Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 18

A banking business shall establish a bank-wide risk-based management and supervision framework for legal compliance. The basis of such framework, functions and responsibilities is specified as follows; where the competent authority has provided otherwise for credit cooperatives and bills finance companies, such provisions shall govern:1. The dedicated legal compliance unit shall set up the procedures, plans and mechanisms for identifying, assessing, controlling, measuring, monitoring, and independently reporting any compliance risk in order to generally control, supervise, and support each domestic or foreign department, branch, and subsidiary with respect to individual business unit, cross-department, and cross-territorial legal compliance.2. The dedicated legal compliance unit shall set up an adequate number of professional units based on the classification or business, or points of legal compliance, to monitor, implement and support the legal compliance of the local or foreign business units related to that business or legislation.3. The dedicated legal compliance unit may assess the appointment and enhance the independence of each chief compliance officer by risk-based approach. Notwithstanding the requirements in the first part of paragraph 5 of Article 16, an independent chief compliance officer is not required, and the legal compliance office of the head office will be responsible for a unit with lower compliance risk.4.The dedicated legal compliance unit shall establish the mechanism of independent reporting, assessment and disposition of compliance risk alert.5.The dedicated legal compliance unit shall assess the risk management of legal compliance for the primary operating activities, products and services, credit or business projects, and critical customer complaints subject to potential legal violation on a regular and ad-hoc basis and shall establish cross-functional communication links with the Risk Management and Information Security units.6. The dedicated legal compliance unit may request each unit to provide relevant information in order to understand the compliance risks across the bank.7. The performance evaluation of management and the head of each department shall incorporate the dedicated compliance unit's assessment opinion on their degree of implementation of legal compliance.8. The banking business and its dedicated legal compliance unit shall fully understand the compliance procedures applicable to the foreign business units, and the criteria required by the local competent authority, and provide full resources and support.9. The dedicated legal compliance unit shall specify the weakness of the compliance risk management, and supervise the improvement plans and schedules with respect to the local and foreign operations across the bank when reporting the legal compliance to the board of directors, and the supervisors or audit committee at least once every half year pursuant to paragraph 1 of Article 16; the board of directors (or the council) shall provide sufficient resources and appropriate mechanism of rewards and sanctions applicable to the business units in order to progressively establish a bank-wide culture of legal compliance.Within two years after establishing a dedicated legal compliance unit, a bank shall submit its bank-wide compliance risk management and oversight framework to the competent authority for recordation. Thereafter, by the end of April of each year, it shall submit to the competent authority the assessment reports referred to in Subparagraphs 5 and 9 of the preceding paragraphs.If a banking business has a foreign business unit, the dedicated legal compliance unit shall supervise the following tasks of the foreign business unit:1. Collecting data on local financial regulations, conducting self-evaluation of compliance operation, and ensuring the suitability of compliance officer and the adequacy of compliance resources (including personnel, equipment and training) so as to ensure compliance with the laws and regulations of the host country or jurisdiction.2. Establishing self-evaluation and monitoring mechanism for compliance risks, and for large business operation, highly complex business or business involving higher risk, engaging a local, outside, independent expert to verify the effectiveness of the self-assessment and monitoring mechanism.