Taiwan

Protects whistleblowers in the public sector and in state-owned or government-controlled bodies who report major illegal activity. It bans retaliation (Art. 8), shields disclosures from liability (Art. 12), protects identity (Art. 15) and provides rewards of at least 10% of penalties or sums recovered (Art. 18). Promulgated 22 January 2025, taking effect six months later (Art. 21).

Adopted by the FSC on 26 November 2024 under Art. 6(2) of the Money Laundering Control Act and effective 30 November 2024. A virtual asset service provider that has not completed AML registration may not operate (Art. 3). Art. 4 disqualifies people with listed convictions or conduct from acting as responsible person or beneficial owner. Operations must start within six months of registration (Art. 6), providers must join the Taiwan Virtual Asset Service Provider Association before operating, customer assets in custody must be segregated (Arts. 23 to 26) and service records kept for five years after the relationship ends (Art. 15).

Issued under Arts. 7, 8, 9 and 10 of the Money Laundering Control Act. Sets out customer due diligence (Art. 3), record keeping (Art. 12) and suspicious transaction reporting (Art. 15) for financial institutions. Announced 28 June 2017 and last modified 14 December 2021 according to the Banking Bureau database.

Governs electronic payment institutions and aims to ensure safe and convenient funds transfer and protect consumers (Art. 1). The FSC is the competent authority (Art. 2); business needs its approval (Art. 4), with minimum paid-in capital of NT$100 million to NT$500 million depending on the business (Art. 9) and customer funds held in trust or under a full bank guarantee (Art. 21). The Banking Bureau database shows it announced on 4 February 2015 and last modified on 19 January 2023.

Issued under Art. 45-1(3) of the Banking Act. Outsourcing needs a written agreement and board-approved internal rules (Arts. 2 and 4), is limited to listed operations unless the FSC approves others (Arts. 3 and 5), and material irregularities go to the FSC and the Central Bank (Art. 6(2)). Art. 18 requires FSC approval for overseas outsourcing of material retail financial information systems, and Art. 19 sets cloud-service controls. The Banking Bureau database shows it announced on 18 September 2006 and last modified on 13 April 2026.

Regulates the collection, processing and use of personal data. It sets out data subject rights (Art. 3), notice at collection (Art. 8), and conditions for non-government agencies (Arts. 19 and 20). Art. 12 requires an agency to notify the data subject of a breach and, in the 2025 text, to report breaches within a specified scope to the competent authority. Amendments promulgated on 11 November 2025 name the Personal Data Protection Commission as competent authority (Art. 1-1); the Executive Yuan sets their effective date.

Sets the framework for banks, with the stated aims of strengthening banking operations and protecting depositors (Art. 1). Art. 45-1 requires banks to set up internal control and audit systems under rules made by the competent authority, and Art. 129 carries the fines used in recent FSC enforcement actions. The Banking Bureau's database shows it as announced in 1931 and last modified 28 June 2023.

Promotes the use of electronic signatures and protects their security. An electronic record and signature that function like their paper equivalents cannot be denied legal effect only because they are electronic (Art. 4). The Ministry of Digital Affairs administers it (Art. 3). The database shows an amendment dated 15 May 2024.

Sets minimum working conditions and states that no employment agreement may fall below them (Art. 1). The Ministry of Labor is the competent authority at central level (Art. 4). Art. 74 lets workers report violations and bars retaliation. The database shows the latest amendment as 10 June 2020.

Aims to prevent money laundering, strengthen AML systems and improve international cooperation (Art. 1). It covers financial institutions and designated non-financial businesses, requires virtual asset and third-party payment providers to register before operating (Art. 6), and sets internal control (Art. 7), customer due diligence (Art. 8), record keeping (Arts. 8 and 10) and suspicious transaction reporting to the Investigation Bureau (Art. 13). The Ministry of Justice database shows the Act as amended and promulgated on 31 July 2024.

Prescribed under Arts. 10, 17 and 24 of the Cyber Security Management Act and dated 5 January 2026. Specific non-government agencies must report a cyber security incident within one hour of becoming aware of it (Art. 11(1)), and update the report if the incident level changes (Art. 11(2)).

States its purpose as developing the national economy and protecting investment (Art. 1) and names the Financial Supervisory Commission as the competent authority (Art. 3). Art. 36 sets the periodic reporting deadlines for public companies, and Art. 66 lets the authority warn securities firms, order removal of managers, suspend business or revoke permission; Art. 178-1 is the fining provision cited in the FSC's securities sanctions. The Securities and Futures Institute's database marks the text as amended 7 August 2024.

Regulates securities investment trust and consulting enterprises. Art. 103 lets the FSC impose warnings, orders to remove managers, suspensions of business and other measures; Art. 104 allows an order to suspend or dismiss a staff member whose conduct affects normal business; Art. 111 sets administrative fines of NT$600,000 to NT$3 million for listed violations. The database shows a release date of 28 June 2023.