Chapter 2 The Design of Internal Control System |
| Article 9 |
Financial holding companies and the banking business shall establish the Three Lines Model for internal control, which shall include a self-inspection system; a legal compliance system, risk management system, and information security system; and an internal audit system.
The structure of the Three Lines Model in the preceding paragraph shall ensure that all units understand their respective duties and functions within the institution's overall risk and internal control framework. Each of the three lines shall fulfill its own duties, and communication and coordination between the units executing internal control tasks and the internal audit unit shall be strengthened to maintain the effective and appropriate operation of the internal control system.
The implementation procedures for the Code of Practice for the Three Lines Model of Internal Control of Banks shall be formulated by the Bankers Association of the Republic of China and submitted to the competent authority for recordation. |
| Article 10 |
The internal control system of a financial holding company or banking business shall incorporate the following components:
1. Control Environment: The Control Environment is the basis for the design and implementation of internal control systems across a financial holding company or banking business. It encompasses the integrity and ethical values of a financial holding company or banking business, the governance oversight responsibility of its board of directors and supervisors (board of supervisors) or audit committee, organizational structure, assignment of authority and responsibility, human resources policy, performance measures, and awards and disciplines. The board of directors and management shall uphold the principle of treating customers fairly and establish ethical corporate management best practice principles and internal codes of conduct, including codes of conduct for directors and employees.
2. Risk Assessment: A precondition to risk assessment is the identification of objectives, linked at different levels of the financial holding company or banking business, and the suitability of the objectives shall also be taken into consideration. The management shall consider the impact of changes in the external environment and within its own business model and possible fraud scenarios. The risk assessment results can assist the financial holding company or banking business in designing, correcting, and implementing necessary controls in a timely manner.
3. Control Operations: Control operations means the actions of adopting proper policies and procedures by a financial holding company or banking business based on the risk assessment results to control risks within a tolerable range. Control operations shall be performed at all levels of a financial holding company or business, at various stages of business processes, and over the technological environment. They shall include the supervision and management of subsidiaries, appropriate segregation of duties, and measures ensuring that management and employees are not assigned conflicting responsibilities.
4. Information and Communication: Information and communication refers to relevant and high-quality information that a financial holding company or banking business obtains, generates, or uses from both internal and external sources to support the continuous functioning of other components of internal control, and to ensure that information can be effectively communicated within and outside the organization. The internal control system must have mechanisms to generate information necessary for planning, implementation, and supervision and to enable timely access to information by those who need it, and the system shall maintain comprehensive internal financial, operational and compliance data. An effective internal control system shall also establish appropriate channels of communication.
5. Monitoring Operations: Monitoring operations means ongoing evaluations, individual evaluations, or combination of the two undertaken by a financial holding company or banking business to ascertain whether each of the components of internal control is present and continuously functioning. Ongoing evaluations means routine evaluations built into the course of operations at different levels. Individual evaluations are evaluations conducted by different personnel such as internal auditors, supervisors (or board of supervisors) or audit committee, or the board of directors. Findings of deficiencies of the internal control system shall be communicated to management of appropriate levels, the board of directors, and supervisors (board of supervisors) or audit committee, and improvements shall be made in a timely manner.
A financial holding company shall supervise its subsidiaries to ensure that their internal control systems incorporate the components prescribed in the preceding paragraph. |
| Article 11 |
The code of conduct for directors mentioned in Subparagraph 1 of the preceding Article shall contain at least the rules that when a director discovers that the financial holding company or banking business is in danger of sustaining material loss or damage, the director shall promptly take appropriate actions and immediately notify the audit committee or independent director members of the audit committee or supervisors (board of supervisors), and report to the board of directors, and supervise the financial holding company or banking business to report to the competent authority. |
| Article 12 |
The internal control system shall cover all business activities, including appropriate policies and procedures as follows, and shall be reviewed and revised in a timely manner:
1. Organizational chart or corporate rules and bylaws, including a clear organizational system, unit functions, scope of operations for each unit, and rules governing authorizations and hierarchical delegation of responsibilities.
2. Related business regulations and handling guides, including:
(1) Investment guidelines.
(2) Customer data confidentiality.
(3) Regulation on interested party transactions.
(4) Shares management.
(5) Management of the preparation process of financial statements, including management of the application of International Financial Reporting Standards, procedures for professional accounting judgments, and processes for making changes in accounting policies and estimates.
(6) Management of administration of general affairs, information, and personnel affairs (for banking business, it shall contain regulations for regular transfer and vacation).
(7) Management of operations for disclosing information externally.
(8) Management of financial examination report.
(9) Management of protection of financial consumers.
(10) Mechanism for handling major contingencies.
(11) Mechanism for anti-money laundering and countering the financing of terrorism (AML/CFT) and management of compliance with relevant laws and regulations, including the management mechanism for identifying, assessing, and monitoring AML/CFT risks.
(12) Management of sustainability information.
(13) Business continuity management mechanisms.
(14) Other business rules and operating procedures.
The business regulations and handling guides of a financial holding company shall also include the management and collaborated marketing management of its subsidiary company.
The business regulations and handling guides of a bank shall additionally include cash handling, deposits, remittances, credit extensions, foreign exchange, new financial products, management of outsourcing operations, the accountability map system, and businesses prescribed in Article 3 of the Banking Act.
The business regulations and handling guides of a credit cooperative shall additionally include cash handling, deposits, credit extensions, remittances, management of outsourcing operations, and businesses prescribed in Article 15 of the Credit Cooperatives Act.
The business regulations and handling guides of a bills finance company shall additionally include bills, bonds, new financial products, and businesses prescribed in Article 21 of The Act Governing Bills Finance Business.
The template for the operation guides of a trust business should be stipulated by the trust association of the R.O.C., with content specifying business operation procedure, accounting operation procedure, computer operation procedure, personnel management system, and other items. A trust business should establish its operation guidelines based on the reference template and make regular revisions in accordance with the alterations in legal regulations, business items, and business procedure.
The internal control system of a financial holding company or banking business whose stock is listed on the stock exchange or traded over the counter shall include the management of the operations of the remuneration committee.
The internal control system of a financial holding company or banking business that has an audit committee set up shall include management of the operation of the audit committee.
A financial holding company or banking business shall establish mechanisms for the supervision and management of its subsidiaries within its internal control system. Where a subsidiary is located in a foreign country, the parent company shall take into account local laws and regulations issued by the host government as well as the actual nature of its operations, so as to supervise the subsidiary in establishing its own internal control system.
Financial holding companies and the banking business shall establish a group-level AML/CFT program, which shall include intra-group information sharing policies and procedures for AML/CFT purposes, based on the laws and regulations of countries or jurisdictions where the foreign branches (or subsidiaries) are located.
The formulation, amendment, or repeal of various operational and management regulations specified in the preceding ten paragraphs shall, when necessary, involve the participation of relevant departments, including dedicated units for legal compliance, risk management, and information security, as well as the internal audit unit. |
| Article 13 |
Financial holding companies and the banking business shall establish a whistleblowing mechanism and designate, at their head offices, a unit that independently exercises its functions to receive and investigate whistleblowing cases, thereby promoting their sound operation.
A financial holding company or banking business shall protect the whistleblower as follows:
1. The whistleblower’s identity shall be kept confidential; no information that may be used to identify that person shall be disclosed.
2. The whistleblower shall not be terminated, dismissed, downgraded/relocated, given a reduction in pay, impairment to any entitlement under the law, contract or customs, or other unfavorable disposition due to the reported case.
Any interested person shall recuse himself from the acceptance and investigation of the reported case.
The whistleblower system, in Paragraph 1, shall at least cover the following procedures, and be resolved by the board of directors:
1. Expressly specifies that anyone may file the report when discovering any crime, corruption, or potential legal violation.
2. The types of reporting that will be accepted.
3. Establishes and publishes the channel of reporting.
4. The procedures of investigation and collaborative support, rules of recusal and the standard operating procedure of subsequent disposition mechanism.
5. Whistleblower protection measures.
6. Acceptance of reported cases, investigation processes, investigation results, and the documentation, record-keeping, and retention of relevant files.
7. The whistleblower shall be given appropriate notice in writing or by other means with respect to the progress of the reported case.
If the alleged perpetrator is a director, supervisor, or a managerial officer of an equivalent level higher than vice general manager, the investigation report shall be reviewed by the supervisors (or members of the supervisory board, or the supervisory board), or the audit committee.
Financial holding companies and the banking business shall report or file the critical incident, or material violation discovered in the investigation with relevant authorities.
A financial holding company or banking business shall hold regular promotional program and education training of the whistleblower system for its personnel. |