Rules Governing the Administration of Electronic Payment Business Article 45
Where a specialized electronic payment institution outsources part of the business items specified in its business permission or operations related to users information to other parties, the outsourcing shall be limited to the following:1. Collection of funds paid by users in cash in New Taiwan Dollar.2. Safekeeping and transport of cash payments received from users and stored value cards.3. Outsourcing the process of sales and refund of bearer stored value cards.4. Value storing in stored value cards.5. Data processing: Including the data entry, processing, and output of information system, the development, monitoring, control, and maintenance of information system, and logistical support for data processing in connection with the business of an electronic payment institution.6. Safekeeping of documents such as forms, statements and certificates.7. User services, including automated voice systems, reply to and handling of user’s e-mails, inquiries of and assistance in matters related to the electronic payment business.8. Engaging an outsourced service provider to perform the identity verification operation of users and contracted institutions.9. Processing work of receipt/payment information, including using the terminal equipment or application programs of other electronic payment institutions, credit card acquirers, contracted institutions to integrate and convey receipt/payment information.10. Installation, tests, maintenance, training, and inspections of the terminal equipment system.11. Shared use of the terminal equipment systems of other electronic payment institutions, credit card acquirers, contracted institutions, or stored value institutions.12. Production and coding of stored value cards.13. Over-the-air downloading and issuance of stored value cards through a trusted service manager platform.14. Promotion of e-payment accounts or stored value card acquirer services, and the audit for the contracted institutions of the electronic payment account or stored value cards carried out by banks, other electronic payment institutions, or credit card acquirers. However, the electronic payment institution is still required to sign a contract with the contracted institutions.15. Transaction clearing operations carried out by other electronic payment institutions and credit card acquirers that provide the shared terminal equipment system.16. Other operations approved by the competent authority for outsourcing.Except the outsourcing business in Subparagraphs 5, 8, and 16 of the preceding paragraph, which must be reported to the competent authority to obtain approval in advance, the remaining outsourcing business specified in the preceding paragraph shall be filed to the competent authority for record within five business days since the first-time operation commencement.A Specialized electronic payment institutions shall comply with the following rules when outsourcing the operations specified in Subparagraph 1 of Paragraph 1:1. Electronic payment institutions shall formulate security control and management plans with outsourced service providers and establish payment account reconciliation mechanisms to immediate deliver, confirm, and check payment collection information when outsourced service providers receive payment from users. Except where the Ministry of Finance promulgates other regulations on the maximum cap of tax payments in convenience stores been on behalf of authorities, the maximum payment collection amount for outsourced service providers in each transaction is NTD 20,000 or its equivalent.2. The payment information of user payments which collected by outsourced service providers shall not fully display the user’s ID number, account number, or other personal information. 3. Electronic payment institutions shall ensure that outsourced service providers and their personnel cannot obtain or identify the user's ID number, account number, and other related personal information by means of the payment information to prevent leaks of user information.A Specialized electronic payment institution shall comply with the following rules when outsourcing their operations:1. An electronic payment institution shall establish internal operating systems and procedures governing the scope of matters that can be outsourced, protection of users rights and interests, risk management, and internal control principles, and those operating systems and procedures and any revisions thereto shall be approved by the board of directors.2. An electronic payment institution shall ensure the outsourced service providers meet its requirements for operational security and risk management.3. An electronic payment institution shall demand that its outsourced service providers comply with the mandatory or prohibitory provisions of laws.4. An electronic payment institution shall demand that its outsourced service providers agree to give the competent authority and the Central Bank access to data or reports relating to the outsourced providers and allow them to conduct financial examination.5. An electronic payment institution shall be held jointly liable as provided by law for users whose interests are damaged by the intentional act or negligence of an outsourced service provider or its employees.A dual-status electronic payment institution that outsources its operations involving electronic payment business or operations relating to users’ information shall comply with the provisions in Paragraph 1 hereof with respect to the scope of outsourcing, and shall also follow the relevant regulations governing the outsourcing of its core business.
中文原文 電子支付機構業務管理規則第45條
專營電子支付機構對於涉及營業執照所載業務項目或使用者資訊之相關作業委託他人處理，以下列事項範圍為限：
一、代收以新臺幣現金繳納支付款項作業。
二、支付款項現金及儲值卡之保管及運送作業。
三、委託他人辦理無記名式儲值卡之販售、退卡作業。
四、儲值卡儲值作業。
五、資料處理：包括資訊系統之資料登錄、處理、輸出，資訊系統之開發、監控、維護，及辦理業務涉及資料處理之後勤作業。
六、表單、憑證等資料保存之作業。
七、使用者服務作業，包括電話自動語音系統服務、使用者電子郵件之回覆與處理作業、電子支付機構業務之相關諮詢及協助。
八、委託受委託機構辦理使用者及特約機構之身分確認作業。
九、收付訊息處理作業，包括透過其他電子支付機構、信用卡收單機構、特約機構或儲值機構之端末設備或應用程式，而整合傳遞收付訊息。
十、端末設備之安裝測試、維護、訓練及查核作業。
十一、共用其他電子支付機構、信用卡收單機構、特約機構或儲值機構端末設備。
十二、儲值卡製卡及錄碼作業。
十三、透過信任服務管理平臺空中下載發行儲值卡作業。
十四、電子支付帳戶或儲值卡收單業務之推廣，及由銀行、其他電子支付機構及信用卡收單機構辦理電子支付帳戶或儲值卡特約機構之查核。
但電子支付機構仍應自行與特約機構簽訂契約。
十五、由提供共用端末設備之其他電子支付機構及信用卡收單機構辦理交易清分作業。
十六、其他經主管機關核定得委託他人處理之作業項目。
前項規定之委外事項範圍，除第八款及第十六款之作業委外，應先報經主管機關核准外，其餘委外事項範圍，應於首次辦理後五個營業日內，報主管機關備查。
專營電子支付機構將第一項第一款作業委託他人處理，應依下列規定辦理：
一、與受委託機構研訂安全控管計畫，並建立支付款項帳務核對機制，於受委託機構收受使用者支付款項時，即時傳遞、確認及核對收款訊息，且除財政部就便利商店代收繳稅限額另有規定者外，受委託機構每筆代收金額上限為等值新臺幣二萬元。
二、受委託機構代收使用者支付款項之繳款資料，不得完整列示使用者身分證字號及帳號等個人資料。
三、確保受委託機構及其人員無法藉由繳款資料取得或辨識使用者之身分證字號、帳號及其他相關個人資料，以避免使用者資料外洩。
專營電子支付機構辦理作業委託他人處理，應符合下列規定：
一、就委託事項範圍、使用者權益保障、風險管理及內部控制原則，訂定內部作業制度及程序，並經董事會通過；修正時，亦同。
二、確認受委託機構符合電子支付機構作業安全及風險管理之要求。
三、要求受委託機構不得違反法令強制或禁止規定。
四、要求受委託機構就受託事項範圍，同意主管機關及中央銀行得取得相關資料或報告，及進行金融檢查。
五、如因受委託機構或其受僱人員之故意或過失致使用者權益受損，仍應對使用者依法負同一責任。
兼營電子支付機構對於涉及電子支付機構業務項目或使用者資訊之相關作業委託他人處理，其範圍適用第一項規定，並應依本業有關作業委託他人處理之規定辦理。
一、代收以新臺幣現金繳納支付款項作業。
二、支付款項現金及儲值卡之保管及運送作業。
三、委託他人辦理無記名式儲值卡之販售、退卡作業。
四、儲值卡儲值作業。
五、資料處理：包括資訊系統之資料登錄、處理、輸出，資訊系統之開發、監控、維護，及辦理業務涉及資料處理之後勤作業。
六、表單、憑證等資料保存之作業。
七、使用者服務作業，包括電話自動語音系統服務、使用者電子郵件之回覆與處理作業、電子支付機構業務之相關諮詢及協助。
八、委託受委託機構辦理使用者及特約機構之身分確認作業。
九、收付訊息處理作業，包括透過其他電子支付機構、信用卡收單機構、特約機構或儲值機構之端末設備或應用程式，而整合傳遞收付訊息。
十、端末設備之安裝測試、維護、訓練及查核作業。
十一、共用其他電子支付機構、信用卡收單機構、特約機構或儲值機構端末設備。
十二、儲值卡製卡及錄碼作業。
十三、透過信任服務管理平臺空中下載發行儲值卡作業。
十四、電子支付帳戶或儲值卡收單業務之推廣，及由銀行、其他電子支付機構及信用卡收單機構辦理電子支付帳戶或儲值卡特約機構之查核。
但電子支付機構仍應自行與特約機構簽訂契約。
十五、由提供共用端末設備之其他電子支付機構及信用卡收單機構辦理交易清分作業。
十六、其他經主管機關核定得委託他人處理之作業項目。
前項規定之委外事項範圍，除第八款及第十六款之作業委外，應先報經主管機關核准外，其餘委外事項範圍，應於首次辦理後五個營業日內，報主管機關備查。
專營電子支付機構將第一項第一款作業委託他人處理，應依下列規定辦理：
一、與受委託機構研訂安全控管計畫，並建立支付款項帳務核對機制，於受委託機構收受使用者支付款項時，即時傳遞、確認及核對收款訊息，且除財政部就便利商店代收繳稅限額另有規定者外，受委託機構每筆代收金額上限為等值新臺幣二萬元。
二、受委託機構代收使用者支付款項之繳款資料，不得完整列示使用者身分證字號及帳號等個人資料。
三、確保受委託機構及其人員無法藉由繳款資料取得或辨識使用者之身分證字號、帳號及其他相關個人資料，以避免使用者資料外洩。
專營電子支付機構辦理作業委託他人處理，應符合下列規定：
一、就委託事項範圍、使用者權益保障、風險管理及內部控制原則，訂定內部作業制度及程序，並經董事會通過；修正時，亦同。
二、確認受委託機構符合電子支付機構作業安全及風險管理之要求。
三、要求受委託機構不得違反法令強制或禁止規定。
四、要求受委託機構就受託事項範圍，同意主管機關及中央銀行得取得相關資料或報告，及進行金融檢查。
五、如因受委託機構或其受僱人員之故意或過失致使用者權益受損，仍應對使用者依法負同一責任。
兼營電子支付機構對於涉及電子支付機構業務項目或使用者資訊之相關作業委託他人處理，其範圍適用第一項規定，並應依本業有關作業委託他人處理之規定辦理。