Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation Article 17
A financial institution that plans to outsource its operations to overseas service providers shall comply with the following provisions:1. Fully understand and grasp the use, processing, and control of customer information by the service provider.2. Furnish the service provider with only necessary customer information that is directly related to the outsourced operations.3. Require service providers to observe the following particulars:(1) A financial institution's customer data shall only be used and processed by the authorized persons of the service provider within the scope of outsourced operations.(2) A financial institution's customer data shall be clearly segregated from those of the service provider and other institutions.(3) A financial institution's customer data processed by the service provider shall be readily provided to the competent authority and the financial institution when needed.4. A financial institution shall adopt a risk-based approach to conduct regular and unscheduled audits and to monitor the use, processing, and control of customer information by the service provider; relevant audits may be conducted by external auditors. A branch of a foreign financial institution in Taiwan may designate the auditing unit of its head office or regional headquarters to handle audit matters; the auditing unit shall provide the branch in Taiwan with audit reports.5. When the foreign competent authority where the service provider is located requests the service provider to provide customer information from the Republic of China(Taiwan) (hereinafter called the R.O.C.), the financial institution shall inform and obtain consent of the competent authority in the R.O.C. in advance before submitting the requested information.In the case where a branch of a foreign financial institution in the R.O.C. outsources operations to the head office or other foreign branches to accommodate its internal division of work, the outsourcing shall be handled in accordance with the preceding paragraph.
中文原文 金融機構作業委託他人處理內部作業制度及程序辦法第17條
金融機構將作業項目委託至境外處理者，應依下列規定辦理：
一、應充分瞭解及掌握受委託機構對客戶資訊之使用、處理及控管情形。
二、提供予受委託機構之客戶資訊僅限與受託事項直接相關之必要資訊。
三、應要求受委託機構確實遵守以下事項：
（一）金融機構之客戶資訊僅限由受委託機構之獲授權人員於受託事項範圍內使用及處理。
（二）金融機構之客戶資訊應與受委託機構及其處理他機構之資料有明確區隔。
（三）受委託機構處理之金融機構客戶資訊應能及時提供予主管機關及金融機構。
四、應依風險基礎方法定期及不定期就受委託機構對客戶資訊之使用、處理及控管情形進行查核及監督；相關查核得委由外部稽核辦理，外國金融機構在臺分支機構得交由總機構或經總機構授權之區域總部稽核單位辦理，相關單位並應提供相關查核報告予該外國金融機構在臺分支機構。
五、受委託機構所在地金融主管機關請求提供我國客戶資訊時，金融機構應先將事由通知我國主管機關並取得同意後始得提供。
外國金融機構在臺分支機構因內部分工將作業交由總機構或國外分支機構處理者，應依前項規定辦理。
一、應充分瞭解及掌握受委託機構對客戶資訊之使用、處理及控管情形。
二、提供予受委託機構之客戶資訊僅限與受託事項直接相關之必要資訊。
三、應要求受委託機構確實遵守以下事項：
（一）金融機構之客戶資訊僅限由受委託機構之獲授權人員於受託事項範圍內使用及處理。
（二）金融機構之客戶資訊應與受委託機構及其處理他機構之資料有明確區隔。
（三）受委託機構處理之金融機構客戶資訊應能及時提供予主管機關及金融機構。
四、應依風險基礎方法定期及不定期就受委託機構對客戶資訊之使用、處理及控管情形進行查核及監督；相關查核得委由外部稽核辦理，外國金融機構在臺分支機構得交由總機構或經總機構授權之區域總部稽核單位辦理，相關單位並應提供相關查核報告予該外國金融機構在臺分支機構。
五、受委託機構所在地金融主管機關請求提供我國客戶資訊時，金融機構應先將事由通知我國主管機關並取得同意後始得提供。
外國金融機構在臺分支機構因內部分工將作業交由總機構或國外分支機構處理者，應依前項規定辦理。