Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 23

An electronic payment institution should take inventory of rules and regulations applicable to information security, incorporate relevant information security requirements into its internal control systems, and undertake self-evaluation of regulatory compliance regularly to ensure compliance with information security regulations.An electronic payment institution should conduct periodic check of its information systems and security control items set out in these Regulations through its internal control systems, and shall appoint an accountant to examine and produce an information system and security control operation evaluation report when it applies for approval pursuant to Article 10 of the Act and before the end of April every year thereafter.The evaluation report in the preceding paragraph shall contain at least the qualifications of the evaluator, scope of evaluation, deficiencies found in evaluation, severity of deficiency, type of deficiency, description of associated risks, concrete improvement suggestions and social engineering drill results. The evaluation should also be given to the internal audit unit for follow-up of improvement actions taken. The aforementioned report and documents on improvement of deficiencies shall be retained for at least 2 years.To ensure the privacy and security of transaction data and to ensure that the accuracy of data transfer, exchange or processing is maintained, the competent authority may, if deemed necessary, require an electronic payment institution to raise the standards for its information system and step up its security management operations.