Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 44

If the annual financial report of a banking business is audited and certified by a certified public accountant (CPA), the business shall also engage the CPA to conduct a special audit on its internal control system. The CPA shall also comment on the correctness of the report submitted to the competent authority for the banking business, the execution status of the internal control system and regulatory compliance system, and the appropriateness of policies for loan loss reserves, including those of the foreign business units of the banking business.A banking business shall engage a certified public accountant (CPA) to conduct a special audit on its personal data protection and anti-money laundering and countering the financing of terrorism mechanisms.Certified public accountants conducting the audits referred to in the preceding two paragraphs shall provide a reasonable assurance report.The special audit fees for the CPA shall be negotiated by the banking business and the CPA. The banking business shall pay the special audit fees to the CPA.The provisions of Paragraph 1 and Paragraph 2 are not applicable to banking business taken over by the competent authority.