Rules Governing the Business of Electronic Stored Value Card Issuers Article 21

Issuers shall establish internal control and audit systems and implement them diligently and effectively.The internal control systems of an issuer regarding management and business rules of organization charter, overall business strategy, major policies, material risks, shall be passed by its board of directors, whereas the rest of the operations shall be carried out in accordance with the internal division of responsibility and authorization rules passed by the board of directors. If any of the directors voices opposition or reservation in a board of directors’ meeting, such opinions and reasons held shall be documented in the meeting minutes, which, together with the internal control systems passed by the board of directors, shall be submitted to the supervisors or the audit committee of the issuer. The preceding provision applies to any revision to the internal control systems.Issuers shall set up an internal audit unit directly under the board of directors, and assign an appropriate number of qualified and full-time internal auditors, including the computer auditor.The internal audit unit shall, based on the results of risk assessment, draft annual audit plan and seek the approval of the board of directors. The preceding provision applies to any revision to the annual audit plan.The internal audit unit of an issuer shall conduct at least one general audit and one special audit a year of the business, assets safekeeping and information technology units, and shall conduct at least one special audit of other management units a year. The internal audit reports shall be submitted to the supervisors as well as independent director(s) or the audit committee, if applicable, for review. The internal audit reports shall also be filed with the Competent Authority in two (2) months from the completion of the audit.