電子支付機構身分確認機制及交易限額管理辦法

These Regulations are adopted pursuant to Article 16, Paragraph 3 of Article 25, Paragraph 3 of Article 26, and Article 42 which apply mutatis mutandis to Article 16, Paragraph 3 of Article 25, and Paragraph 3 of Article 26 of the Act Governing Electronic Payment Institutions (referred to as the “Act” hereunder).

The identity verification mechanism and transaction amount limits for users of electronic payment institutions and contracted institutions shall be governed in accordance with these Regulations. Matters not prescribed in these Regulations shall be governed by the Regulations Governing Anti-Money Laundering of Financial Institutions and other related regulations.

1The terms used in these Regulations are defined as follows:

21. "Individual users" shall mean natural-person users including natural persons from other countries or regions (including Mainland Area).

32. "Non-individual users" shall mean government agencies, legal persons, business entities, and other organizations in the ROC as well as government agencies, legal persons, business entities, and other organizations from other countries or regions (including Mainland Area).

43. "Individual contracted institutions" shall mean natural persons who signed contracted institution contracts with an electronic payment institution, including natural persons from other countries or regions (including Mainland Area).

54. "Non-individual contracted institutions" shall mean government agencies, legal persons, business entities, and other organizations in the ROC as well as government agencies, legal persons, business entities, and other organizations of other countries or regions (including Mainland Area) who signed contracted institution contracts with an electronic payment institution.

When an electronic payment institution accepts users to register, open an electronic payment account, or register their stored value cards, it shall learn the identity of users, record such identity information, and confirm the veracity of users according to these Regulations; the preceding provision applies when users change their identity information.

1When an electronic payment institution accepts users to register, open an electronic payment account, or register their stored value cards, it shall check with the Joint Credit Information Center (JCIC) for the following information and keep relevant records for future reference:

21. Information on deposit account with suspicious or unusual transactions.

32. Data and information circulated by electronic payment institutions pursuant to Article 28 and Article 35 of the Rules Governing the Administration of Electronic Payment Business.

43. Notation data where the users’ requests to enhance identity verification.

54. Other data as required by the competent authority.

6Electronic payment institutions shall use the data obtained from JCIC prudentially, according to the preceding paragraph; and they shall decide whether to approve or reject user's registration application based on objectivity and autonomy.

1An electronic payment institution shall reject users to register, open electronic payment accounts, or register their stored value cards if the users have any of the situations specified in Article 4 of the Regulations Governing Anti-Money Laundering of Financial Institutions.

2An electronic payment institution shall reject the user’s application for registration, or application for registering their stored value cards if the users have any of the following situations:

31. The deposit account or electronic payment account has been reported as a watch-listed account and the account status has not been removed.

42. The applicant applies for registration frequently over a short period of time without reasonable explanation.

53. The transaction functions applied for are obviously inconsistent with the applicant's age or background.

64. Data obtained from inquiry with JCIC according to Paragraph 1 of the preceding article show irregularity.

75. The same mobile phone number provided for identity verification has been used repeatedly in identity verification without reasonable explanation.

8

1The types and transaction functions of e-payment accounts opened by users with an electronic payment institution are as follows:

21. Type 1 and Type 2 e-payment account: An e-payment account for individual users and non-individual users that offers the functions of collecting, paying funds, and accepting deposit of funds as stored value funds.

32. Type 3 e-payment account: An e-payment account for individual users that only offers the functions of paying funds under collecting and making payments for real transactions, deposit funds and receiving small-amount domestic and international remittances from a lineal relative or guardian’s electronic payment account in the same institution.

When accepting individual users to register, open electronic payment accounts, or register their stored value cards, an electronic payment institution shall ask the users to provide basic identity information, including at least name, nationality, type and number of identification document and date of birth. It shall also retain the photocopy or image files of the identity certification or keep important information as the records.

1When an electronic payment institution accepts individual users to register and open a Type 1 e-payment account, its identity verification process shall comply with the following provisions:

21. Verifying the mobile phone number provided by the user: Verify that the user can use the said mobile phone number to operate and receive messages and notifications.

32. Verifying the veracity of the user’s identity information. The verification method shall comply with any one of the criteria set forth below:

4(1) When a national ID card is provided, the institution shall check the user's ID card issuance records, name, and data with JCIC to verify data veracity;

5(2) When a resident certificate, vertical household registration certificate, or other identity document issued by a government agency is provided, the institution must check such documents with the Ministry of the Interior or the issuers of the said documents, the name and data with JCIC, or use other appropriate methods to verify the user's name.

63. Confirming the financial payment instrument used by the user.

74. Verifying the user identity via over-the-counter review, a certificate that complies with the Electronic Signature Act, or video teller machine.

1When an electronic payment institution accepts individual users to register and open a Type 2 e-payment account, its identity verification process shall comply with the provisions in Subparagraphs 1 to 3, Paragraph 1 of the preceding article.

2The provisions in Paragraphs 2 and 3 of the preceding article shall apply mutatis mutandis to conditions specified in the preceding paragraph.

When an electronic payment institution accepts individual users to register and open a Type 3 e-payment account, its identity verification process shall comply with the provisions in Subparagraphs 1 and 2, Paragraph 1 of Article 9.

When accepting a non-individual user to register an e-payment account, an electronic payment institution shall ask the user to provide basic identity information, including at least the name of the entity, country of registration, registration paper, license, or type and number of approval document for establishment, contact information, as well as representative's name, nationality, type and number of identification document, mailing address, and telephone number.

1When an electronic payment institution accepts a non-individual user to register and open a Type 1 e-payment account, its identity verification process shall comply with the following provisions:

21. Confirming a payment instrument used by the user.

32. Requesting the photocopy or image file of the user's license or certificate, or approval for establishment, and its representative's identification certification. Taiwanese government agencies, public schools, state-owned enterprises, or utility companies and foundations, of which their representatives are appointed by the government according to the law, may be exempted from these requirements.

43. Verifying the user’s identity presented by the user’s representative or its authorized agent via over-the-counter review, a certificate complied with the Electronic Signatures Act, or video teller machine.

5The provisions in Paragraphs 3 of Article 9 shall apply mutatis mutandis to conditions specified in Subparagraph 1 of the preceding paragraph.

6With respect to the image file of the registration license or certificate, or approval for establishment provided from onshore non-individual users in accordance with Subparagraph 2 of Paragraph 1 hereof, the electronic payment institution shall check the registration records with the Ministry of Economic Affairs, Ministry of Finance, or the competent authorities in charge of user's main line of business.

7

1When an electronic payment institution accepts non-individual user to register and open a Type 2 e-payment account, its identity verification process shall comply with the provisions in Subparagraphs 1 and 2, Paragraph 1 of the preceding article.

2The provisions in Paragraph 3 of Article 9 and Paragraph 3 of the preceding article shall apply mutatis mutandis to conditions specified in the preceding paragraph.

1When an electronic payment institution accepts users to register stored value cards, the identity verification process for individual users shall comply with the provisions in Subparagraphs 1 and 2, Paragraph 1 of Article 9; the identity verification process for non-individual users shall comply with the provisions in Subparagraphs 2 and 3, Paragraph 1 of Article 13.

2An electronic payment institution must request the user’s contact phone number when it implement the process prescribed in the preceding paragraph.

3An electronic payment institution issues a stored value card to its user, which is annexed to the user’s electronic payment account, the registration for the such stored value card annexed to the electronic payment account shall be deemed as completed.

1An electronic payment institution is deemed to have carried out the required identity verification process for a user, provided that the outsourced service provider has performed the identity verification of the users by following a procedure not less than the requirements set out in Articles 9 to 11 and Articles 13 to 15 hereof.

2If an electronic payment institution engage an outsourced service provider to perform the identity verification process, the regulations set forth in Article 7 of the Regulations Governing Anti-Money Laundering of Financial Institutions shall apply to the institution.

3Where an outsourced service provider cannot implement the measures specified in the preceding paragraph, the electronic payment institution shall terminate its outsourced services.

An electronic payment institution shall, based on the results of differentiated identity verification performed according to these Regulations, set up users risk categorization standards, rate the risk levels of users accordingly, carry out scheduled or unscheduled monitoring, inspections, and risk control.

1When an electronic payment institution signs a contract with a contracted institution, the identity verification process shall comply with the following provisions:

21. Type 1 individual contracted institutions: Articles 4 to 6, 8, 9, and 16 apply mutatis mutandis to Type 1 individual contracted institutions.

32. Type 1 non-individual contracted institutions: Articles 4 to 6, 12, 13, and 16 apply mutatis mutandis to Type 1 non-individual contracted institutions.

43. Type 2 individual contracted institutions: Articles 4 to 6, 8, 10, and 16 apply mutatis mutandis to Type 2 individual contracted institutions.

54. Type 2 non-individual contracted institutions: Articles 4 to 6, 12, 14, and 16 apply mutatis mutandis to Type 2 non-individual contracted institutions.

1When an electronic payment institution signs a contracted institution contract with a contracted institution, it shall request the contracted institution to provide advertisements, photographs of the business premises, or other information that can verify the existence of real transactions for its supply of product or services.

2An electronic payment institution must sign a “contracted institution contract” with a user before it may provide the user with services as being a payee in the process of collecting and making payments for real transactions as an agent service, but this does not apply to those that meet the conditions prescribed in the regulations in Subparagraph 4, Article 6 of the Act, or Article 7 of the Rules Governing the Administration of Electronic Payment Business.

1The transaction amount limits on users’ e-payment accounts opened in electronic payment institutions are as follows:

21. Type 1 e-payment account:

3(1) Cumulative amount of collection and payment of real transaction per month shall be agreed between the electronic payment institution and the user.

4(2) The balance of stored value funds deposited shall be limited to not more than an equivalent of NT$100,000.

5(3) Each small-amount domestic and international remittance shall be limited to not more than NT$100,000 or its equivalent. The cumulative collection and payment amount for small-amount domestic and international remittances of individual users shall be respectively limited to not more than NT$1,000,000 or its equivalent; the cumulative collection and payment amount for small-amount domestic and international remittances of non-individual users shall be respectively limited to not more than NT$10,000,000 or its equivalent.

62. Type 2 e-payment account:

7(1) Cumulative payment received and made per month shall be respectively limited to not more than an equivalent of NT$300,000.

8

1When an electronic payment institution provides contracted institutions with services for collecting and making payments for real transactions as an agent, the maximum transaction amounts are as follows:

21. Type 1 contracted institutions: The collection amount for cumulative payment collection received and made for real transactions per month shall be agreed between the electronic payment institution and the contracted institution.

32. Type 2 contracted institutions: The collection amount for cumulative payment collection received and made for real transactions per month shall be limited to not more than an equivalent of NT$300,000. An electronic payment institution may take its risk tolerance or contracted institutions' actual need into account to see if it shall raise the collection amount for the cumulative payment collection received and made for real transactions per month. However, the collection amount for the cumulative payment collection received and made for real transactions per month shall not exceed NT$500,000 or its equivalent, and the collection amount for the cumulative payment collection received and made for real transactions per year shall not exceed NT$3,600,000 or its equivalent.

When a user opens more than one e-payment account with an electronic payment institution, the amount of payment received and made per account shall not exceed the limit on that type of account, whereas the total limits on those accounts combined shall not exceed the limit set for the highest category of e-payment accounts registered and opened by the same user.

An electronic payment institution shall retain the data obtained in users and contracted institutions identity verification process and relevant records on carrying out the users and contracted institutions identity verification; the preceding provision applies when users and contracted institutions change their identity information.

1An electronic payment institution shall retain the following necessary transaction records of users:

21. For the business of collecting and making payments for real transactions as an agent: records retained on the types, account numbers or card numbers of payors’ payment instruments, amount, types of the payment currency and time of making payment, e-payment account numbers or stored value card numbers of payors and recipients, information for the identification of the contracted institutions, transaction services fees and related transaction results; in the cases of refunds, records retained on methods, amount, types of currency, time of making refund, and types, account numbers or card numbers of payment instruments used for making refund payment and the related transaction results.

32. For the business of accepting deposits of funds as stored value funds: Records retained on deposit methods, e-payment account numbers or stored value card numbers receiving the deposit, amount, types of currency and time of making deposit, transaction services fees and related transaction results.

43. For the business of small-amount domestic and international remittances: Records retained on the users’ e-payment account numbers, amount, types of currency and time of making remittances, transaction services fees and related transaction results.

54. For withdrawal of funds from e-payment account: Records retained on the e-payment account number from which the fund is withdrawn, the account number of the user’s same-currency financial institution deposit account which the fund is transferred into, amount, types of currency and time of making withdrawal, transaction services fees and related transaction results.

Regarding the user and contracted institution identity verification process and transaction amount limits, if an electronic payment institution does not meet the requirements of the provisions in Chapter 2 and Chapter 3 hereof, the institution shall make adjustments to become compliant within one year after these Regulations enter into force on July 1, 2021.

These Regulations shall enter into force on July 1, 2021.