Regulations Governing the Internal Controls and Audit System for Postal Remittances and Savings
Article 24、31 and 34-1 amended and issued on September 8,2023.

Article 24
Chunghwa Post shall set up a compliance unit under the president to take charge of the planning, management, and execution of the regulatory compliance system. The chief legal compliance officer shall also be assigned to act as chief compliance officer for the head office to conduct compliance affairs. The chief compliance officer shall make a report to the board of directors, supervisors at least semiannually, and in case of major regulatory violation or rating downgrade by the financial competent authority, immediately inform the directors and supervisors, and report to the board of directors on compliance matters.
The chief compliance officer at Chunghwa Post cannot be appointed to internal posts other than chief legal officer or chief AML/CFT compliance officer.
The chief compliance officer at Chunghwa Post shall hold a post comparable to that of vice president and meet the qualification requirements set out in the Regulations Governing Postal Remittances and Savings Operations.
The compliance unit of the head office, business units (post office branches of all levels), information unit, assets safekeeping unit, and other management units of Chunghwa Post shall each assign the personnel to act as the compliance officer to take charge of related affairs.
The chief officer and personnel of the compliance unit of Chunghwa Post, as well as the compliance officer of business units (post office branches of all levels), information department, assets management department, and other management departments shall meet one of the following qualification requirements:
1. Having worked as personnel or chief officer of legal compliance office for five years in aggregate.
2. Having attended not less than 30 hours of courses offered by institutions recognized by the FSC, passed the exams and received completion certificates therefor.
Personnel in the previous paragraph shall attend at least fifteen (15) hours of training a year offered by institutions recognized by the FSC or held internally by Chunghwa Post, and the training courses shall cover at least the latest regulatory amendments, new businesses or new financial products launched. The methods for the on-the-job training held by Chunghwa Post itself shall be approved by the board of directors. The head office shall keep the attendance records of relevant personnel for review.
When a dedicated AML/CFT compliance unit is set up under the legal compliance unit, the required training for AML/CFT compliance unit personnel before their appointment/assignment and every year shall observe the relevant AML/CFT regulations and is not subject to the provisions of the two preceding paragraphs.
Chunghwa Post shall file the list of head office chief compliance officers, the chief officers and personnel of the compliance unit as well as their training records with the FSC via an online information system.

Article 31
When commission accountants carry out an audit as stipulated in Paragraph 1 of Article 28 hereof, Chunghwa Post shall submit the accountant’s auditing report to the MOTC and the FSC for reference before the deadline set out by the FSC. This auditing report shall at least cover the scope, basis, procedures and results of the audit.
When the MOTC or the FSC makes inquiries about the contents of the auditing report, the accountants shall provide detailed related data and explanations.


Article 34-1
Chunghwa Post shall assign a manager ranking vice president or higher or an individual with equivalent position to serve concurrently as the chief information security officer, who shall oversee the implementation and coordination of the information security policy and resource allocation.
Chunghwa Post shall set up a dedicated information security unit with independent function, arrange suitable workforce and equipment, and appoint a person with the rank higher than that of the head of the office or equivalent position to serve as the chief officer of such unit.
The staff and the chief officer of the dedicated information security unit under the preceding paragraph shall not be appointed to other posts in charge of information or tasks with conflicts of interest.
The dedicated information security unit is in charge of planning, monitoring, and implementing the management processes of information security. Chunghwa Post shall submit, disclose, and publish the internal control system statement in accordance with the regulations in Paragraph 1 of Article 11 and the chief information security officer shall co-sign and issue the statement.
The personnel of the dedicated information security unit of Chunghwa Post shall attend at least fifteen (15) hours of professional courses regarding information security or on-the-job training every year. The personnel of the head office, business units (post office branches of all levels), information units, assets safekeeping units, and other management units of Chunghwa Post shall attend no less than three hours of information security courses every year.