Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 21

Financial holding companies and the banking business shall establish a dedicated risk management unit subordinate to the general manager to take charge of the planning, management, and execution of the risk management system. The unit shall not concurrently engage in other operations that present a conflict of interest with its duties. A person ranked vice general manager or above, or a person with equivalent responsibilities, shall be appointed to serve as the Chief Risk Officer (CRO) to oversee risk management affairs.The dedicated risk management unit shall periodically measure relevant risks and submit risk management reports to the board of directors. Upon identifying a significant risk exposure that might adversely affect its financial or business status or compliance with applicable acts and regulations, it shall take immediate and adequate countermeasures and submit a report to the board of directors. The overall implementation of risk management of the preceding year shall be incorporated into the assessment of the implementation of the internal control system referred to in Paragraph 1 of Article 8 annually.The dedicated risk management unit shall establish clear and appropriate mechanisms for the transmission, consultation, coordination, and communication of risk management.Where the competent authority has provided otherwise for credit cooperatives and bills finance companies regarding the provisions of Paragraph 1, such provisions shall govern. With respect to the establishment of the dedicated risk management unit, a credit cooperative may designate a head office management unit as an alternative.