Regulations Governing Implementation of Internal Control and Audit System for Anti-Money Laundering and Countering Terrorism Financing of Insurance Companies, Post Offices Engaging in Simple Life Insurance Business and Other Financial Institutions De Article 5
With the exception of individuals practicing as an insurance agent or broker, the internal control system of insurance companies, post offices engaging in simple life insurance business and other FSC-designated institution for AML/CFT and any subsequent amendment thereto shall be approved by its board of directors (council). The internal control system shall contain the following particulars:1. The policies and procedures to identify, assess and manage its money laundering and terrorist financing risks.2. An AML/CFT program established based on money laundering and terrorist financing risks and business size to manage and mitigate identified risks, which also includes enhanced control measures for higher risk situations.3. Standard operating procedures for monitoring compliance with AML/CFT regulations and for the implementation of AML/CFT program, which shall be included in the self-inspection and internal audit system, and enhanced if necessaryWhen insurance companies, post offices engaging in simple life insurance business and other FSC-designated institutions carry out the identification, assessment and management of money laundering and terrorist financing risks mentioned in Subparagraph 1 of the preceding paragraph, the operation should cover at least customers, geographic areas, products and services, transactions, and delivery channels, and be conducted in accordance with the following provisions:1. Produce a risk assessment report;2. Risk assessment should consider all risk factors to determine the level of overall risk, and appropriate measures to mitigate the risks;3. There should be a risk assessment update mechanism in place to ensure that risk data are kept up-to-date.4. When the risk assessment report is completed or updated, submit the report to the FSC for recordation.The AML/CFT program mentioned in Subparagraph 2 of Paragraph 1 hereof shall include the following policies, procedures and controls; the AML/CFT program of insurance agent companies, insurance broker companies and individuals practicing as an insurance agent or broker need not include Items 2 and 3 below1. Verification of customer identity;2. Watch list filtering of customers and trading counterparties;3. Ongoing monitoring of transactions;4. Record keeping;5. Reporting of currency transactions above a certain amount;6. Reporting of suspicious money laundering or terrorist financing transactions.7. Appointment of a compliance officer at the management level to take charge of AML/CFT compliance matters;8. Employee screening and hiring procedure;9. Ongoing employee training program;10. An independent audit function to test the effectiveness of AML/CFT system; and11. Other matters required by the AML/CFT regulations and the competent authoritiesInsurance companies, post offices engaging in simple life insurance business and other FSC-designated institutions shall establish a group-level AML/CFT program for implementation by branches (or subsidiaries) within the group. The AML/CFT program shall include the policies, procedures and controls mentioned in the preceding paragraph, and in addition, the following particulars without violating the information confidentiality regulations of the ROC and countries or jurisdictions at where the foreign branches (or subsidiaries) are located:1. Policies and procedures for sharing information within the group required for the purposes of customer due diligence and money laundering and terrorist financing risk management;2. When necessary for AML/CFT purposes, group-level compliance, audit, and AML/CFT functions should be provided with customer and transaction information as well as information on unusual transactions or activities and analysis therefor from foreign branches (or subsidiaries); when necessary, foreign branches (or subsidiaries) can access such information through group management functions; and3. Adequate safeguards on the confidentiality and use of information exchanged, including safeguard against information leakage.Insurance companies, post offices engaging in simple life insurance business and other FSC-designated institutions shall ensure that its foreign branches (or subsidiaries) apply AML/CFT measures to the extent that the laws and regulations of host countries or jurisdictions so permit, and those measures should be consistent with those adopted by the head office (or parent company). Where the minimum requirements of the countries where its head office (or parent company) and branches (or subsidiaries) are located are different, the branch (or subsidiary) shall choose to follow the criteria which are higher. However, in case there is any doubt regarding the determination of higher or lower criteria, the determination by the competent authority of the place at where the head office of insurance company, post office engaging in simple life insurance business or other FSC-designated institution is located shall prevail. If a foreign branch (or subsidiary) is unable to adopt the same criteria as the head office (or parent company) due to prohibitions from foreign laws and regulations, appropriate additional measures should be taken to manage the risks of money laundering and terrorist financing, and a report shall be made to the FSC.For insurance companies, post offices engaging in simple life insurance business and other FSC-designated institutions that have a board of directors (council) established, its board of directors (council) holds the ultimate responsibility for ensuring the establishment and maintenance of appropriate and effective AML/CFT internal controls. The board of directors (council) and senior management of the company/post office/institution should understand its money laundering and terrorist financing risks and the operation of its AML/CFT program, and adopt measures to create a culture of AML/CFT compliance.
中文原文 保險公司與辦理簡易人壽保險業務之郵政機構及其他經金融監督管理委員會指定之金融機構防制洗錢及打擊資恐內部控制與稽核制度實施辦法第5條
保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構防制洗錢及打擊資恐之內部控制制度，除個人執業之保險代理人或保險經紀人外，應經董（理）事會通過；修正時，亦同。
其內容並應包括下列事項：
一、就洗錢及資恐風險進行辨識、評估、管理之相關政策及程序。
二、依據洗錢及資恐風險、業務規模，訂定防制洗錢及打擊資恐計畫，以管理及降低已辨識出之風險，並對其中之較高風險，採取強化控管措施。
三、監督控管防制洗錢及打擊資恐法令遵循及防制洗錢及打擊資恐計畫執行之標準作業程序，並納入自行查核及內部稽核項目，且於必要時予以強化。
前項第一款洗錢及資恐風險之辨識、評估及管理，應至少涵蓋客戶、地域、產品及服務、交易及通路等面向，並依下列規定辦理：
一、製作風險評估報告。
二、考量所有風險因素，以決定整體風險等級，及降低風險之適當措施。
三、訂定更新風險評估報告之機制，以確保風險資料之更新。
四、於完成或更新風險評估報告時，將風險評估報告送本會備查。
第一項第二款之防制洗錢及打擊資恐計畫，應包括下列政策、程序及控管機制，保險代理人公司、保險經紀人公司及個人執業之保險代理人或保險經紀人防制洗錢及打擊資恐計畫得不包括下列第二目及第三目：
一、確認客戶身分。
二、客戶及交易有關對象之姓名及名稱檢核。
三、交易之持續監控。
四、紀錄保存。
五、一定金額以上通貨交易申報。
六、疑似洗錢或資恐交易申報。
七、指定防制洗錢及打擊資恐專責主管負責遵循事宜。
八、員工遴選及任用程序。
九、持續性員工訓練計畫。
十、測試防制洗錢及打擊資恐機制有效性之獨立稽核功能。
十一、其他依防制洗錢及打擊資恐相關法令及本會規定之事項。
保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構應訂定集團層次之防制洗錢及打擊資恐計畫，於集團內之分公司（或子公司）施行。
其內容除包括前項政策、程序及控管機制外，並應在符合我國及國外分公司（或子公司）所在地資料保密法令規定之情形下，訂定下列事項：
一、確認客戶身分與洗錢及資恐風險管理目的所需之集團內資訊分享政策及程序。
二、為防制洗錢及打擊資恐目的，於有必要時，依集團層次法令遵循、稽核及防制洗錢及打擊資恐功能，得要求國外分公司（或子公司）提供有關客戶及交易資訊，並應包括異常交易或活動之資訊及所為之分析；必要時，亦得透過集團管理功能使國外分公司（或子公司）取得上述資訊。
三、對運用被交換資訊及其保密之安全防護，包括防範資料洩漏之安全防護。
保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構應確保其國外分公司（或子公司），在符合當地法令情形下，實施與總公司（或母公司）一致之防制洗錢及打擊資恐措施。
當總公司（或母公司）與分公司（或子公司）所在國之最低要求不同時，分公司（或子公司）應就兩地選擇較高標準者作為遵循依據，惟就標準高低之認定有疑義時，以保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構所在國之主管機關之認定為依據；倘因外國法規禁止，致無法採行與總公司（或母公司）相同標準時，應採取合宜之額外措施，以管理洗錢及資恐風險，並向本會申報。
已設董（理）事會之保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構，董（理）事會對確保建立及維持適當有效之防制洗錢及打擊資恐內部控制負最終責任。
董（理）事會及高階管理人員應瞭解其洗錢及資恐風險，及防制洗錢及打擊資恐計畫之運作，並採取措施以塑造重視防制洗錢及打擊資恐之文化。
其內容並應包括下列事項：
一、就洗錢及資恐風險進行辨識、評估、管理之相關政策及程序。
二、依據洗錢及資恐風險、業務規模，訂定防制洗錢及打擊資恐計畫，以管理及降低已辨識出之風險，並對其中之較高風險，採取強化控管措施。
三、監督控管防制洗錢及打擊資恐法令遵循及防制洗錢及打擊資恐計畫執行之標準作業程序，並納入自行查核及內部稽核項目，且於必要時予以強化。
前項第一款洗錢及資恐風險之辨識、評估及管理，應至少涵蓋客戶、地域、產品及服務、交易及通路等面向，並依下列規定辦理：
一、製作風險評估報告。
二、考量所有風險因素，以決定整體風險等級，及降低風險之適當措施。
三、訂定更新風險評估報告之機制，以確保風險資料之更新。
四、於完成或更新風險評估報告時，將風險評估報告送本會備查。
第一項第二款之防制洗錢及打擊資恐計畫，應包括下列政策、程序及控管機制，保險代理人公司、保險經紀人公司及個人執業之保險代理人或保險經紀人防制洗錢及打擊資恐計畫得不包括下列第二目及第三目：
一、確認客戶身分。
二、客戶及交易有關對象之姓名及名稱檢核。
三、交易之持續監控。
四、紀錄保存。
五、一定金額以上通貨交易申報。
六、疑似洗錢或資恐交易申報。
七、指定防制洗錢及打擊資恐專責主管負責遵循事宜。
八、員工遴選及任用程序。
九、持續性員工訓練計畫。
十、測試防制洗錢及打擊資恐機制有效性之獨立稽核功能。
十一、其他依防制洗錢及打擊資恐相關法令及本會規定之事項。
保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構應訂定集團層次之防制洗錢及打擊資恐計畫，於集團內之分公司（或子公司）施行。
其內容除包括前項政策、程序及控管機制外，並應在符合我國及國外分公司（或子公司）所在地資料保密法令規定之情形下，訂定下列事項：
一、確認客戶身分與洗錢及資恐風險管理目的所需之集團內資訊分享政策及程序。
二、為防制洗錢及打擊資恐目的，於有必要時，依集團層次法令遵循、稽核及防制洗錢及打擊資恐功能，得要求國外分公司（或子公司）提供有關客戶及交易資訊，並應包括異常交易或活動之資訊及所為之分析；必要時，亦得透過集團管理功能使國外分公司（或子公司）取得上述資訊。
三、對運用被交換資訊及其保密之安全防護，包括防範資料洩漏之安全防護。
保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構應確保其國外分公司（或子公司），在符合當地法令情形下，實施與總公司（或母公司）一致之防制洗錢及打擊資恐措施。
當總公司（或母公司）與分公司（或子公司）所在國之最低要求不同時，分公司（或子公司）應就兩地選擇較高標準者作為遵循依據，惟就標準高低之認定有疑義時，以保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構所在國之主管機關之認定為依據；倘因外國法規禁止，致無法採行與總公司（或母公司）相同標準時，應採取合宜之額外措施，以管理洗錢及資恐風險，並向本會申報。
已設董（理）事會之保險公司、辦理簡易人壽保險業務之郵政機構及其他經本會指定機構，董（理）事會對確保建立及維持適當有效之防制洗錢及打擊資恐內部控制負最終責任。
董（理）事會及高階管理人員應瞭解其洗錢及資恐風險，及防制洗錢及打擊資恐計畫之運作，並採取措施以塑造重視防制洗錢及打擊資恐之文化。