Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation｜第 4 條｜銀行｜Regulation｜In Force
金融監督管理委員會｜v1.0
Last Amended: 2026-04-13
A financial institution shall conduct outsourcing operations in accordance with its internal outsourcing rules approved by its board of directors under the premises that outsourcing will not affect the sound operation of the financial institution, the interests of customers, or regulatory compliance. The internal outsourcing rules of the branches of a foreign financial institution in Taiwan (including branches of foreign banks in Taiwan and foreign credit card companies) may be approved by an officer authorized by the head office. The internal outsourcing rules referred to in the preceding paragraph shall specify the following contents: 1. Outsourcing policies and principles, including evaluation of outsourcing decisions, risk management mechanisms, approval hierarchy, and governance structure. 2. Division of authority and responsibility of unit-in-charge and relevant units regarding the control of outsourced operations. 3. Scope of operations that may be outsourced and outsourcing procedures. 4. Internal operations and procedures that assure the protection of customer interests. 5. Risk management principles and operating procedures. 6. Internal control principles and operating procedures. 7. Other outsourcing operations and procedures. A financial institution is ultimately responsible for its outsourcing. It shall evaluate the risk level and materiality of outsourced operations and the impact of outsourcing on customer interests, adopt appropriate management measures based on the risk-based approach, and comply with the following provisions: 1. The board of directors shall be aware of the outsourcing risks and regularly oversee the execution status of outsourced operations. 2. A financial institution shall ensure that the unit-in-charge and relevant units have adequate resources, expertise, and authority over the control of outsourced operations. 3. A financial institution shall identify, evaluate, and manage outsourcing of operations deemed material, and formulate relevant procedures and policies. A financial institution shall formulate enhanced controls and emergency response measures for outsourcing arrangements which may significantly impact on normal operations or customer interests. 4. A financial institution shall formulate proper due diligence and periodic review procedures to ensure that service providers possess the expertise and resources for the execution of outsourced operations, are financially sound, have internal control and information security management mechanisms, and meet regulatory requirements. 5. A financial institution shall ensure that the itself, the competent authority, and the Central Bank or persons designated by them can have access to relevant data or reports of service providers and conduct financial examinations or audits with respect to the outsourced operations, or order service providers to provide relevant data or reports within a prescribed time period. A branch of a foreign financial institution in Taiwan may designate its head office or regional head office to be responsible and handle the matters of applying the provisions in the preceding paragraph. However, the unit-in-charge shall still be handled by personnel from the branches of foreign financial institutions in Taiwan and shall fully understand the control of outsourcing activities in Taiwan by the head office or regional headquarters authorized thereby. The term "materiality" under these Regulations refers to one of the following conditions: 1. Where the outsourced operation cannot be performed or where there are concerns regarding information security, and such issues will significantly impact business operations of the financial institution. 2. Where the outsourced operation is involved in a customer data security incident that has a significant impact on the interests of the financial institution or customers. 3. Where the outsourced operation has otherwise had a significant impact on the interests of the financial institution or customers.