Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 20

Financial holding companies and the banking business shall formulate appropriate risk management policies and procedures, and establish an independent and effective risk management framework, which shall include procedures and mechanisms for identifying, assessing, measuring, and monitoring risks in order to control and report the overall risk tolerance, the current status of risks assumed, determination of risk response strategies, and the compliance status of risk management procedures.The risk management policies and procedures under the preceding paragraph shall be passed by the board of directors and be reviewed and revised in a timely manner.