Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation Article 4
A financial institution shall conduct outsourcing operations in accordance with its internal outsourcing rules approved by its board of directors under the premises that outsourcing will not affect the sound operation of the financial institution, the interests of customers, or regulatory compliance. The internal outsourcing rules of the branches of a foreign financial institution in Taiwan (including branches of foreign banks in Taiwan and foreign credit card companies) may be approved by an officer authorized by the head office.The internal outsourcing rules referred to in the preceding paragraph shall specify the following contents:1. Outsourcing policies and principles, including evaluation of outsourcing decisions, risk management mechanisms, approval hierarchy, and governance structure.2. Division of authority and responsibility of unit-in-charge and relevant units regarding the control of outsourced operations.3. Scope of operations that may be outsourced and outsourcing procedures.4. Internal operations and procedures that assure the protection of customer interests.5. Risk management principles and operating procedures.6. Internal control principles and operating procedures.7. Other outsourcing operations and procedures.A financial institution is ultimately responsible for its outsourcing. It shall evaluate the risk level and materiality of outsourced operations and the impact of outsourcing on customer interests, adopt appropriate management measures based on the risk-based approach, and comply with the following provisions:1. The board of directors shall be aware of the outsourcing risks and regularly oversee the execution status of outsourced operations.2. A financial institution shall ensure that the unit-in-charge and relevant units have adequate resources, expertise, and authority over the control of outsourced operations.3. A financial institution shall identify, evaluate, and manage outsourcing of operations deemed material, and formulate relevant procedures and policies. A financial institution shall formulate enhanced controls and emergency response measures for outsourcing arrangements which may significantly impact on normal operations or customer interests.4. A financial institution shall formulate proper due diligence and periodic review procedures to ensure that service providers possess the expertise and resources for the execution of outsourced operations, are financially sound, have internal control and information security management mechanisms, and meet regulatory requirements.5. A financial institution shall ensure that the itself, the competent authority, and the Central Bank or persons designated by them can have access to relevant data or reports of service providers and conduct financial examinations or audits with respect to the outsourced operations, or order service providers to provide relevant data or reports within a prescribed time period.A branch of a foreign financial institution in Taiwan may designate its head office or regional head office to be responsible and handle the matters of applying the provisions in the preceding paragraph. However, the unit-in-charge shall still be handled by personnel from the branches of foreign financial institutions in Taiwan and shall fully understand the control of outsourcing activities in Taiwan by the head office or regional headquarters authorized thereby.The term "materiality" under these Regulations refers to one of the following conditions:1. Where the outsourced operation cannot be performed or where there are concerns regarding information security, and such issues will significantly impact business operations of the financial institution.2. Where the outsourced operation is involved in a customer data security incident that has a significant impact on the interests of the financial institution or customers.3. Where the outsourced operation has otherwise had a significant impact on the interests of the financial institution or customers.
中文原文 金融機構作業委託他人處理內部作業制度及程序辦法第4條
金融機構作業委外應在不影響健全經營、客戶權益及相關法令遵循之原則下，依董（理）事會核定之委外內部作業規範辦理。
但外國金融機構在臺分支機構（包括外國銀行在臺分行及外國信用卡公司）之核定，得由經總機構授權之人員為之。
前項所稱委外內部作業規範應載明下列事項：
一、作業委外之政策及原則，包括委外之決策評估、風險管理機制、核決層級及治理架構。
二、專責單位及相關單位對委外事項控管之權責分工。
三、委外事項範圍及委外程序。
四、客戶權益保障之內部作業及程序。
五、風險管理原則及作業程序。
六、內部控制原則及作業程序。
七、其他委外作業事項及程序。
金融機構對於作業委外負最終責任，應就委外事項之風險程度、重大性及對營運及客戶權益影響進行評估，依風險基礎方法採取適當之控管措施，並依下列規定辦理：
一、董（理）事會應認知作業委外之風險，定期監督委外事項執行情形。
二、應確保專責單位及相關單位對於控管委外事項具備充足之資源、專業及權限。
三、應辨識、評估及管理具重大性之作業委外，訂定相關程序及政策，確保委外作業對金融機構正常營運或客戶權益有重大影響者，訂定強化之控管及緊急應變措施。
四、應有適當之盡職調查及定期審查程序以確認受委託機構具備執行受託作業之專業知識與資源、財務健全、內部控制及資安管理機制及符合法規要求。
五、應確保金融機構本身、主管機關及中央銀行，或其指定之人能取得受委託機構就受託事項範圍之相關資料或報告，及進行金融檢查或查核，或得命令受委託機構於限期內提供相關資料或報告。
前項規定於外國金融機構在臺分支機構之適用，得由總機構或經其授權之區域總部負責及辦理。
但專責單位仍應由外國金融機構在臺分支機構人員辦理，並充分掌握總機構或經其授權之區域總部對在臺作業委外事項之控管情形。
本辦法所稱之重大性，係指下列情形之一：
一、委外作業無法提供服務或有資訊安全疑慮，對金融機構之業務營運有重大影響者。
二、委外作業涉及客戶資料安全事件，對金融機構或客戶權益有重大影響者。
三、其他委外作業對金融機構或客戶權益有重大影響者。
但外國金融機構在臺分支機構（包括外國銀行在臺分行及外國信用卡公司）之核定，得由經總機構授權之人員為之。
前項所稱委外內部作業規範應載明下列事項：
一、作業委外之政策及原則，包括委外之決策評估、風險管理機制、核決層級及治理架構。
二、專責單位及相關單位對委外事項控管之權責分工。
三、委外事項範圍及委外程序。
四、客戶權益保障之內部作業及程序。
五、風險管理原則及作業程序。
六、內部控制原則及作業程序。
七、其他委外作業事項及程序。
金融機構對於作業委外負最終責任，應就委外事項之風險程度、重大性及對營運及客戶權益影響進行評估，依風險基礎方法採取適當之控管措施，並依下列規定辦理：
一、董（理）事會應認知作業委外之風險，定期監督委外事項執行情形。
二、應確保專責單位及相關單位對於控管委外事項具備充足之資源、專業及權限。
三、應辨識、評估及管理具重大性之作業委外，訂定相關程序及政策，確保委外作業對金融機構正常營運或客戶權益有重大影響者，訂定強化之控管及緊急應變措施。
四、應有適當之盡職調查及定期審查程序以確認受委託機構具備執行受託作業之專業知識與資源、財務健全、內部控制及資安管理機制及符合法規要求。
五、應確保金融機構本身、主管機關及中央銀行，或其指定之人能取得受委託機構就受託事項範圍之相關資料或報告，及進行金融檢查或查核，或得命令受委託機構於限期內提供相關資料或報告。
前項規定於外國金融機構在臺分支機構之適用，得由總機構或經其授權之區域總部負責及辦理。
但專責單位仍應由外國金融機構在臺分支機構人員辦理，並充分掌握總機構或經其授權之區域總部對在臺作業委外事項之控管情形。
本辦法所稱之重大性，係指下列情形之一：
一、委外作業無法提供服務或有資訊安全疑慮，對金融機構之業務營運有重大影響者。
二、委外作業涉及客戶資料安全事件，對金融機構或客戶權益有重大影響者。
三、其他委外作業對金融機構或客戶權益有重大影響者。