Point 1
These Directions are specifically adopted to strengthen the anti-money laundering and countering terrorism financing (AML/CFT) regime, and enhance soundness of the internal control and internal audit system of the securities or futures industry.

Point 2
A securities or futures business shall conduct matters related to AML/CFT in accordance with these Directions as well as relevant provisions in the Money Laundering Control Act, Terrorism Financing Prevention Act, and Regulations Governing Cash Transaction Reports (CTR) and Suspicious Transaction Reports (STR) by Financial Institutions.

Point 3
The "securities or futures business" referred to in these Directions include securities brokers, securities investment and trust enterprises, securities finance enterprises, securities investment consulting enterprises, securities central depository enterprises, futures brokers, futures trust enterprises and managed futures enterprises.

Point 4
A securities or futures business shall comply with the following provisions in undertaking customer due diligence (CDD) measures:
1. A securities or futures business shall not keep anonymous accounts or accounts in fictitious names.
2. A securities or futures business shall undertake customer due diligence (CDD) measures when:
A. establishing business relations with any customer;
B. carrying out any transactions settled by cash payment (includes a customer subscribes to a single fund and pay with cash) of NT$500,000 or more (including the foreign currency equivalent thereof).
C. there is a suspicion of money laundering or terrorism financing, or carrying out any transactions from a country or region with high money laundering and terrorism financing risk; or
D. a securities or futures business has doubts about the veracity or adequacy of previously obtained customer identification data.
3. The CDD measures to be taken by a securities or futures business are as follows:
A. Identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information. In addition, a securities or futures business shall retain copies of the customer's identity documents or record the relevant information thereon.
B. Verifying that any person purporting to act on behalf of the customer is so authorized, identifying and verifying the identity of that person using reliable, independent source documents, data or information where the customer opens an account or conducts a transaction through an agent. In addition, the securities or futures business shall retain copies of the person's identity documents or record the relevant information thereon.
C. Taking reasonable measures to identify and verify the identity of the beneficial owner of a customer.
D. Enquiring information on the purpose and intended nature of the business relationship when undertaking CDD measures.
4. When the customer is a legal person or a trustee, a securities or futures business shall, in accordance with the preceding subparagraph, understand the business nature, ownership, and control structure of the customer or trust (including trust-like legal arrangements) and obtain at least the following information to identify and verify the identity of the customer or the trust:
A. Name, legal form and proof of existence of the customer or trust.
B. The powers that regulate and bind the legal person or trust, as well as the names of the relevant persons having a senior management position in the legal person or trustee.
C. The address of the registered office of the legal person or trustee, and the address of its principal place of business.
5. When the customer is a legal person, a securities or futures business shall understand whether the customer is able to issue bearer shares and adopt appropriate measures for customers who have issued bearer shares to ensure that information on its beneficial owners is kept up-to-date.
6. When the customer is a legal person or a trustee, a securities or futures business shall, in accordance with Item C of Subparagraph 3, obtain the following information to identify the beneficial owners of the customer and take reasonable measures to verify the identity of such persons:
A. For legal persons:
a. The identity of the natural persons who ultimately have a controlling ownership interest in a legal person. A controlling ownership interest refers to owning more than 25 percents of a company's shares or capital;
b. To the extent that there is doubt under a. above as to whether the person(s) with the controlling ownership interest are the beneficial owner(s) or where no natural person exerting control through ownership interests is identified, the identity of the natural persons (if any) exercising control of the customer through other means.
c. Where no natural person is identified under a. or b. above, a securities or futures business shall identify the relevant natural person who holds the position of senior managing official.
B. For trustees: the identity of the settlor(s), the trustee(s), the trust supervisor, the beneficiaries, and any other person exercising ultimate effective control over the trust, or the identity of persons in equivalent or similar positions;
C. Unless otherwise provided for in the Proviso of Subparagraph 2 of Point 7, a securities or futures business is not subject to the aforementioned requirements of identifying and verifying the identity of shareholders or beneficial owners of a customer if the customer or a person having a controlling ownership interest in the customer is any of the following:
a. an R.O.C government entity;
b. an enterprise owned by the R.O.C. government;
c. a foreign government entity;
d. a public company and its subsidiaries;
e. an entity listed on a stock exchange outside of R.O.C. that is subject to regulatory disclosure requirements of its principal shareholders, and the subsidiaries of such entity;
f. a financial institution supervised by the R.O.C. government, and an investment vehicles managed by such institution;
g. a financial institution incorporated or established outside R.O.C. that is subject to and supervised for compliance with AML/CFT requirements consistent with standards set by the FATF, and an investment vehicle managed by such institution;
h. Public Service Pension Fund, Labor Insurance, Labor Pension Fund and Postal Savings of R.O.C.
7. A securities or futures business should not establish a business relationship or carry out occasional transactions with a customer before completing the CDD process. Provided, a securities or futures business may first obtain information on the identity of the customer and any beneficial owner and then complete the verification following the establishment of a business relationship, if all of the following requirements are met:
A. Money laundering and terrorist financing risks are effectively managed, including adopting risk management procedures with respect to the conditions under which a customer may utilize the business relationship to complete a transaction prior to verification.
B. It would be essential not to interrupt the normal conduct of business with the customer.
C. Verification of the identities of the customer and beneficial owner will be completed as soon as reasonably practicable following the establishment of business relationship. The securities or futures business shall terminate the business relationship if verification cannot be completed as soon as reasonably practicable, and inform the customer in advance.
8. Where a securities or futures business is unable to complete the required CDD process on a customer, it should consider reporting suspicious transactions in relation to the customer.
9. If a securities or futures business suspects that a customer or transaction may relate to money laundering or terrorist financing and reasonably believes that performing the CDD process might tip-off the customer, it may choose not to pursue that process, and file a suspicious transactions report instead.

Point 5
If there exists any of the following situations in the CDD process, a securities or futures business should decline to establish a business relationship or carry out any transaction with the customer:
1. The customer is suspected of using a fake name, a nominee, a shell entity, or a shell corporation to open an account;
2. The customer refuses to provide the required documents for identifying and verifying the customer's identity;
3. Where for a customer that opens an account through a representative or an agent, it is difficult to check and verify the facts of representation or authorization and identity related information;
4. The customer uses forged or altered identification documents, or when conducting face-to-face business dealings or transactions provides only photocopies of the identification documents;
5. Documents provided by the customer are suspicious or unclear, or the customer refuses to provide other supporting documents, or the documents provided cannot be authenticated;
6. The customer procrastinates in providing identification documents in an unusual manner;
7. Other unusual circumstances exist in the process of establishing a business relationship and the customer fails to provide reasonable explanations; or
8. The customer is an individual, legal entity, or organization sanctioned under the Terrorism Financing Prevention Act or a terrorist or terrorist group identified or investigated by a foreign government or an international anti-money laundering organization.

Point 6
Ongoing customer due diligence:
1. A securities or futures business shall apply CDD measures with respect to the identity and information of existing customers on the basis of materiality and risk, and conduct due diligence on such existing relationships at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained. The aforementioned appropriate times include at least:
A. When the customer opens a new account or enters new business relationships;
B. When it is time for periodic review of the customer scheduled on the basis of materiality and risk; and
C. When it becomes known that there is a material change to a customer's identity and background information.
2. A securities or futures business shall conduct ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions being conducted are consistent with the business's knowledge of the customer, its business, and its risk profile, including, where necessary, ascertaining the source of funds.
3. A securities or futures business shall periodically review the adequacy of customer identification information obtained in respect of customers and beneficial owners and ensure that the information is kept up to date, particularly for higher risk categories of customers, for whom the securities or futures business should conduct review at least once every year.
4. A securities or futures business is entitled to rely on the identification and verification steps that it has already undertaken, therefore a securities or futures business is allowed not to repeatedly identify and verify the identity of each customer every time that a customer conducts a transaction unless it has doubts about the veracity of that information. Examples of situations that might lead a securities or futures business to have such doubts could be where there is a suspicion of money laundering in relation to that customer, or where there is a material change in the way that the customer's account is operated, which is not consistent with the customer's business profile. In such events, the securities or futures business shall conduct CDD again in accordance with the provisions of Point 4.

Point 7
A securities or futures business shall determine the extent of applying CDD and ongoing monitoring measures under Subparagraph 3 of Point 4 and the preceding Point using a risk-based approach (RBA):
1. For higher risk circumstances, a securities or futures business shall apply enhanced CDD or ongoing CDD measures by adopting additionally at least the following enhanced measures:
A. Obtaining the approval of senior management before establishing or entering a new business relationship;
B. Adopting reasonable measures to understand the sources of wealth and the source of funds of the customer; and
C. Adopting enhanced ongoing monitoring of business relationship.
2. For lower risk circumstances, a securities or futures business may adopt simplified CDD measures, which shall be commensurate with the lower risk factors. However, simplified CDD measures are not allowed in the following circumstances:
A. Where the customers are from or in countries and jurisdictions known to have inadequate AML/CFT regimes, including but not limited to those which designated by international organizations on AML/CFT as countries or regions with serious deficiencies in their AML/CFT regime, and other countries or regions that do not or insufficiently comply with the recommendations of international organizations on AML/CFT as forwarded by the Financial Supervisory Commission (FSC); or
B. Where a securities or futures business suspects that money laundering or terrorism financing is involved.

Point 8
Policies and procedures for checking the names of customers and trading counterparties:
1. A securities or futures business shall establish policies and procedures for checking the names of customers and trading counterparties using a risk-based approach to detect, match, and filter customers or trading counterparties that are individuals, legal entities, or organizations sanctioned under the Terrorism Financing Prevention Act or terrorists or terrorist groups identified or investigated by a foreign government or an international anti-money laundering organization, and handle related matters in compliance with Article 7 of the Terrorism Financing Prevention Act.
2. The policies and procedures for checking the names of customers and trading counterparties of a securities or futures business shall include at least matching and filtering logics, implementation procedures, and inspection standards, and shall be documented.
3. A securities or futures business shall document its name checking operations and maintain the records for a time period in accordance with Point 10.

Point 9
Ongoing monitoring of accounts and transactions:
1. A securities or futures business shall use an information system to consolidate basic information and transaction information on all customers for inquiries by the head office and branches for AML/CFT purpose so as to strengthen the business's account and transaction monitoring ability. A securities or futures business shall also establish internal control procedures for requests and inquiries as to customer information made by various entities, and shall exercise care to ensure the confidentiality of the information.
2. A securities or futures business shall establish policies and procedures for account and transaction monitoring using a risk-based approach and utilize the information system to assist in the detection of suspicious transactions.
3. A securities or futures business shall review its policies and procedures for account and transaction monitoring based on AML/CFT laws and regulations, the nature of its customers, business size and complexity, money laundering and terrorist financing related trends and information obtained from internal and external sources, and the results of internal risk assessment, and update those policies and procedures periodically.
4. The policies and procedures for account and transaction monitoring of a securities or futures business shall include at least the procedures for establishing a complete monitoring system, and carrying out the setting of parameters, threshold amounts, alerts and monitoring operations, the procedures for checking the monitored cases and reporting standards, and shall be documented.
5. A complete monitoring system mentioned in the preceding Subparagraph shall include the patterns published by the trade associations and additional monitoring patterns in reference to the securities or futures business' own money laundering and terrorist financing risk assessment or daily transaction information. Examples of monitoring patterns are as follows:
A. Where a customer makes a large transaction or transactions, which do not appear to be commensurate with the customer's status and income or are unrelated to the nature of the customer's business.
B. Where three or more third-party accounts are used to disperse large transactions, and there are obvious irregularities.
C. Where there are large and frequent transactions through an account opened collectively by company employees or by members of a specific organization.
D. Where there are suddenly large transactions in a newly opened account or an account that has had no transactions for 1 year or longer.
E. Where a transaction or transactions involve a country or region with high money laundering or terrorism financing risk, and such transactions do not appear to be commensurate with the customer's status and income, or are unrelated to the nature of the customer's business.
F. Where the ultimate beneficiary or the counterparty of a transaction is a terrorist or terrorist group as advised by the FSC based on information provided by foreign governments, or a terrorist organization identified or investigated by an international organization against money laundering; or where there is reasonable reason to suspect that funds involved in the transaction are or have been linked with a terrorist activity, terrorist organization or financing of terrorism.
6. A securities or futures business shall document its ongoing account and transaction monitoring operation and maintain the records in accordance with Point 10.

Point 10
A securities or futures business shall keep records on all business relations and transactions with its customers in accordance with the following provisions:
1. A securities or futures business shall maintain, for at least five years, all necessary records on transactions, both domestic and international.
2. A securities or futures business shall keep all the following information for at least five years after the business relationship is ended, or after the date of the occasional transaction:
A. All records obtained through CDD measures, such as copies or records of official identification documents like passports, identity cards, driving licenses or similar documents.
B. Account files.
C. Business correspondence, including inquiries to establish the background and purpose of complex, unusual large transactions and the results of any analysis undertaken.
3. Transaction records maintained by a securities or futures business must be sufficient to permit reconstruction of individual transactions so as to provide, if necessary, evidence for determination of criminal activity.
4. A securities or futures business shall ensure that information on transaction records and CDD information will be swiftly made available to the competent authorities when such requests are made with appropriate authority.

Point 11
When conducting CDD, a securities or futures business should use a self-established database or information obtained from external sources to determine whether a customer or beneficial owner is a person who is or has been entrusted with a prominent function by a foreign government or an international organization (hereinafter, "politically exposed person (PEP)"):
1. For a customer or beneficial owner determined to be a current PEP of a foreign government, a securities or futures business shall directly deem the customer a high-risk customer, and adopt enhanced CDD measures under Subparagraph 1 of Point 7.
2. For a customer or beneficial owner determined to be a current PEP of an international organization, a securities or futures business shall assess the risks when establishing a business relationship with the person and conduct annual review thereafter. When the securities firm deems the business relationship to be high-risk, it shall adopt enhanced CDD measures under Subparagraph 1 of Point 7.
3. The preceding two Subparagraphs apply to family members or close associates of PEPs.
4. For former PEPs of foreign governments or international organizations, a securities or futures business shall assess risks based on the level of influence that the individual could still exercise, the seniority of the position that the individual held as a PEP, etc. If it is determined that the person is still a PEP, the provisions of the preceding three Subparagraphs shall apply.

Point 12
Prior to the launch of new products or services or new business practices (including new payment or delivery mechanisms, use of new technologies for pre-existing or new products or business practices), a securities or futures business should assess the money laundering or terrorist financing risks that may arise in relation thereto, and establish relevant risk management measures to mitigate those risks.

Point 13
Internal control system:
1. The internal control system established by a securities or futures business according to Article 2 of the Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets, Articles 2, 35-1 of the Regulations Governing Securities Firms, Article 2 of the Regulations Governing Futures Commission Merchants, Articles 6, 33 of the Regulations Governing Futures Trust Enterprises, Articles 8 of the Regulations Governing Managed Futures Enterprises, Articles 2, 22-1 of the Regulations Governing Securities Investment Trust Enterprises, Article 2 of the Regulations Governing Securities Investment Consulting Enterprises, Articles 6, 42 of the Regulations Governing Offshore Funds , Article 22-1 of the Regulations Governing the Conduct of Discretionary Investment Business by Securities Investment Trust Enterprises and Securities Investment Consulting Enterprises, Article 5 of the Regulations Governing Securities Finance Enterprises shall contain the following items:
A. The policy and procedure to identify, assess and manage its money laundering and terrorism financing risks.
B. An AML/CFT program established based on money laundering and terrorist financing risks and business size to manage and mitigate identified risks, which also includes enhanced control measures for higher risk situations.
C. Standard operational procedures for monitoring compliance with AML/CFT regulations and for the implementation of AML/CFT program, which shall be included in the self-inspection and internal audit system, and enhanced if necessary.
2. The money laundering and terrorist financing risks mentioned in Item A of the preceding Subparagraph shall be identified, assessed and managed in accordance with the following provisions:
A. Risk assessment should be documented;
B. Risk assessment should consider all risk factors and cover at least customers, geographic areas, products and services, transactions, or payment and delivery channels to determine the level of overall risk, and appropriate measures to mitigate the risks; and
C. There should be a risk assessment update mechanism in place to ensure that risk data are kept up-to-date.
3. The AML/CFT program mentioned in Item B of Subparagraph 1 shall include the following policies, procedures and controls:
A. Verification of customer identity;
B. Checking of names of customers and trading counterparties;
C. Ongoing monitoring of accounts and transactions;
D. Record keeping;
E. Reporting of currency transactions above a certain amount;
F. Reporting of suspicious transactions;
G. Appointment of a compliance officer at the management level to take charge of AML/CFT compliance matters;.
H. Employee screening and hiring procedure;
I. Ongoing employee training program;
J. An independent audit function to test the effectiveness of AML/CFT systems; and
K. Other matters required by the AML/CFT laws and regulations and the competent authorities.
4. A securities or futures business having overseas branches and subsidiaries shall establish a group-level AML/CFT program, which shall include the policies, procedures and controls mentioned in the preceding Subparagraph, and in addition, the following particulars, without violating the information confidentiality regulations of the ROC and of the countries or jurisdictions where the foreign branches and subsidiaries are located:
A. Policies and procedures for sharing information within the group required for the purposes of CDD and money laundering and terrorist financing risk management;
B. For AML/CFT purposes, the overseas branches or subsidiaries must have in place compliance and audit rules that are consistent with the group-level program, and must provide customer, account, and transaction information; and
C. Safeguards on the use and confidentiality of information exchanged.
5. A securities or futures business shall ensure that its foreign branches and subsidiaries apply AML/CFT measures, to the extent that the laws and regulations of host countries or jurisdictions so permit, consistent with the home country requirements. Where the minimum requirements of the countries where its head office (or parent) and branches or subsidiaries are located are different, the branch or subsidiary shall choose to follow the criteria which are higher. However, in case there is any doubt regarding the determination of higher or lower criteria, the determination by the competent authority of the place where the head office (or parent) of the securities or futures business is located shall prevail. If a foreign branch or subsidiary is unable to adopt the same criteria as the head office (or parent) due to prohibitions from foreign laws and regulations, appropriate additional measures should be taken to manage the risks of money laundering and terrorist financing, and a report shall be made to the FSC.
6. The board of directors and senior management of a securities or futures business should understand its money laundering and terrorist financing risks and the operation of its AML/CFT program, and adopt measures to create a culture of AML/CFT compliance.

Point 14
Chief AML/CFT compliance officer:
1. A securities or futures business shall appoint an adequate number of AML/CFT personnel appropriate to the size and risks of the business. The board of directors of the securities or futures business shall appoint a senior officer to serve as the chief AML/CFT compliance officer and vest the officer full authority in AML/CFT implementation. The officer should report to the board of directors and the supervisors (or the audit committee) at least semiannually, or whenever a major regulatory violation is discovered. The aforementioned AML/CFT personnel and the chief AML/CFT compliance officer may not hold any concurrent posts that may have a conflict of interest with their AML/CFT responsibilities.
2. The chief AML/CFT compliance officer mentioned in the preceding paragraph shall be charged with the following duties:
A. Supervising the planning and implementation of policies and procedures for identifying, assessing, and monitoring money laundering and terrorist financing risks.
B. Coordinating and supervising business-wide AML/CFT risk identification and assessment.
C. Monitoring and controlling money laundering and terrorist financing risks.
D. Developing an AML/CFT program.
E. Coordinating and supervising the implementation of AML/CFT program.
F. Confirming compliance with AML/CFT laws and regulations, including relevant compliance templates or self-regulatory rules produced by the financial services trade association to which the securities or futures business belongs and approved by the FSC.
G. Supervising the reporting on suspicious transactions and on the properties or property interests and location of individuals or entities designated by the Terrorism Financing Prevention Act to the Investigation Bureau, Ministry of Justice.
3. Any overseas business unit of a securities or futures business shall be staffed with an adequate number of AML/CFT personnel in view of the number of local branches, and the size and risks of its business, and appoint an AML/CFT compliance officer to take charge of related compliance matters.
4. The appointment of an AML/CFT compliance officer by an overseas business unit of a securities or futures business shall comply with the local regulations and the requirements of the local authorities of the host jurisdiction. The AML/CFT compliance officer shall be vested with full authority in AML/CFT implementation, including reporting directly to the chief AML/CFT compliance officer mentioned in Subparagraph 1, and should not hold any other posts, except for the post of legal compliance officer. If the AML/CFT compliance officer holds other concurrent posts, the foreign business unit should communicate that fact with the local competent authority to confirm that the holding of other concurrent posts will not result or potentially result in any conflict of interest, and report the matter to the FSC for record.

Point 15
Implementation and statement of internal AML/CFT control system:
1. The domestic and foreign business units of a securities or futures business shall appoint a senior manager to act as a supervisory officer in charge of supervising the AML/CFT related matters of the business unit, and conduct self-assessment in accordance with the Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets.
2. The internal audit unit of a securities or futures business shall audit the following matters and submit audit opinions in accordance with the Regulations Governing the Establishment of Internal Control Systems by Service Enterprises in Securities and Futures Markets:
A. Whether the money laundering and terrorist financing risk assessment and the AML/CFT program meet the regulatory requirements and are vigorously implemented; and
B. The effectiveness of AML/CFT program.
3. The president of a securities or futures business should oversee that respective units prudently evaluate and review the implementation of internal AML/CFT control system. The chairman, president, chief auditor and chief AML/CFT compliance officer shall jointly issue a statement on internal AML/CFT control (see attached), which shall be submitted to the board of directors for approval and disclosed on the website of the securities or futures business within three months after the end of each fiscal year, and filed via a website designated by the FSC.

Point 16
Employee hiring and training:
1. A securities or futures business shall establish prudent and appropriate procedures for employee screening and hiring, including examining whether the prospective employee has integrity of character and the professional knowledge required to perform their duties.
2. The chief AML/CFT compliance officer, the personnel of dedicated AML/CFT unit, and the AML/CFT supervisory officer of domestic business units, of a securities or futures business shall possess one of the following qualification requirements:
A. Having served as a compliance officer or AML/CFT personnel on a full-time basis for at least 3 years;
B. Having attended not less than 24 hours of courses recognized by the FSC, passed the exams and received completion certificates therefor. Chief AML/CFT compliance officers and personnel of dedicated AML/CFT units who are appointed/assigned to the post prior to 30 June 2017 may receive the aforementioned certificates within 6 months after the appointment/assignment, and the AML/CFT supervisory officers of domestic business units may receive such certificates within 1 year after the appointment/assignment; or
C. Having received a domestic or international AML/CFT professional certificate issued by an institution recognized by the FSC.
3. The AML/CFT personnel and the chief AML/CFT compliance officer of a securities or futures business and the AML/CFT supervisory personnel of its domestic business units shall attend not less than 12 hours of training offered by institutions recognized by the FSC or offered by the parent financial holding company (including its subsidiaries) or the employing securities or futures business (including the parent company) every year. The training shall cover at least newly amended laws and regulations, and trends and patterns of money laundering and terrorist financing risks. If the person has obtained a domestic or international AML/CFT professional certificate issued by an institution recognized by the FSC in a year, the certificate may be used to offset the training hours for the year.
4. The AML/CFT supervisory officer and the AML/CFT officer and personnel of foreign business units of a securities or futures business shall attend not less than 12 hours of training on AML/CFT offered by foreign competent authorities or relevant institutions. If no such training is available, the personnel may attend training courses offered by institutions recognized by the FSC authority or offered by the parent financial holding company (including its subsidiaries) or the employing securities or futures business (including the parent company).
5. A securities or futures business shall arrange appropriate hours of orientation and on-the-job training of suitable contents on AML/CFT in view of the nature of its business for its legal compliance personnel, internal auditors, and associated persons to familiarize them with their AML/CFT duties and equip them with the professional knowhow to perform their duties.

Point 17
If a securities or futures business violates these Directions, the FSC may take appropriate sanctions commensurate with the seriousness of the violations in accordance with Articles 56, 65, 66, and 178 of the Securities and Exchange Act, Articles 100, 101, and 119 of the Futures Trading Act, Articles 102, 103, and 104 of the Securities Investment Trust and Consulting Act, and with the Money Laundering Prevention Act and other relevant laws and regulations.