Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation Article 18
When operations involving retail financial business information systems deemed material are outsourced by a financial institution to overseas, the financial institution shall submit the following documents to the competent authority for approval:1. Internal outsourcing rules established in accordance with paragraph 2 of Article 4 herein.2. Meeting minutes containing a resolution of the board of directors, or a letter of consent signed by an officer authorized by the head office in the case of a branch of a foreign financial institution in Taiwan.3. Necessity and compliance analysis of outsourcing of business operations, including an evaluation of compliance with the customer data protection rules and regulations of the R.O.C. by the service provider.4. An outsourcing plan, which shall include the following contents:(1) Risk assessment and management mechanisms:A. Evaluation of the risk level and materiality of outsourced operations and the impact on business operations and customer interests.B. A due diligence check of the service provider to ensure the reliability and compliance of the services provided; the reliability check shall include analysis of business continuity, substitutability, and concentration.C. Description showing that the service provider has the professional skills and resources to monitor the execution of outsourced operations.D. Regular monitoring plan and implementation unit.(2) Description of customer data protection measures and whether customer consents have been obtained to ensure the quality of outsourcing service and protection of customer interests.(3) Information security and management:A. Description of data security management measures, data transmission and segregation, and data ownership.B. Description of management policies with regard to the location of data storage, including assessment of legal, political, and economic stability at the data processing and storage locations, and description of data backup and data accessibility at any time.(4) Emergency response plan, including a contingency plan when the service provider is unable to provide services or when there is service interruption.5. A letter of consent or outsourcing agreement signed by the service provider, agreeing that where necessary, a person designated by the financial institution may examine the outsourced items. The aforesaid designated person may also be assigned by the competent authority in the R.O.C. at the expense of the financial institution.6. A statement issued by the service provider undertaking that it is free of incidents, such as employee fraud, information security breach, or other incidents that have caused damage to customer interests or undermined the sound operation of the institution in the last three years.When conducting outsourcing under the preceding paragraph, a financial institution shall comply with the following provisions in addition to the preceding article:1. Assure that the use, processing, and safekeeping of customer information by the service provider comply with the Personal Information Protection Act, retain complete audit trails, and include compliance matter in key audit items.2. Periodically evaluate cost benefit and the reasonableness of expense allocation within the group, and submit the report to the board of directors for approval.3. The standards for information system security testing shall be no less rigorous than the requirements set forth by the competent authority or the Bankers Association.4. Conduct one routine audit and one target audit at least annually, and submit an annual cross-border outsourcing audit report within four months after the end of the year. The aforementioned audits may be performed by an independent third party specializing in information technology.5. Establish a business contingency plan in case of failure to provide services or service interruption by the service provider.6. Specify in the outsourcing agreement the situations where the outsourced operations are transferred to another service provider or back to the financial institution, and the original service provider's obligations regarding system relocation and data processing, and the service provider's liability for damages in case of service interruption.In the case where a branch of a foreign financial institution in Taiwan outsources operations to the head office or other foreign branches to accommodate its internal division of work, the outsourcing shall be handled in accordance with paragraph 1 hereof.
中文原文 金融機構作業委託他人處理內部作業制度及程序辦法第18條
金融機構辦理作業委外，涉及重大性消費金融業務資訊系統委託至境外處理，應檢具下列書件向主管機關申請核准：
一、依第四條第二項訂定之委外內部作業規範。
二、董（理）事會決議之議事錄。
但外國金融機構在臺分支機構得由經總機構授權人員出具同意書為之。
三、委外對營運之必要性及適法性分析，其中應包含對受委託機構遵守我國客戶資料保護相關規定之評估。
四、作業委外計畫書，其內容應包括：
（一）風險評估及管理機制：1.委外事項之風險程度、重大性及對營運及客戶權益影響之評估情形。
2.受委託機構盡職調查情形，確保提供作業之可靠性、遵法性，其中可靠性應包括對業務持續性、替代性及集中性之分析。
3.應具專業技術及資源，監督受委託機構執行受託作業之說明。
4.日常監督機制之計畫及執行單位。
（二）客戶資訊保護措施及是否已取得客戶同意，以確保委外服務品質及客戶權益保障之說明。
（三）資訊安全及管理：1.資料安全管理措施、資料傳輸及區隔，以及資料所有權說明。
2.資料儲存地之管理政策，包括資料處理地及儲存地之法律、政治、經濟安定性評估說明，資料備份及得隨時存取資料之說明。
（四）緊急應變計畫，包括受委託機構發生無法提供服務情事或服務中斷之營運備援計畫。
五、受委託機構出具之同意函或委外契約，同意必要時得由金融機構指定之人，對受託事項進行查核。
上開指定之人亦得由我國主管機關指派之，其費用由金融機構負擔。
六、受委託機構出具近三年內未發生造成客戶權益受損或影響機構健全營運之人員舞弊、資通安全及其他事件之聲明書。
金融機構辦理前項委外，除應符合前條規定外，並應依下列規定辦理：
一、應就受委託機構對客戶資訊之使用、處理及控管情形確認符合我國個人資料保護法相關規定，留存完整稽核紀錄，並列為重點查核項目。
二、應定期評估成本效益與集團內費用分攤之合理性並報董（理）事會通過。
三、對資訊系統之安全檢測應不低於主管機關或銀行公會之規範。
四、每年至少應辦理一次一般性查核及一次專案查核，並應於每年年度終了後四個月內將當年度辦理跨境委外查核報告提報董（理）事會報告。
前述查核之執行得委託具資訊專業之獨立第三人辦理。
五、應建立受委託機構發生無法提供服務情事或服務中斷之營運備援計畫。
六、應於契約中載明於委外作業移轉至其他受委託機構或移回金融機構之情況，原受委託機構有關系統遷移、資料處理之義務，及受委託機構服務中斷之賠償責任。
外國金融機構在臺分支機構因內部分工將作業交由總機構或國外分支機構處理者，應依第一項規定辦理。
一、依第四條第二項訂定之委外內部作業規範。
二、董（理）事會決議之議事錄。
但外國金融機構在臺分支機構得由經總機構授權人員出具同意書為之。
三、委外對營運之必要性及適法性分析，其中應包含對受委託機構遵守我國客戶資料保護相關規定之評估。
四、作業委外計畫書，其內容應包括：
（一）風險評估及管理機制：1.委外事項之風險程度、重大性及對營運及客戶權益影響之評估情形。
2.受委託機構盡職調查情形，確保提供作業之可靠性、遵法性，其中可靠性應包括對業務持續性、替代性及集中性之分析。
3.應具專業技術及資源，監督受委託機構執行受託作業之說明。
4.日常監督機制之計畫及執行單位。
（二）客戶資訊保護措施及是否已取得客戶同意，以確保委外服務品質及客戶權益保障之說明。
（三）資訊安全及管理：1.資料安全管理措施、資料傳輸及區隔，以及資料所有權說明。
2.資料儲存地之管理政策，包括資料處理地及儲存地之法律、政治、經濟安定性評估說明，資料備份及得隨時存取資料之說明。
（四）緊急應變計畫，包括受委託機構發生無法提供服務情事或服務中斷之營運備援計畫。
五、受委託機構出具之同意函或委外契約，同意必要時得由金融機構指定之人，對受託事項進行查核。
上開指定之人亦得由我國主管機關指派之，其費用由金融機構負擔。
六、受委託機構出具近三年內未發生造成客戶權益受損或影響機構健全營運之人員舞弊、資通安全及其他事件之聲明書。
金融機構辦理前項委外，除應符合前條規定外，並應依下列規定辦理：
一、應就受委託機構對客戶資訊之使用、處理及控管情形確認符合我國個人資料保護法相關規定，留存完整稽核紀錄，並列為重點查核項目。
二、應定期評估成本效益與集團內費用分攤之合理性並報董（理）事會通過。
三、對資訊系統之安全檢測應不低於主管機關或銀行公會之規範。
四、每年至少應辦理一次一般性查核及一次專案查核，並應於每年年度終了後四個月內將當年度辦理跨境委外查核報告提報董（理）事會報告。
前述查核之執行得委託具資訊專業之獨立第三人辦理。
五、應建立受委託機構發生無法提供服務情事或服務中斷之營運備援計畫。
六、應於契約中載明於委外作業移轉至其他受委託機構或移回金融機構之情況，原受委託機構有關系統遷移、資料處理之義務，及受委託機構服務中斷之賠償責任。
外國金融機構在臺分支機構因內部分工將作業交由總機構或國外分支機構處理者，應依第一項規定辦理。