Implementation Rules for the Internal Audit and Internal Control System of Specialized Electronic Payment Institutions Article 36-1

If a specialized electronic payment institution whose total assets audited and certified by a certified public accountant in the previous year amounted to NT$1 billion or whose number of users reached 2 million or more, it must set up a dedicated information security unit and appoint a supervisor, who shall not be assigned to perform information management or other tasks with conflict of interest, and shall allocate suitable workforce and equipment.If the dedicated information security unit specified in the preceding paragraph is part of the information management organization, it shall be set up as a separate entity from other information management units to meet the management mechanisms for independent operations.If an electronic payment institution does not meet the provisions Paragraph 1, it shall implement adjustments within six months of the promulgation of the amendment to meet requirements.