Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries Article 9

Financial holding companies and the banking business shall establish the Three Lines Model for internal control, which shall include a self-inspection system; a legal compliance system, risk management system, and information security system; and an internal audit system.The structure of the Three Lines Model in the preceding paragraph shall ensure that all units understand their respective duties and functions within the institution's overall risk and internal control framework. Each of the three lines shall fulfill its own duties, and communication and coordination between the units executing internal control tasks and the internal audit unit shall be strengthened to maintain the effective and appropriate operation of the internal control system.The implementation procedures for the Code of Practice for the Three Lines Model of Internal Control of Banks shall be formulated by the Bankers Association of the Republic of China and submitted to the competent authority for recordation.