Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 29

Financial holding companies the banking business shall, after having regard to its investment scale, business condition (the number of its branches and amount of business), management needs, and relevant provisions of rules and regulations, staff competent persons in an appropriate number as full-time internal auditors who shall perform their duties in a detached, independent, objective, and impartial manner. Personnel of the internal audit unit shall be deputy to each other to cover each other's absence.An internal auditor of a financial holding company or banking business shall meet the following qualification requirements:1. Having not less than two (2) years of experience in financial examination; or having graduated from a college or university or passed a senior civil service examination or an equivalent examination, or the examination of certified internal auditor or certified information systems auditor and having not less than two (2) years of experience in financial business; or having not less than five (5) years of experience in financial business. A person is deemed to meet such requirements if he or she has worked as a professional, such as an auditor in an accounting firm, or a computer programmer or system analyst for not less than two (2) years and has received not less than three (3) months of training in the business operations and management of a financial institution. However, the number of this type of auditor cannot exceed one-half of the total auditors.2. Free of any record of demerit or more severe disciplinary action from employer in the last three (3) years, unless the demerit record was a result of joint and several disciplinary action on account of the violation or offense of another person, and the demerit has been offset by other merits; and3. If a lead auditor, have no less than three (3) years of experience in auditing or financial examination, or have no less than one (1) year of experience in auditing and no less than five (5) years of experience in financial business.The qualifications of the dedicated internal audit personnel of banks’ foreign business units must comply with the local regulations and the requirements of the local competent authority. However, if the local competent authority does not specify the qualifications for internal auditors hired locally, the foreign business unit shall hire employees in accordance with the evaluation and selection regulations passed by the board of directors, and the aforementioned regulations do not apply.Financial holding companies and the banking business shall examine whether the internal auditors have violated the regulations in the preceding three paragraphs. If the auditor has violated the rules, the company shall order the auditor to make improvement within two (2) months and shall be transferred to other job if he or she fails to make such improvement.