Rules Governing the Administration of Electronic Payment Business Article 44
The information system and security management operation of an electronic payment institution for conducting the electronic payment business shall be set up within the territory of the ROC. However, this provision does not apply to those that meet the requirements that the competent authority may immediate, direct, complete, and continuous access to related information, and have obtained the approval of the competent authority.An electronic payment institution applying for the approval of the competent authority in accordance with the proviso of the preceding paragraph shall submit the following documents:1. The written confirmation letter from the local government authority where the service provider is located. The letter shall contain the following:(1) The government authority agrees that the competent authority of the ROC and the electronic payment institution may conduct necessary audits.(2) The government authority agrees not to collect customer information in Taiwan.2. An inspection report issued by an independent third party specializing in information technology, indicating that the information system of the offshore service provider is not below the domestic information security standards.3. A contingency plan in the event that the offshore information system fails to provide services, and an assessment report issued by an independent third party specializing in information technology, indicating that such plan meets the following requirements:(1) The electronic payment institution shall ensure the restoration of normal functions for existing customers within four hours after the offshore information system fails to provide services, and ensure the proper management of financial and business risks; and(2) If it is evaluated that the offshore information system could not be functional within a short period of time due to a natural disaster, the electronic payment institution shall ensure the functional operations of its main businesses within the territory of the ROC within seven days of the incident, through activation of the backup system, installation of (temporary) information server or other means.4. An ordinary supervision plan with the following particulars:(1) The setup of a supervisory unit or committee consisting personnel of compliance, internal audit, operational risk management, and information management to effectively carry out the ordinary supervision; and(2) An outsourcing operation’s supervision mechanism including: the log file of customer information accession, authorization of system access, non-routine operations, with the detailed descriptions of the operational contents, methods, and processes along with the deficiency resolving mechanism.5. An evaluation report on the cost benefit and the reasonableness of expense allocation within the group that has been passed by the board of directors.An electronic payment institution applying for approval in accordance with the preceding two paragraphs must meet the following requirements:1. Not having been subject to sanction by the competent authority due to violation of financial regulations in the previous year, or having made concrete improvement actions recognized by the competent authority over the violation.2. All deficiencies as redressed by the competent authority or the Central Bank before the end of year preceding application have been effectively remedied; and3. Not having any major breach of information security that is not yet remedied in the past year.
中文原文 電子支付機構業務管理規則第44條
電子支付機構辦理電子支付機構業務之資訊系統及其備援系統，應設置於我國境內。
但符合主管機關可立刻、直接、完整、持續取得相關資訊之情形，並經主管機關核准者，不在此限。
電子支付機構依前項但書規定向主管機關申請核准時，應檢具下列書件：
一、所在地政府機關書面確認文件，其內容應包括：
（一）該政府機關允許我國主管機關及電子支付機構得進行必要之查核。
（二）該政府機關同意不會取得我國客戶資訊。
二、委託具資訊專業之獨立第三人出具境外資訊系統不低於我國資訊安全標準之查核報告。
三、針對境外資訊系統發生無法提供服務情事，建立營運備援計畫，並由具資訊專業之獨立第三人出具該計畫符合以下要求之評估報告：
（一）應確保於境外資訊系統發生無法提供服務情事後四小時內，恢復既有客戶之業務正常運作，同時維持對各項財務及業務風險之妥善管理。
（二）若評估境外資訊系統因天然災害致無法於短期內恢復提供服務，電子支付機構應確保於事件發生後七日內，透過啟動備援系統、安裝（臨時）資訊主機或其他方式，恢復在我國之主要業務正常運作。
四、日常監督機制之計畫書，其內容應包括：
（一）設立資訊系統設置於境外之監督管理單位或委員會，參與人員包括法規遵循、內部稽核、作業風險管理及資訊管理監督人員，以有效執行日常監督。
（二）日常作業機制，包括客戶資料存取情形、系統權限設定及非例行性作業等檢核項目，計畫應詳述管理作業內容、方式、流程及缺失處理機制。
五、報經董事會通過之成本效益與集團內費用分攤合理性之評估報告。
電子支付機構依前二項申請核准，應符合下列條件：
一、最近一年內無因違反金融相關法令，受主管機關處分之情事，或有違反法令情事已具體改善，並經主管機關認可。
二、申請前一年底經主管機關或中央銀行糾正之缺失，均已切實改善。
三、最近一年內無重大資安事故未改善之情事。
但符合主管機關可立刻、直接、完整、持續取得相關資訊之情形，並經主管機關核准者，不在此限。
電子支付機構依前項但書規定向主管機關申請核准時，應檢具下列書件：
一、所在地政府機關書面確認文件，其內容應包括：
（一）該政府機關允許我國主管機關及電子支付機構得進行必要之查核。
（二）該政府機關同意不會取得我國客戶資訊。
二、委託具資訊專業之獨立第三人出具境外資訊系統不低於我國資訊安全標準之查核報告。
三、針對境外資訊系統發生無法提供服務情事，建立營運備援計畫，並由具資訊專業之獨立第三人出具該計畫符合以下要求之評估報告：
（一）應確保於境外資訊系統發生無法提供服務情事後四小時內，恢復既有客戶之業務正常運作，同時維持對各項財務及業務風險之妥善管理。
（二）若評估境外資訊系統因天然災害致無法於短期內恢復提供服務，電子支付機構應確保於事件發生後七日內，透過啟動備援系統、安裝（臨時）資訊主機或其他方式，恢復在我國之主要業務正常運作。
四、日常監督機制之計畫書，其內容應包括：
（一）設立資訊系統設置於境外之監督管理單位或委員會，參與人員包括法規遵循、內部稽核、作業風險管理及資訊管理監督人員，以有效執行日常監督。
（二）日常作業機制，包括客戶資料存取情形、系統權限設定及非例行性作業等檢核項目，計畫應詳述管理作業內容、方式、流程及缺失處理機制。
五、報經董事會通過之成本效益與集團內費用分攤合理性之評估報告。
電子支付機構依前二項申請核准，應符合下列條件：
一、最近一年內無因違反金融相關法令，受主管機關處分之情事，或有違反法令情事已具體改善，並經主管機關認可。
二、申請前一年底經主管機關或中央銀行糾正之缺失，均已切實改善。
三、最近一年內無重大資安事故未改善之情事。