Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 16

Financial holding companies and the banking business shall establish a dedicated legal compliance unit subordinate to the general manager to take charge of the planning, management, and execution of the legal compliance system, and appoint a person ranked vice general manager or above, or a person with equivalent responsibilities, to serve as the Chief Compliance Officer (CCO) to oversee legal compliance affairs. The chief compliance officer shall report to the board of directors and supervisors (board of supervisors) or the audit committee at least semi-annually. Upon discovering a material violation of laws and regulations or a downgrade of its rating by competent financial authorities, the CCO shall immediately notify the directors and supervisors (board of supervisors) and submit a report on legal compliance matters to the board of directors.The dedicated legal compliance unit mentioned in the preceding paragraph may concurrently handle matters related to anti-money laundering, countering the financing of terrorism, and anti-fraud. The unit shall not concurrently engage in legal affairs unrelated to the planning, management, and execution of the legal compliance system, or other operations that present a conflict of interest with its duties. The chief compliance officer may serve concurrently as the head of the dedicated unit for anti-money laundering, countering the financing of terrorism, and anti-fraud. However, the chief compliance officer shall not serve concurrently as the head of the legal affairs unit or hold other internal positions.Where the competent authority has provided otherwise for credit cooperatives and bills finance companies regarding the provisions of the preceding two paragraphs, such provisions shall govern.The CCO of a financial holding company or a bank shall meet the qualification requirements set out respectively in the “Regulations Governing Qualification Requirements for the Promoter or Responsible Persons of Financial Holding Companies and Concurrent Serving Restrictions and Matters for Compliance by the Responsible Persons of a Financial Holding Company” and in the “Regulations Governing Qualification Requirements and Concurrent Serving Restrictions and Matters for Compliance by the Responsible Persons of Banks”.The dedicated legal compliance unit of the head office, domestic and foreign business units, information unit, assets safekeeping unit, and other management units of a financial holding company or a banking business shall each assign the personnel to act as the compliance officer to take charge of related affairs. Arranging the compliance officer position in the foreign business unit shall comply with the local regulations and the requirements of the local authorities and the compliance officer shall not hold other posts except in any of the following situations:1 The compliance officer serves concurrently as the AML/CFT compliance officer.2. The compliance officer holds concurrent posts that do not constitute a conflict of interest according to the local regulations.3. It is not strictly prohibited in the local regulations regarding the holding of concurrent posts, provided the holding of concurrent post does not result or potentially result in conflict of interest and the matter has been communicated with and confirmed by the local competent authority and reported to the competent authority for recordation.If a Taiwan branch of a foreign bank is unable to appoint a person to serve as the compliance officer in its business units, information technology units, finance and custody units, and other management units in accordance with the preceding paragraph, it shall adopt appropriate alternative methods to achieve the same functions required in the preceding paragraph.The chief officer and personnel of the dedicated compliance unit of a financial holding company or the head office of a banking business, as well as the compliance officer of its domestic and foreign business units, information department, assets management department, and other management departments shall meet one of the following qualification requirements:1. Having worked as personnel or chief officer of legal compliance office at any financial institute for five years in aggregate.2. Having attended not less than 30 hours of courses offered by institutions recognized by the competent authorities, passed the exams and received completion certificates, therefore.3. The compliance officer of a foreign business unit who is hired locally, has shown his/her familiarity with local regulations and competence in related matters according to the self-assessment of the assessment procedures resolved by the board of directors, or the review and acknowledgement by the local competent authority.