Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 10-1

The design principle for payment via the agreed linked deposit account shall meet the following requirements:1. The electronic payment institution uses direct or indirect link mechanism to provide the service of payment via agreed linked deposit account.2. The electronic payment institution should apply to a financial institution for a financial certificate and enters an agreement with the financial institution that it will be the exclusive certificate for payment via the agreed linked deposit account operation. The application for agreed linkage or deduction instruction by/from the electronic payment institution should be effected through authentication of signature via certificate authority, and both parties should agree that this certificate authentication mechanism will serve as the undeniability of the transaction. The application for financial certificate shall be made in the following manner:(1) Direct link mechanism: The electronic payment institution shall apply to the financial institution holding the account.(2) Indirect link mechanism: The electronic payment institution shall apply to the dedicated deposited account bank.3. Agreed linkage procedure:(1) The user should apply to the electronic payment institution for account linkage and agree to have the electronic payment institution carry out transfer of funds on user's behalf. The user should apply to user's bank for account linkage in the following manner:a. Make application to the financial institution holding the account over-the-counter or through online banking.b. Make application to the financial institution holding the account through the electronic payment institution in accordance with the manner set out in the preceding subparagraph.(2) When the user applies for account linkage, the user should provide the financial institution holding the account with bank deposit account number, e-payment account number and other agreed information. The agreed linkage is effected after the user's bank has verified the user's identity.(3) The electronic payment institution should ask the financial institution holding the account to verify user's identity in accordance with the interface security design for transactions prescribed in the Standards for the Security Management Operation of Electronic Banking Business of Financial Institutions and limit the amount of fund transfer for transactions based on the type of risk applicable to the method used for identity verification.(4) When the user uses the payment service via agreed linked account offered by the same electronic payment institution, the aggregate amount of payment shall be limited to NT$300,000 per month.4. Transaction procedure:(1) Direct link mechanism: The electronic payment institution gives the financial institution holding the account a payment deduction instruction according to user's payment instruction, and the institution disburses funds after authenticating the financial certificate agreed with the electronic payment institution and checking the relevant data of agreed linked deposit account.(2) Indirect link mechanism: The electronic payment institution gives the financial institution holding the account a payment deduction instruction according to user's payment instruction through the financial information service enterprise or clearing house that the dedicated deposit account bank is connected to. The dedicated deposit account bank will authenticate the financial certificate agreed with the institution, and the financial institution holding the account will disburse funds after checking the relevant data of agreed linked deposit account and relevant information sent by the financial information service enterprise or clearing house.5. Private Key Protection: Private keys for the certificate shall be stored in a hardware security module that complies with Common Criteria EAL 4+ (including at least AVA_VLA.4 or AVA_VAN.5) or FIPS 140-2 Level 3 or above, or other modules with the same security strength, and are subject to expressed key export restrictions.6. Access control: The electronic payment institution should establish control mechanism to restrict access to private keys and programs relating to agreed linked deposit account operation by unauthorized personnel or programs.7. Notification mechanism: The electronic payment institution should ask the financial institution holding the account to establish a notification mechanism, by which, the institution will notify the user instantly after making fund transfer.8. Risk control: The electronic payment institution should ask the dedicated deposit account bank or the financial institution holding the account to establish reasonable transaction flow control mechanism.9. Application for termination of agreed linkage:(1) The user should apply for termination of agreed linkage in a manner provided under Item 3 (1) hereof or other manners agreed with the electronic payment institution or the financial institution holding the account.(2) The financial institution holding the account should notify the electronic payment institution when a user directly applies to it for termination of agreed linkage.10. Simplified rules for institutions engaging concurrently in electronic payment business:(1) A bank concurrently engaged in the electronic payment business or Chunghwa Post Co., Ltd. may verify the user’s identity, and complete the agreed linkage and transaction procedures in accordance with the Regulations, instead of the provisions of subparagraphs 2 to 4, 7, and 8.(2) For institutions engaging concurrently in electronic payment business or Chunghwa Post Co., Ltd. that are not the user's bank and adopt indirect link mechanism, the provisions of Item (2) of Subparagraph 2, Item (1).b of Subparagraph 3 and Item (2) of Subparagraph 4 hereof on agreement with the dedicated deposit account bank and authentication of financial certificate do not apply.