

13.14 A direct life insurer shall take all appropriate steps to ensure that its officers, employees
and agents (whether in Singapore or elsewhere) are regularly and appropriately trained
on -
(a) AML/CFT laws and regulations, and in particular, CDD measures, detecting and
reporting of suspicious transactions;
(b) prevailing techniques, methods and trends in money laundering and terrorism
financing; and
(c) the direct life insurer's internal policies, procedures and controls on AML/CFT and
the roles and responsibilities of officers, employees and agents in combating
money laundering and terrorism financing. Endnotes on History of Amendments
1. MAS Notice 314 dated 2 July 2007. (a) MAS Notice 314 (Amendment) 2009 dated 3 July 2009 with effect from 2
December 2009. (b) MAS Notice 314 (Amendment) 2013 with effect from 23 January 2013. (c) MAS Notice 314 (Amendment) 2014 with effect from 1 July 2014.
2.

3.1 This Notice is based on the following principles, which shall serve as a guide for all banks
in the conduct of their operations and business activities:
(a) A bank shall exercise due diligence when dealing with customers, natural persons
appointed to act on the customer's behalf, connected parties of the customer and
beneficial owners of the customer.
(b) A bank shall conduct its business in conformity with high ethical standards, and
guard against establishing any business relations or undertaking any transaction,
including a digital token transaction, that is or may be connected with, or facilitates
or may facilitate money laundering or terrorism financing.
(c) A bank shall, to the fullest extent possible, assist and cooperate with the relevant
law enforcement authorities in Singapore to prevent money laundering and
terrorism financing.

Explanation: The Basel Crypto regime (Regime A) focuses on prudential capital requirements, risk-weighting exposures, and supervisory equivalence for financial institutions (chunk_ids 32afd37cade34f84::3a4::1a5b, 32afd37cade34f84::3ec::a3fa). The Singapore AML regime (Regime B) focuses on customer due diligence, training, and the prevention of money laundering and terrorism financing (chunk_ids 3d521e61e49aaf46::38f::e615, 39886a6842407c92::356::ee53). The obligations in Regime A relate to financial stability and capital adequacy, while the obligations in Regime B relate to compliance and risk management. There is no specific obligation in the Basel Crypto regime that pushes against a specific obligation in the Singapore AML regime; rather, they regulate distinct aspects of banking operations. Therefore, the regimes are in different domains.


See also Resolution of the Presidents' Committee on IOSCO Adoption of the
Objectives and Principles of Securities Regulation, September 1998, available at
http://www.iosco.org/library/resolutions/pdf/IOSCORES16.pdf.
10 A full numerical list of IOSCO Resolutions and public reports is set out on IOSCO's
website:https://www.iosco.org/about/?subsection=resolutions and
http://www.iosco.org/publications/?subsection=public_reports (respectively), catalogued by reference to
the month and year of their issuance. INTRODUCTION
The IOSCO Principles are one of the key standards and codes (including those on clearing and
settlement) highlighted by the Financial Stability Board (FSB) as being key to sound financial
systems and deserving priority implementation.11 Further articulation of how to apply the
Principles pursuant to this Methodology helps to effectuate the general objectives of IOSCO
as expressed in its By-Laws, in particular that securities authorities should cooperate to ensure
better regulation of the markets on the domestic and international level by establishing
standards, among other things.

On 4 October 2024, the Monetary Authority of Singapore ("MAS") issued a consultation paper on
the proposed regulatory approach, regulations, notices and guidelines for digital token service
providers issued under the Financial Services and Markets Act 2022 ("FSM Act") (the "consultation
paper"). Under this, digital token service providers are defined as individuals, partnerships or
Singapore corporations that are operating from a place of business in Singapore or formed or
incorporated in Singapore but carry on a business of providing digital token ("DT") services outside
Singapore ("DTSPs").
1.2. The consultation period closed on 4 November 2024, and MAS would like to thank all respondents
for their contributions. MAS has considered carefully the feedback received and incorporated them
where justified and appropriate. Comments that are of a wider interest, together with MAS'
responses, are set out below. The list of respondents and their full submissions are provided in the
Annexes at the end of this paper.
1.3.

2.1 Pursuant to section 137 of the FSM Act, any person that conducts digital token
services in Singapore as defined in the First Schedule of the FSM Act is required to hold a
licence unless that person is exempted. Section 137(5) of the FSM Act sets out the applicable
exemptions from holding a licence.

2.2 As MAS will not be providing a transitional arrangement for DTSPs, DTSPs which are
subject to a licensing requirement under section 137 of the FSM Act must suspend or cease
carrying on a business of providing digital token services outside Singapore by 30 June 2025.
A DTSP that contravenes the licensing requirement is guilty of an offence and would be liable
to penalties set out in section 137(6) of the FSM Act.
Types of Digital Token Services

Explanation: The IOSCO passages (chunk f173909614befd49::455::1a1a) discuss general international standards and principles for securities regulation, including disclosure and cooperation. The SG_FSMA_DTSP passages (chunks 20d526d712753652::404::80be and cc1be49e9cf8c821::2f4::ea8f) regulate the licensing and conduct of Digital Token Service Providers (DTSPs) under Singapore's FSM Act. While the SG passages mention alignment with international standards and FATF, they do not impose specific obligations that conflict with the general IOSCO principles. The regimes regulate distinct operational areas (general securities standards vs. specific digital token service provider licensing), resulting in no direct conflict.


Investment firms that offer or recommend to clients financial instruments not manufactured by them should also
have appropriate arrangements in place to obtain and understand the relevant information concerning the product
approval process, including the identified target market and the characteristics of the product they offer or
recommend. That obligation should apply without prejudice to any assessment of appropriateness or suitability
to be subsequently carried out by the investment firm in the provision of investment services to each client, on the
basis of their personal needs, characteristics and objectives. In order to ensure that financial instruments will be offered or recommended only when in the interest of the
client, investment firms offering or recommending the product manufactured by firms which are not subject to the
product governance requirements set out in this Directive or manufactured by third-country firms should also have
appropriate arrangements to obtain sufficient information about the financial instruments. (72) In order to give all relevant information to investors, it is appropriate to require investment firms providing
investment advice to disclose the cost of the advice, to clarify the basis of the advice they provide, in particular the
range of products they consider in providing personal recommendations to clients, whether they provide
investment advice on an independent basis and whether they provide the clients with the periodic assessment
of the suitability of the financial instruments recommended to them.

Article 25
Assessment of suitability and appropriateness and reporting to clients
1. Member States shall require investment firms to ensure and demonstrate to competent authorities on request that
natural persons giving investment advice or information about financial instruments, investment services or ancillary
services to clients on behalf of the investment firm possess the necessary knowledge and competence to fulfil their
obligations under Article 24 and this Article. Member States shall publish the criteria to be used for assessing such
knowledge and competence. 12.6.2014 EN Official Journal of the European Union L 173/409
2. When providing investment advice or portfolio management the investment firm shall obtain the necessary
information regarding the client's or potential client's knowledge and experience in the investment field relevant to
the specific type of product or service, that person's financial situation including his ability to bear losses, and his
investment objectives including his risk tolerance so as to enable the investment firm to recommend to the client or
potential client the investment services and financial instruments that are suitable for him and, in particular, are in
accordance with his risk tolerance and ability to bear losses.

1.1 This Notice is issued pursuant to section 27B of the Monetary Authority of Singapore Act
(Cap. 186) ("MAS Act") and applies to all holders of a payment service licence under the
Payment Services Act 2019 (Act 2 of 2019) ("PS Act") that carry on a business of
providing digital payment token service ("payment service provider").

1.2 This Notice shall take effect from 28 January 2020.

Guidelines
• MAS' surveillance efforts are • Existing VASPs operating in
focused on: (a) detecting and Singapore were required to notify
Licensing
deterring unlicensed DPT activities MAS and submit licence
Surveillance and
in Singapore; and (b) leveraging applications by 28 Jul 2020.
data and blockchain analytics to Supervision
identify higher risk entities. • Applicants expected to
demonstrate understanding and
ability to mitigate ML/TF risks. Slide 5 (III) AML/CFT requirements for DPT sector
AML/CFT requirements for digital payment token (DPT) service in Singapore
• AML/CFT requirements are set out in MAS Notice PSN02 (issued 5 Dec 2019) and Guidelines to PSN02 (issued on 16 Mar 2020). Amendments to the Payment Services Act were passed in Parliament in Jan 2021 to expand the scope of DPT services and
further updates to Notice PSN02 and Guidelines are in train to apply AML/CFT requirements to the newly scoped-in DPT services.
• Entities that (a) deal in DPT; (b) facilitate the exchange of DPT; (c) facilitate the transmission of DPT; (d) and/or provide custodian
wallet services, will therefore be required to be licensed as DPT service providers, and comply with the AML/CFT requirements.

Explanation: The EU MIFID2 passages regulate the conduct of investment firms, specifically regarding product governance, suitability assessments, and client information disclosure (e.g., Article 1, Article 24, Article 25). The SG_PSA_DPT passages regulate the licensing and AML/CFT compliance of Digital Payment Token (DPT) service providers under the Payment Services Act. While both regimes apply to entities dealing with financial instruments (MIFID2) and digital payment tokens (PSA), the obligations are distinct: MIFID2 focuses on the suitability and best interests of the client, whereas PSA focuses on licensing, surveillance, and anti-money laundering controls. There is no specific obligation in MIFID2 that directly conflicts with the specific obligations in PSA regarding DPT operations. The regimes regulate different aspects of the financial services value chain (conduct of business vs. licensing and AML/CFT).


Part 1.6 Interaction with Australian Charities and Not-for-profits Commission Act Section 111L
Provisions of this Act that do not apply to bodies corporate registered under the
ACNC Act
Item Column 1 Column 2
Provision(s) Topic
2 section 138 ASIC may direct company to lodge
consolidated constitution
3 section 139 Company must send copy of
constitution to member
4 subsection 142(2), section 146 and Company must notify ASIC of
subsection 146A(2) changes of address
5 (a) sections 180 to 183; and Duties of directors etc. (b) section 185, to the extent that it
relates to sections 180 to 183
6 section 188, to the extent it relates to Responsibility of secretaries and
a provision mentioned in another directors for certain contraventions
item of this table
7 sections 191 to 194 Interests of directors
8 (a) sections 201L and 205A to 205C; Public information about directors
and etc.

17. Article 62 of MiCA provides for the requirements for the application for authorisation as
CASP. More particularly, Article 62(1) of MiCA obliges legal persons or other
undertakings that intend to provide crypto-asset services to submit their application for
an authorisation as a CASP to the NCA of their home Member State.

Explanation: The evidence from the Australian Corporations Act (Regime A) focuses on the interaction with the Australian Charities and Not-for-profits Commission Act, detailing specific provisions regarding company constitutions, director duties, and winding up (chunk_id 0fc4f857c226f510::375::66b5). The evidence from the EU MiCA Title V CASP (Regime B) outlines the requirements for authorisation as a Crypto-Asset Service Provider (CASP) under Article 62, specifically mandating that legal persons intending to provide crypto-asset services submit an application to their National Competent Authority (chunk_id c51ad46265cea4e5::147::6214). The obligations in Regime A relate to general corporate governance and winding up, while Regime B addresses the licensing and authorisation of crypto-asset service providers. These are distinct regulatory domains with no apparent overlap of obligations, resulting in a non-conflict classification.


The crisis has shown that collateralised debt obligations comprised of
asset-backed securities (i.e. CDOs of ABS or so-called 'resecuritisations') are more
highly correlated with risk than are traditional securitisations. APRA reviewed its
prudential standard for securitisation and assessed that the current requirements do not
capture the risks associated with these resecuritisation structures. The BCBS also formed the view that increased disclosure requirements should
provide timely, relevant, reliable and useful decision-making information that
promotes institutional transparency. APRA also identified that its prudential
requirements for disclosure did not cover certain elements relating to an ADI's
securitisation exposures. Therefore, based on APRA's experience as the prudential supervisor during the crisis
and analysis of its prudential framework for ADIs, APRA believes that the
deficiencies that the Basel II enhancements are seeking to address exist in the
Australian prudential framework and present risks that require addressing.

Explanation: AU_APRA_PRUDENTIAL (APRA's broader prudential framework — including Basel-aligned standards) and INT_BASEL_CRYPTO (Basel d424 prudential treatment of crypto-asset exposures by banks). APRA implements Basel-style prudential standards in Australia; the cited A passage is a Basel II Enhancements RIS document confirming the Basel-implementation relationship. Reinforcing.


11.8 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

11.9 Where the ordering institution is unable to comply with the requirements in paragraphs
11.3 to 11.8, it shall not execute the wire transfer.
Responsibility of the Beneficiary Institution

11.10 A bank that is a beneficiary institution shall take reasonable measures, including post-
event monitoring or real-time monitoring where feasible, to identify cross-border wire
transfers that lack the required wire transfer originator or required wire transfer beneficiary
information.

11.11 For cross-border wire transfers, a beneficiary institution shall identify and verify the
identity of the wire transfer beneficiary if the identity has not been previously verified.

15.10 All wire transfer originator and beneficiary information collected by the ordering institution
shall be documented.

15.11 Where the ordering institution is unable to comply with the requirements in paragraphs
15.3 to 15.10, it shall not execute or arrange for the wire transfer.

Responsibility of the Beneficiary Institution

15.12 A payment service provider that is a beneficiary institution shall take reasonable
measures, including post-event monitoring or real-time monitoring where feasible, to
identify cross-border wire transfers that lack the required wire transfer originator or
required wire transfer beneficiary information.

15.13 For cross-border wire transfers where the beneficiary institution pays out funds in cash or
cash equivalent to the wire transfer beneficiary in Singapore, a beneficiary institution shall
identify and verify the identity of the wire transfer beneficiary if the identity has not been
previously verified.

11.7 In a domestic wire transfer, every finance company that is an ordering institution shall
either -
(a) include in the message or payment instruction that accompanies or relates to the
wire transfer the following:
(i) the name of the wire transfer originator;
(ii) the wire transfer originator's account number (or unique transaction
reference number where no account number exists); and
(iii) any of the following
(A) the wire transfer originator's:
(1) residential address; or
(2) registered or business address, and if different, principal place
of business,
as may be appropriate;
(B) the wire transfer originator's unique national identification number
(such as an identity card number, birth certificate number or passport
number, or where the wire transfer originator is not a natural person,
the incorporation number or business registration number);
(C) the date and place of birth, incorporation or registration of the wire
transfer originator (as may be appropriate); or
(b) include only the wire transfer originator's account number (or unique transaction
reference number where no account number exists), provided -
(i) that these details will permit the transaction to be traced back to the wire
transfer originator and wire transfer beneficiary;
(ii) the ordering institution shall provide the wire transfer originator information
set out in paragraph 11.7(a) within 3 business days of a request for such
information by the beneficiary institution, by the Authority or other relevant
authorities in Singapore; and
(iii) the ordering institution shall provide the wire transfer originator information
set out in paragraph 11.7(a) immediately upon request for such information
by law enforcement authorities in Singapore.

Transfer of personal data outside Singapore
26.-(1) An organisation must not transfer any personal data to a
country or territory outside Singapore except in accordance with
requirements prescribed under this Act to ensure that organisations
provideastandardofprotectiontopersonaldatasotransferredthatis
comparable to the protection under this Act. (2) The Commission may, on the application of any organisation,
by written notice exempt the organisation from any requirement 33 Act 2012 2020Ed.
prescribed pursuant to subsection (1) in respect of any transfer of
personal data by that organisation. (3) An exemption under subsection (2) -
(a) may be granted subject to such conditions as the
Commission may specify in writing; and
(b) neednotbepublishedintheGazetteandmayberevokedat
any time by the Commission. (4) The Commission may at any time add to, vary or revoke any
condition imposed under this section.

PART 3
GENERAL RULES WITH RESPECT TO
PROTECTION OFAND ACCOUNTABILITY FOR
PERSONAL DATA
11. Compliance with Act
12. Policies and practices

2020Ed. Act 2012 2

PART 4
COLLECTION, USE AND DISCLOSURE OF
PERSONAL DATA
Division 1 - Consent
Section
13. Consent required
14. Provision of consent
15. Deemed consent
15A. Deemed consent by notification
16. Withdrawal of consent
17. Collection, use and disclosure without consent
Division 2 - Purpose
18. Limitation of purpose and extent
19. Personal data collected before 2 July 2014
20. Notification of purpose

PART 5
ACCESS TO AND CORRECTION OF
PERSONAL DATA
21. Access to personal data
22. Correction of personal data
22A. Preservation of copies of personal data

13 Act 2012 2020Ed.
by a data intermediary as if the personal data were processed by the
organisation itself. (4) This Act does not apply in respect of -
(a) personal data about an individual that is contained in a
record that has been in existence for at least 100 years; or
(b) personal data about a deceased individual, except that the
provisions relating to the disclosure of personal data and
section 24 (protection of personal data) apply in respect of
personal data about an individual who has been dead for
10 years or less. (5) Except where business contact information is expressly
mentioned, Parts 3, 4, 5, 6 and 6A do not apply to business contact
information.
[40/2020]
(6) Unless otherwise expressly provided in this Act -
(a) nothinginParts 3,4, 5, 6, 6Aand6Baffectsanyauthority,
right, privilege or immunity conferred, or obligation or
limitation imposed, by or under the law, including legal
privilege, except that the performance of a contractual
obligation is not an excuse for contravening this Act; and
(b) theprovisionsofotherwrittenlawprevailtotheextentthat
any provision of Parts 3, 4, 5, 6, 6A and 6B is inconsistent
with the provisions of that other written law.
[40/2020]

Explanation: MAS AML/CFT Notices 626, 824, 1014 and PSN01 require ordering institutions to collect, transmit and document originator and beneficiary identifying information for wire transfers, and to refuse to execute the transfer where the information cannot be obtained. The PDPA imposes a consent framework on the collection, use and disclosure of personal data, supplemented by Section 26 which forbids transfers of personal data outside Singapore unless comparable protection is ensured. The textual tension is between a consent baseline (PDPA Part 4) plus a cross-border restriction (s 26) on one side, and a mandatory disclosure / transmission obligation (the MAS travel-rule clauses) on the other. The resolution path is operational rather than structural: PDPA Part 4 Division 3 allows collection, use and disclosure without consent where required or authorised under any written law (and the MAS Notices, made under the MAS Act and PSA, are such law); the cross-border restriction is satisfied where the receiving institution is itself subject to comparable AML/CFT obligations. The tension becomes real where the receiving counterparty is in a jurisdiction without comparable protections — there the institution must rely on the prescribed contractual / certification mechanisms or refuse the transfer under the MAS Notices' own paragraphs 11.9 / 15.11.

Rely on the PDPA 'required or authorised by law' exception for the use/disclosure of originator/beneficiary information under MAS Notices.

For cross-border transmission, evidence that the receiving institution is bound by comparable obligations (the PDPA s 26 standard) or use a prescribed legally enforceable obligation, e.g. binding contractual clauses.

When 11.3–11.8 cannot be satisfied, refuse the wire transfer (which is itself the lawful PDPA-compatible outcome).

The ordering institution is a MAS-regulated FI captured by Notices 626 / 824 / 1014 / PSN01 / PSN02; non-FI obligated entities (e.g. DPT service providers under PSA) follow a parallel but not identical regime.

Beneficiary institution exists and can be identified — covered-payment-instrument and crypto-asset transfers are not separately analysed here.


121 See Corporations Act, s 761E.
Annexure 1. Legal and regulatory framework | 41

Regulator: AUSTRAC
Relevant Legislation: AML/CTF Act
Digital currency exchanges are regulated by AUSTRAC under the Anti Money Laundering and
Counter Terrorism Financing (AML/CTF) Act for the purposes of preventing and detecting money
laundering and terrorism financing.
Digital currency exchanges must register with AUSTRAC and meet AML/CTF compliance and
reporting obligations (including Know Your Customer requirements).
Regulator: ATO
Relevant Legislation: Income Tax Act, Goods and Services Tax Act
Investors in crypto tokens and other market participants are subject to tax laws. If an entity is
carrying on a business in relation to digital currency, or as part of their existing business, or if
they are accepting digital currency as a payment in business, the entity needs to consider any
GST consequences that may arise.
Tax implications for investors flow from the underlying nature of the rights and obligations
attached to the asset and the personal circumstances of the investor. Crypto tokens will
generally be capital assets, meaning there could be capital gains tax consequences.122

For example, distributed
computing, document authentication, algorithmic insurance, and micro payments. The ATO estimates that
more than one million taxpayers have interacted with the ecosystem since 2018. However, the crypto asset ecosystem presents unique challenges to the existing regulatory framework. In
particular, it is difficult to identify the relevant regulatory framework that may, or may not apply to different
crypto assets and related services. This causes confusion for various stakeholders including consumers,
industry, and regulators. The Select Committee on Australia as a Technology and Financial Centre's Final Report was released in
October 2021 and considered the regulation of the crypto sector. The Final Report found that the sector
lacked regulatory certainty to ensure safeguards for investors while lending credibility and certainty to the
industry. In response, on 21 March 2022, Treasury released a consultation paper on Crypto asset secondary
service providers: Licensing and custody requirements seeking views on proposed options for licensing and
custody frameworks as well as preliminary views on token mapping.

Treasury received substantial feedback
from a range of stakeholders with industry-wide support for clarity on the regulatory settings for crypto
assets. In particular, key stakeholders flagged the need to prioritise the 'token mapping' work, which
involves reviewing a range of crypto assets to identify how they fit within the existing regulatory framework. Accordingly, to commence the reform agenda, I will prioritise the complex 'token mapping' work in 2022. Token mapping is a foundational piece of work to support Government to identify how crypto assets and
related services ought to be regulated. It will also importantly aid the development of a licensing framework
by assisting in demarcating the perimeter between financial product crypto assets (already the subject of
financial services laws) and non-financial product crypto assets (that may warrant a separate crypto asset
regulatory framework). Parliament House Canberra ACT 2600 Australia
OFFICIAL: Sensitive OFFICIAL: Sensitive Subject to your agreement, I propose to announce the reform agenda, commence stakeholder consultations
and release a public consultation paper on token mapping in 2022 (as indicated in Treasury's earlier
consultation paper on crypto licensing and custody requirements).

16. After token mapping, licensing and custody reforms are the logical next step for crypto reforms
in Australia. The identification of appropriate obligations and operational standards for crypto
asset service providers and how they safe-keep assets for customers is a key step for consumer
protection; ensuring consumers do not lose assets to avoidable business failure or misuse of
assets by the provider.

17. The Government will release a consultation paper proposing a licensing and custody framework
for crypto asset service providers in mid-2023 to allow for sufficient consultation prior to the
introduction of legislation. The paper will reflect ongoing work and consultation in this area and
leverage the findings from the token mapping exercise. The responses to the following
questions will help inform the general direction of future policy and potential consumer
protections.

Explanation: AU_ATO_CRYPTO (ATO crypto-asset tax framework — every crypto disposal is a CGT event requiring identification of the cost base, recordkeeping, and taxpayer reporting) and AU_TREASURY_DAP (Australia's proposed Digital Asset Platforms licensing regime — operational obligations on platform operators for client services). The friction is recurring: every transaction on a DAP-licensed platform creates a CGT event for the user AND an operational/recordkeeping obligation for the platform. Neither regime creates the other's obligation, but their combination scales with platform throughput, imposing an ongoing cost that is a function of design choice (treating crypto disposals as taxable events rather than as currency transactions).


This paper represents a foundational step in the Government's multi-stage reform agenda that will
implement appropriate regulatory settings and support innovation. Token mapping plays a critical role in understanding the crypto ecosystem and ensuring a consistent
and fair approach to the regulation of crypto assets in Australia. Primarily, this paper explores where
existing regulation applies and helps set the path for future reforms. Increased mainstream interest
Over the past decade, there has been increased mainstream interest from both financial markets and
consumers in the crypto ecosystem. Over 1 million Australians are expected to include crypto assets
on their tax returns in FY 2022. This trend has created emerging risks and opportunities. According to Chainalysis' crypto adoption index, Australia ranks 40th globally for crypto adoption, with
retail transactions at centralised exchanges also ranking 40th globally when measured by purchasing
power parity per capita (see Figure 1).1
Figure 1: Global crypto adoption index
Source: Chainalysis September 2022
From global market capitalisation highs of US$3.0 trillion (AU$4.1 trillion) in November 2021, crypto
asset markets have lost around 63 per cent of their value and are now valued at US$1.0 trillion
(AU$1.5 trillion).2 The turbulence in crypto asset markets over the past year highlights some of the
risks.

Article 52
Liability of issuers of e-money tokens for the information given in a crypto-asset white paper
1.
Where an issuer of an e-money token has infringed Article 51, by providing in its crypto-asset white paper or in a
modified crypto-asset white paper, information that is not complete, fair or clear, or that is misleading, that issuer and
the members of its administrative, management or supervisory body shall be liable to a holder of such e-money token
for any loss incurred due to that infringement.
2.
Any contractual exclusion or limitation of civil liability as referred to in paragraph 1 shall be deprived of legal
effect.
3.
It shall be the responsibility of the holder of the e-money token to present evidence indicating that the issuer of
that e-money token has infringed Article 51 by providing in its crypto-asset white paper or in a modified crypto-asset
white paper information that is not complete, fair or clear, or that is misleading and that reliance on such information
had an impact on the holder's decision to purchase, sell or exchange that e-money token.
4.
The issuer and the members of its administrative, management or supervisory bodies shall not be liable for loss
suffered as a result of reliance on the information provided in a summary pursuant to Article 51(6), including any
translation thereof, except where the summary:
(a) is misleading, inaccurate or inconsistent when read together with the other parts of the crypto-asset white paper; or
(b) does not provide, when read together with the other parts of the crypto-asset white paper, key information in order
to aid prospective holders when considering whether to purchase such e-money tokens.
5.
This Article is without prejudice to any other civil liability pursuant to national law.
EN
L 150/110

Explanation: The evidence from the Australian Taxation Office (ATO) focuses on the taxation of crypto assets and the token mapping process (chunk_id e6bb47e92e88e16c::567::36c4). In contrast, the evidence from the EU MiCA Title IV EMT focuses on the liability of issuers of e-money tokens for information provided in crypto-asset white papers (chunk_id 491a2f0014d56ffb::702::05e4). The obligations described in the EU passage relate to the disclosure and liability standards for issuers, whereas the ATO passage relates to tax compliance and ecosystem mapping. These are distinct regulatory domains with no apparent overlap of obligations.


7. The FATF adopted this Guidance at its June 2019 Plenary. Following the adoption of
this Guidance and the revisions to the FATF Standards, the FATF continued its
enhanced monitoring of the VA sector and the implementation of the revised
Standards by countries. In March 2020, the FATF released its Guidance on Digital ID
to assist in identifying customers in the digital context. While this guidance
addresses Digital ID broadly, it includes useful information for VASPs. In June 2020,
the FATF completed its 12-Month Review of the Revised FATF Standards on VAs and
VASPs, which identified areas where greater FATF guidance was necessary to clarify
the application of the revised FATF Standards. Simultaneously with this report, the
FATF also released its Report to the G20 on So-called Stablecoins. This report sets out
how the revised FATF Standards apply to so-called stablecoins and considers the
AML/CFT issues.

Strengthening AML/CFT Controls of
Digital Payment Token Service Providers
March 2021 Introduction
This infographic sets out recent international developments and MAS' supervisory expectations on
AML/CFT controls for the Digital Payment Token (DPT) sector.
• This infographic is intended to raise industry awareness to the money laundering and terrorism financing (ML/TF)
risks in the DPT sector, and provide additional supervisory information to help DPT service providers implement
effective policies, procedures and controls to deal with the ML/TF risks.
• In particular, this infographic focuses on:
I) Financial Action Task Force (FATF) Standards and recent developments;
II) ML/TF Risks in DPT sector; and
III) Overview of MAS' AML/CFT requirements and expectations for the DPT sector - including key AML/CFT
considerations relating to new DPT products, enhanced customer due diligence (ECDD) and value transfer.
• The infographic supplements existing AML/CFT requirements, and should be read in conjunction with the Notice
PS-N02 and accompanying Guidelines.

Explanation: FATF_R16 (FATF Recommendation 16 — international travel-rule standard) and SG_AML (MAS Notice 314 + DPT-specific AML guidance — Singapore's AML/CFT framework). Singapore's AML framework implements FATF standards including R16 for DPT providers. Reinforcing rather than conflicting; SG operates as implementing jurisdiction for the FATF standard.