Taiwan

Art. 8 bans adverse treatment such as dismissal, demotion, pay cuts and unlawful disclosure of a whistleblower's identity, and presumes retaliation once the whistleblower shows the required evidence unless the employer proves legitimate grounds. Art. 11 sets fines of NT$50,000 to NT$5,000,000 for non-civil servants who retaliate. The Act covers whistleblowers in the public sector and in state-owned or government-controlled bodies.

Art. 74 lets a worker report a violation of the Act to the employer, the competent authority or an inspection agency. The employer may not dismiss, transfer or cut the pay of the worker for doing so, and any such action is void. The authority must investigate and notify the worker in writing of the outcome within 60 days, and must keep the complainant's identity confidential.

Art. 8(2) requires customer due diligence records to be kept for at least five years after the business relationship ends or the date of the occasional transaction, and Art. 10(2) requires transaction records to be kept for at least five years after the transaction, unless other laws require longer. Art. 12 of the AML Regulations repeats the five-year period.

Art. 45-1 of the Banking Act requires banks to set up an internal control and audit system, under rules the competent authority sets on objectives, procedures, internal auditor qualifications and audit scope. The FSC has cited this article, with Art. 129, in each of its 2025 and 2026 bank penalties.

Art. 3 limits outsourcing to listed categories and requires institutions to report outsourced operations to the FSC; other operations need FSC approval under Art. 5. Art. 6(2) requires material irregularities to be reported to the FSC and the Central Bank as soon as possible. Art. 18 requires FSC approval before overseas outsourcing of material retail financial information systems, and Art. 19 sets cloud-service policies, encryption and data location rules.

Art. 13 of the Money Laundering Control Act requires institutions to report suspicious transactions, including attempted ones, to the Investigation Bureau of the Ministry of Justice. Under Art. 15(2) of the AML Regulations, the report goes in within two business days of approval by the responsible chief compliance officer, whatever the amount; Art. 15(3) asks for urgent cases to be sent as soon as possible by fax or other means, with a written follow-up.

Art. 4 of the Act Governing Electronic Payment Institutions requires FSC approval for collecting and paying as agent, accepting stored value funds and small-amount remittances, and Art. 5 bars unlicensed firms from them with limited exceptions. Art. 9 sets minimum paid-in capital of NT$500 million, falling to NT$300 million or NT$100 million for narrower businesses. Art. 21 requires stored value funds and agent-collected funds to be held in trust or under a full bank performance guarantee, and an accountant must audit compliance quarterly.

Art. 3 bars a virtual asset service provider from operating a business type until it has completed AML registration with the FSC; Art. 6 of the Money Laundering Control Act also requires registration before operating. Under Art. 6 of the Regulations, operations must start within six months of registration, extendable once by up to six months, a provider must also join the Taiwan Virtual Asset Service Provider Association before operating, and Art. 15 requires service records to be kept for five years after the relationship ends.