Implementation Rules for the Internal Audit and Internal Control System of Specialized Electronic Payment Institutions Article 27

If the annual financial report of a specialized electronic payment institution is audited and certified by an accountant, the institution shall also engage the accountant to conduct an audit of its internal control system. The accountant shall also submit a reasonable assurance report on the accuracy of reports submitted by the specialized electronic payment institution to the competent authority, and the appropriateness of the implementation status of internal control system and regulatory compliance system.The competent authority may request the specialized electronic payment institution to authorize an accountant to conduct a targeted examination of its personal data protection and AML/CFT mechanisms.The audit fees for the accountant shall be negotiated and agreed between the specialized electronic payment institution and the accountant, and paid by the specialized electronic payment institution.