Implementation Rules for the Internal Audit and Internal Control System of Specialized Electronic Payment Institutions Article 18

Where a significant fraudulent event occurs at a specialized electronic payment institution as a result of poor internal management, unsatisfactory internal controls, inadequate implementation of the internal audit system and regulatory compliance system, or concealment of the results of improvement actions taken for any deficiency specified by a financial examination agency in an examination opinion requiring review and follow-up, or the audit findings of the internal audit unit (including the internal audit unit of parent company), the personnel involved shall be held responsible for dereliction of duties. A specialized electronic payment institution shall reward its internal auditors who identify any significant fraud or negligence and thereby avert material loss to the institution.When a significant deficiency or fraudulent event arises within a unit of a specialized electronic payment institution, the internal audit unit shall have the power to suggest penalties and shall make a full disclosure of the responsible negligent personnel in the internal audit report.