Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation Article 19
A financial institution shall comply with the following rules when its outsourced operations involve cloud-based services:1. Formulate policies and principles for using cloud-based services, adopt appropriate risk control measures, and heed the proper diversification of operations outsourced to cloud service providers.2. A financial institution is ultimately responsible for the monitoring of cloud service providers and it shall have the professional skills and resources to monitor the cloud service providers' execution of outsourced operations. It may also request professional third parties to assist in monitoring operations as needed.3. A financial institution may appoint an independent third party with expertise in information technology at its sole discretion or in conjunction with other financial institutions that outsource to the same cloud service provider to conduct audits. Meanwhile, financial institutions and their appointed parties shall comply with the following provisions:(1) A financial institution shall ensure that its audit scope includes important systems and control measures related to the operations outsourced to the cloud service provider.(2) A financial institution shall evaluate the suitability of a third party and verify that the contents of an audit report submitted by a third party meet the relevant international standards of information security and privacy protection.(3) A third party shall conduct audits based on the scope of outsourced operations and issue an audit report.4. Where a financial institution transmits and stores customer data at a cloud service provider, it shall adopt customer data encryption, tokenization, or other effective protection measures and it shall also establish appropriate encryption key management mechanisms.5. A financial institution shall retain complete ownership of data outsourced to cloud service providers for processing. The financial institution shall ensure that the cloud service provider does not have the right to access customer data except for the execution of outsourced operations and it may not use the data for purposes outside the scope of outsourced operations.6. With respect to customer data processing by cloud service providers, and data storage location, the following rules shall be observed:(1) The financial institution shall retain the right to designate the location for the processing and storage of the data.(2) The local data protection regulations at the offshore location shall be no less rigorous than the requirements in the R.O.C..(3) The customer data of material retail financial business information systems shall be stored within the territory of the R.O.C. in principle. If such data are stored offshore, backups of important customer data shall be retained in the R.O.C., except with the approval of the competent authority.
中文原文 金融機構作業委託他人處理內部作業制度及程序辦法第19條
金融機構將作業委託他人處理涉及使用雲端服務，應依下列規定辦理：
一、應訂定使用雲端服務之政策及原則，採取適當風險管控措施，並應注意作業委託雲端服務業者之適度分散。
二、金融機構對雲端服務業者負有最終監督義務，並應具有專業技術及資源，監督雲端服務業者執行受託作業，並得視需要委託專業第三人以輔助其監督作業。
三、金融機構得自行委託，或與委託同一雲端服務業者之其他金融機構聯合委託具資訊專業之獨立第三人查核，並應符合下列規定：
（一）確認其查核範圍涵蓋雲端服務業者受託處理作業相關之重要系統及控制環節。
（二）應評估第三人之適格性，以及其所出具查核報告內容之妥適性並符合相關國際資訊安全及隱私保護標準。
（三）應針對金融機構所委託作業範圍進行查核並出具報告。
四、金融機構傳輸及儲存客戶資料至雲端服務業者，應採行客戶資料加密或代碼化等有效保護措施，並應訂定妥適之加密金鑰管理機制。
五、對委託雲端服務業者處理之資料應保有完整所有權，除執行受託作業外，金融機構應確保雲端服務業者不得有存取客戶資料之權限，並不得為委託範圍以外之利用。
六、委託雲端服務業者處理之客戶資料及其儲存地應依下列規定辦理：
（一）金融機構須保有其指定資料處理及儲存地之權利。
（二）境外當地資料保護法規不得低於我國要求。
（三）涉及重大性消費金融業務資訊系統之客戶資料儲存地以位於我國境內為原則。
如位於境外，除經主管機關核准者外，客戶重要資料應在我國留存備份。
一、應訂定使用雲端服務之政策及原則，採取適當風險管控措施，並應注意作業委託雲端服務業者之適度分散。
二、金融機構對雲端服務業者負有最終監督義務，並應具有專業技術及資源，監督雲端服務業者執行受託作業，並得視需要委託專業第三人以輔助其監督作業。
三、金融機構得自行委託，或與委託同一雲端服務業者之其他金融機構聯合委託具資訊專業之獨立第三人查核，並應符合下列規定：
（一）確認其查核範圍涵蓋雲端服務業者受託處理作業相關之重要系統及控制環節。
（二）應評估第三人之適格性，以及其所出具查核報告內容之妥適性並符合相關國際資訊安全及隱私保護標準。
（三）應針對金融機構所委託作業範圍進行查核並出具報告。
四、金融機構傳輸及儲存客戶資料至雲端服務業者，應採行客戶資料加密或代碼化等有效保護措施，並應訂定妥適之加密金鑰管理機制。
五、對委託雲端服務業者處理之資料應保有完整所有權，除執行受託作業外，金融機構應確保雲端服務業者不得有存取客戶資料之權限，並不得為委託範圍以外之利用。
六、委託雲端服務業者處理之客戶資料及其儲存地應依下列規定辦理：
（一）金融機構須保有其指定資料處理及儲存地之權利。
（二）境外當地資料保護法規不得低於我國要求。
（三）涉及重大性消費金融業務資訊系統之客戶資料儲存地以位於我國境內為原則。
如位於境外，除經主管機關核准者外，客戶重要資料應在我國留存備份。