Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 12
The internal control system shall cover all business activities, including appropriate policies and procedures as follows, and shall be reviewed and revised in a timely manner:1. Organizational chart or corporate rules and bylaws, including a clear organizational system, unit functions, scope of operations for each unit, and rules governing authorizations and hierarchical delegation of responsibilities.2. Related business regulations and handling guides, including:(1) Investment guidelines.(2) Customer data confidentiality.(3) Regulation on interested party transactions.(4) Shares management.(5) Management of the preparation process of financial statements, including management of the application of International Financial Reporting Standards, procedures for professional accounting judgments, and processes for making changes in accounting policies and estimates.(6) Management of administration of general affairs, information, and personnel affairs (for banking business, it shall contain regulations for regular transfer and vacation).(7) Management of operations for disclosing information externally.(8) Management of financial examination report.(9) Management of protection of financial consumers.(10) Mechanism for handling major contingencies.(11) Mechanism for anti-money laundering and countering the financing of terrorism (AML/CFT) and management of compliance with relevant laws and regulations, including the management mechanism for identifying, assessing, and monitoring AML/CFT risks.(12) Management of sustainability information.(13) Business continuity management mechanisms.(14) Other business rules and operating procedures.The business regulations and handling guides of a financial holding company shall also include the management and collaborated marketing management of its subsidiary company.The business regulations and handling guides of a bank shall additionally include cash handling, deposits, remittances, credit extensions, foreign exchange, new financial products, management of outsourcing operations, the accountability map system, and businesses prescribed in Article 3 of the Banking Act.The business regulations and handling guides of a credit cooperative shall additionally include cash handling, deposits, credit extensions, remittances, management of outsourcing operations, and businesses prescribed in Article 15 of the Credit Cooperatives Act.The business regulations and handling guides of a bills finance company shall additionally include bills, bonds, new financial products, and businesses prescribed in Article 21 of The Act Governing Bills Finance Business.The template for the operation guides of a trust business should be stipulated by the trust association of the R.O.C., with content specifying business operation procedure, accounting operation procedure, computer operation procedure, personnel management system, and other items. A trust business should establish its operation guidelines based on the reference template and make regular revisions in accordance with the alterations in legal regulations, business items, and business procedure.The internal control system of a financial holding company or banking business whose stock is listed on the stock exchange or traded over the counter shall include the management of the operations of the remuneration committee.The internal control system of a financial holding company or banking business that has an audit committee set up shall include management of the operation of the audit committee.A financial holding company or banking business shall establish mechanisms for the supervision and management of its subsidiaries within its internal control system. Where a subsidiary is located in a foreign country, the parent company shall take into account local laws and regulations issued by the host government as well as the actual nature of its operations, so as to supervise the subsidiary in establishing its own internal control system.Financial holding companies and the banking business shall establish a group-level AML/CFT program, which shall include intra-group information sharing policies and procedures for AML/CFT purposes, based on the laws and regulations of countries or jurisdictions where the foreign branches (or subsidiaries) are located.The formulation, amendment, or repeal of various operational and management regulations specified in the preceding ten paragraphs shall, when necessary, involve the participation of relevant departments, including dedicated units for legal compliance, risk management, and information security, as well as the internal audit unit.
中文原文 金融控股公司及銀行業內部控制及稽核制度實施辦法第12條
內部控制制度應涵蓋所有營運活動，並應訂定下列適當之政策及作業程序，且應適時檢討修訂：
一、組織規程或管理章則，應包括訂定明確之組織系統、單位職掌、業務範圍與明確之授權及分層負責辦法。
二、相關規範及處理手冊，包括：
（一）投資準則。
（二）客戶資料保密。
（三）利害關係人交易規範。
（四）股權管理。
（五）財務報表編製流程之管理，包括適用國際財務報導準則之管理、會計專業判斷程序、會計政策與估計變動之流程等。
（六）總務、資訊、人事管理（銀行業應含輪調及休假規定）。
（七）對外資訊揭露作業管理。
（八）金融檢查報告之管理。
（九）金融消費者保護之管理。
（十）重大偶發事件之處理機制。
（十一）防制洗錢及打擊資恐機制及相關法令之遵循管理，包括辨識、衡量、監控洗錢及資恐風險之管理機制。
（十二）永續資訊之管理。
（十三）營運持續管理機制。
（十四）其他業務之規範及作業程序。
金融控股公司業務規範及處理手冊應另包括子公司之管理及共同行銷管理。
銀行業務規範及處理手冊應另包括出納、存款、匯兌、授信、外匯、新種金融商品、委外作業管理、責任地圖制度及銀行法第三條所定業務等。
信用合作社業務規範及處理手冊應另包括出納、存款、授信、匯兌、委外作業管理及信用合作社法第十五條所定業務等。
票券商業務規範及處理手冊應另包括票券、債券、新種金融商品及票券金融管理法第二十一條所定業務等。
信託業作業手冊之範本由信託業商業同業公會訂定，其內容應區分業務作業流程、會計作業流程、電腦作業規範、人事管理制度等項。
信託業應參考範本訂定作業手冊，並配合法規、業務項目、作業流程等之變更，定期修訂。
股票已在證券交易所上市或於證券商營業處所買賣之金融控股公司及銀行業，應將薪資報酬委員會運作之管理納入內部控制制度。
金融控股公司及銀行業設置審計委員會者，其內部控制制度，應包括審計委員會議事運作之管理。
金融控股公司及銀行業應於內部控制制度中，訂定對子公司必要之控制作業，其為國外子公司者，並應考量該子公司所在地政府法令之規定及實際營運之性質，督促其子公司建立內部控制制度。
金融控股公司及銀行業應建立集團整體性防制洗錢及打擊資恐計畫，包括在符合國外分公司（或子公司）當地法令下，以防制洗錢及打擊資恐為目的之集團內資訊分享政策及程序。
前十項各種作業及管理規章之訂定、修訂或廢止，必要時應有法令遵循、風險管理、資訊安全等專責單位及內部稽核單位等相關單位之參與。
一、組織規程或管理章則，應包括訂定明確之組織系統、單位職掌、業務範圍與明確之授權及分層負責辦法。
二、相關規範及處理手冊，包括：
（一）投資準則。
（二）客戶資料保密。
（三）利害關係人交易規範。
（四）股權管理。
（五）財務報表編製流程之管理，包括適用國際財務報導準則之管理、會計專業判斷程序、會計政策與估計變動之流程等。
（六）總務、資訊、人事管理（銀行業應含輪調及休假規定）。
（七）對外資訊揭露作業管理。
（八）金融檢查報告之管理。
（九）金融消費者保護之管理。
（十）重大偶發事件之處理機制。
（十一）防制洗錢及打擊資恐機制及相關法令之遵循管理，包括辨識、衡量、監控洗錢及資恐風險之管理機制。
（十二）永續資訊之管理。
（十三）營運持續管理機制。
（十四）其他業務之規範及作業程序。
金融控股公司業務規範及處理手冊應另包括子公司之管理及共同行銷管理。
銀行業務規範及處理手冊應另包括出納、存款、匯兌、授信、外匯、新種金融商品、委外作業管理、責任地圖制度及銀行法第三條所定業務等。
信用合作社業務規範及處理手冊應另包括出納、存款、授信、匯兌、委外作業管理及信用合作社法第十五條所定業務等。
票券商業務規範及處理手冊應另包括票券、債券、新種金融商品及票券金融管理法第二十一條所定業務等。
信託業作業手冊之範本由信託業商業同業公會訂定，其內容應區分業務作業流程、會計作業流程、電腦作業規範、人事管理制度等項。
信託業應參考範本訂定作業手冊，並配合法規、業務項目、作業流程等之變更，定期修訂。
股票已在證券交易所上市或於證券商營業處所買賣之金融控股公司及銀行業，應將薪資報酬委員會運作之管理納入內部控制制度。
金融控股公司及銀行業設置審計委員會者，其內部控制制度，應包括審計委員會議事運作之管理。
金融控股公司及銀行業應於內部控制制度中，訂定對子公司必要之控制作業，其為國外子公司者，並應考量該子公司所在地政府法令之規定及實際營運之性質，督促其子公司建立內部控制制度。
金融控股公司及銀行業應建立集團整體性防制洗錢及打擊資恐計畫，包括在符合國外分公司（或子公司）當地法令下，以防制洗錢及打擊資恐為目的之集團內資訊分享政策及程序。
前十項各種作業及管理規章之訂定、修訂或廢止，必要時應有法令遵循、風險管理、資訊安全等專責單位及內部稽核單位等相關單位之參與。