I read page 11 as potentially revealling that ISX, in...

I read page 11 as potentially revealling that ISX, in combination with its own tech, uses a non prop technology such as Mastercard NuDetect for it's ongoing 2FA. This would give it access to the mobile phone data that you refer to.

On the second point, ISX is subject to the same AML regulations in the EU (probably applied more stringently than in AUS). This tells me that they have internal systems that adhere to AML reporting obligations.

What's obvious is that ISX doesn't have all the infrastructure in place in Aus to be tier 1 and needs to build it. This is pretty much what they have said, right?