The Act Governing Electronic Payment Institutions Article 25

Specialized electronic payment institutions shall establish a user and contracted institution identity verification mechanism and retain the data obtained in the identification process. The user and contracted institution identification process shall adopt a risk-based approach and include a review of beneficial owners.The retention period for data obtained in the user and contracted institution identification process referred to in the preceding paragraph shall be at least five (5) years after the termination of the business relationship.Regulations governing the manner of establishment and process for user and contracted institution identification mechanism referred to in Paragraph 1 hereof, its management, the scope of data obtained in the user and contracted institution identification process prescribed in the preceding paragraph, and other related matters shall be prescribed by the competent authority in consultation with the Ministry of Justice and the Central Bank.