Compliance

Anti-money Laundering

In order to tighten requirements concerning anti-money laundering and counter-terrorism financing, internal control, and compliance in banks, the SCSB has established a group anti-money laundering policy and the relevant procedure. A dedicated Anti-Money Laundering and Counter-Terrorism Financing Center has been established under the Compliance Department with a responsible officer, and an inter-departmental Anti-Money Laundering and Counter-Terrorism Financing Committee has also been established. Supervisory officers for anti-money laundering and counter-terrorism financing have been appointed to all of our business units to build a top-down hierarchical management system. The external independent verification unit has been authorized every year to conduct the Anti-Money Laundering and Counter-Terrorism Financing Program Review.

The SCSB performs three lines of defense for anti-money laundering and counter-terrorism financing. For the first line, the business unit conducts customer and trade reviews and self-evaluation. (The business exclusive to the business unit is conducted by the business unit.) For the second line, the Anti-Money Laundering and Counter-Terrorism Financing Center (dedicated unit) and all business management departments carry out supervision. In addition to operation planning for anti-money laundering and counter-terrorism financing, the Center and all of these business departments execute activity spot checks and assessments for business units. (The KPI item for the business unit and its compliance manager includes tasks for anti-money laundering and counter-terrorism financing.) For the third line, the internal audit unit and an external independent unit conduct third-party verification at least once a year.

The head of the Anti-Money Laundering and Counter-Terrorism Financing Center and managers of all branches discuss on anti-money laundering and counter-terrorism financing issues at quarterly compliance meeting. If any business unit has any concerns about the implementation of anti-money laundering and counter-terrorism financing, it may report its concern to the Anti-Money Laundering and Counter-Terrorism Financing Center via internal consulting form. Through the establishment of an internal counseling system, the SCSB can reinforce the effectiveness of three lines of defense and communication between lines of defense.

In addition, to enhance effectiveness and efficiency of anti-money laundering and counter-terrorism financing education training, the SCSB gradually reinforces application of RegTech. The SCSB uses these technologies for customer due diligence (CDD), regular review, transaction monitoring, and characterization threshold calibration to increase efficiency and reduce labor burden. For example:

• The SCSB develops and utilizes Robotic Process Automation (RPA) to collect shareholding structure of the legal entity customers with complex ownership structure from the government website automatically and calculate the final number of shares of natural person systematically. The technology is used to find the ultimate beneficial owner.
• The SCSB participates in the development of a project for optimization of the CTP system of Taiwan Depository & Clearing Corporation. The multiple layer shareholding information is added to enhance the utilization of domestic shareholding information via the real-time/batch download function of Application Programming Interface (API). This effectively assists in identification of beneficial ownership in the complex shareholding structure for anti-money laundering.

Anti-money Laundering and Counter-terrorism Financing Education Training

In order to continue to help employees learn more about anti-money laundering and counter-terrorism financing, the SCSB held 62 seminars with a total of 220 hours for anti-money laundering and counter-terrorism financing in 2024. To build a culture that emphasizes anti-money laundering and counter-terrorism financing, the SCSB offers subsidies to help staff become the CAMS international anti-money laundering specialists or take the exams organized by domestic institutions recognized by the Financial Supervisory Commission for Anti-Money Laundering and Counter-Terrorism Financing Specialists. Via E-LEARNING and morning meetings, education training for anti-money laundering and counter-terrorism financing is provided by sharing ideas on a topic. A total of 19 sessions were held during morning meetings in 2024. (A total of 148 sessions were held from May 2017 to December 2024.) All staff were required to attend the seminars.

In addition, the SCSB actively encourages employees to acquire professional licenses for anti-money laundering and counter-terrorism financing and pass the relevant exam. The number of staff with professional licenses for anti-money laundering and counter-terrorism financing and qualifications for passing certain exams in 2024:

Donation to the SCSB Associated with Political/Policy Impact

Ethical Management

Zero tolerance policy is adopted for violation against internal work rules such as relevant regulations, Code of Ethical Conduct and Ethical Corporate Management Best-Practice Principles. The violation will be reported to the Personnel Review Board for discussion if it was true. The handling record will be kept. Warning and admonishment will be made, and a demerit will be recorded, depending on severity. In 2024, the SCSB received a total of 4 reported cases where 1 qualified reported case was handled with care. In addition, after reviewing the ethical management confirmation statement signed by different units, no violation against ethical management occurred.

Furthermore, in 2024, the following information is disclosed regarding incidents that were not discovered through whistleblowing: The SCSB was not involved in any cases associated with conflicts of interest, corruption and bribery, customer privacy information leaks, discrimination and harassment, money laundering and insider trading, anti-competitive practices, antitrust and monopoly behavior, or any relevant legal disputes and penalties regarding market manipulation.

Ethical Management Training and Communication

At SCSB, ethical management is the foundation of stable governance. To make sure that employees understand anti-corruption regulations, besides internal messages, unit managers and announcements to all employees, anti-corruption is also promoted at morning meetings and via the precautions in the Ethical Corporate Management Best-Practice Principles. The promotion covers all employees. As for the Board of Directors, anti-corruption is communicated via corporate governance forum. The anti-corruption trainings are designed for employees based on their job grades and business types (in which visual disabilities are accommodated with oral training sessions instead). The following is the information related to such courses organized in 2024.

Note: Data is calculated by the end of December 2024 and in accordance with all active SCSB staff

Procedures Tailored to Whistleblowing

Note：The accepted whistleblowing report refers to the whistleblowing report that shall be accepted according to the “Procedure for handling Whistleblowing.”

Whistleblowing Processing Method and Channel

Whistleblowing mailbox: compliance@scsb.com.tw
Whistleblowing helpline: (02)6618-9952
Postal address: No. 2, Sec. 1, Minquan E. Rd., Zhongshan Dist., Taipei City. The recipient information should be stated as the Chief Compliance Officer
Details for the SCSB’s announcement: https://www.scsb.com.tw/content/about/about21.jsp

Risk Management

In the SCSB’s risk management organizational structure, the Board of Directors is the highest decision-making unit. It must take at least six hours of risk courses a year to learn about risk management issues including anti-money laundering, anti-corruption and information security. The Risk Management Committee established under the Board of Directors is responsible for bank-wide risk management. The Risk Management Department established under the President, and our Deputy Executive Vice President Chen Chia-Hung supervises the Risk department and is responsible for building a bank-wide risk management mechanism and independently performing its duties for bank-wide risk management. Every responsible unit shall appoint risk managers based on its size, significance and complexity to conduct risk management for the unit. In addition, the Loan Review Committee and Investment Review Committee established under the President are responsible for loan risk management and investment risk management respectively.

Furthermore, for the purpose of incorporating the risk management metrics into financial incentives, the SCSB has set up specific risk management metrics for senior management personnel and general employees respectively to enrich the risk management culture within employees’ daily operations.

Three Lines of Defense for Risk Control

Risk Management KPIs Set-up

The SCSB asks managers and employees of the Risk Management Department to set up specific KPIs and job objectives that critically incorporate the risk management metrics into financial incentives. In 2024, the KPIs of the Deputy Executive Vice President of the Risk Management department can be seen in the table below.

Risk Appetite

Risk appetite represents the level and types of risks that the SCSB is willing to accept in the process of achieving its strategic objectives and business plans. Building upon this, the SCSB establishes risk management and quantitative procedures as well as sets both qualitative statements and quantitative limits. The risk appetite and various limits are determined annually based on factors including annual operational targets, statutory capital adequacy ratio requirements for the SCSB and its subsidiaries, financial budgets, business planning, and historical credit utilization rates. These are then submitted to the Risk Management Committee and the Board of Directors for further discussion.

Furthermore, the SCSB reasonably allocates various limits by considering the business portfolios, business scale, and capital scale of each subsidiary to ensure their risk-bearing capacity. The monitoring results are incorporated into risk management execution reports and submitted to the Risk Management Committee and the Board of Directors for quarterly reporting.

Risk Assessment of New Products and Services

Before launching new products or services, the review team will conduct a thorough risk assessment and internal inspections to ensure the optimization of risk management and internal control. Apart from identifying the market risk, the credit risk, the operational risk, the liquidity risk, the compliance risk, the climate risk, emerging risks, and other potential factors that might affect business operations, the review team also looks into various aspects including product traits, business strategies, internal control, and customer right protection. Furthermore, prior to launching trust products, it’s pivotal to assess their legitimacy, cost efficienscy, risk-return traits, preferred target customers, consistency with the SCSB’s risk management criteria, and market demand. In 2024, 562 cases of both domestic and overseas risk assessments were closed.

Rating Risks by Scale

The SCSB incorporates magnitude and likelihood as two important factors into mapping out different risks by scale, where reactive actions and mitigating processes are then developed to cope with risks that could exert prominent impacts on the SCSB. This way, the SCSB is able to reinforce its risk management capability and strengthen the operational resilience consequently.

Note1: Risk Items/ Evaluating Items represent sequences based on risk rating

Note 2: Magnitude represents level differences between Big and Mild with numeric value ranging from 1 to 16

Note 3: Likelihood represents level difference between Big and Mild with numeric value ranging from 1 to 16

Information Security

Due to the popularity of digital finance, topics such as personal data protection and information security have received contentious attention within the financial industry in recent years. By acknowledging the importance of information security, the SCSB has acquired the certificate of the ISO 27001: 2022 Information security, cybersecurity and privacy protection- Information security management systems (ISMS), set up information security goals, and built up a cross-department information security committee to arrange quarterly meetings and carefully inspect and manage the information security policies, risk assessment, incidents investigation, reports, corrective actions, and regulations..

Structure and Function of Information Security

Information Security Management Committee

Through the cross-department Information Security Committee, discussion and supervision have been conducted for material business, internal information security policy, and important information security issues regularly. The SCSB planned for the practice of information security control measures throughout the entire bank. SCSB’s Risk Management Committee is in charge of supervising information security matters. In addition, Director Chiu Yi-Jen used to serve as the CIO of the SCSB and Director Huang Hui-Chu used to serve as General Manager of Taiwan IBM, reflecting board members with background and knowledge in the information security field. Likewise, the SCSB’s Senior Executive Vice President Lu Shao-Yu also happens to serve the CISO role in 2024, who is mainly in charge of promoting information security policies and rearranging available resources.

Drill for information security in 2024

3 times of information security drills were held in 2024 (including the social engineering drill and DDoS attack drill) to help all employees become more familiar with real-time actions taken in response to any form of information security incident.

Reinforcement of information security control of IoT

The SCSB explicitly specified the “Regulations Governing Information Security Incidents” and “Establishment Regulations for Information Security Incident Response Team” to define the reporting process and response guidelines for information security incidents. The SCSB is able to resume operation quickly and effectively according to systematic processing procedures and take required improvement measures. When an information security incident occurred, the manager of the Information Service Department, managers of all sections and the manager of the Information Security Department formed the Information Business Emergency Response Team. This team is responsible for taking emergency response measures and activating the continuous operation plan of relevant businesses. Meanwhile, this team helps the Head Office prepare for the press release and explain it to the public. The SCSB received 1 customer data breach in 2023. However, there were no significant cybersecurity incidents in 2024. In the same year, only one general personal data breach occurred. In response, immediate measures were taken to mitigate damage to the affected parties. Additionally, improvements and preventive measures have been implemented to reduce the likelihood of similar incidents occurring in the future. For more detailed information, please refer to Chapter 1.7.

The reporting procedures for information security incidents

Improve the Customer Service

Customer Satisfaction Survey

Throughout its century-long history, the SCSB has embedded a service-oriented mindset into every aspect of its operations. For example, all new employees are required to complete at least five hours of etiquette training. The SCSB has also developed the “5 Heart to Heart Rules Manual in the Business Hall  ”, which outlines key service principles across five key customer touchpoints: welcoming, waiting, counter service, transaction, and walking the customer out. Since the launch of service quality evaluations in 2005, the SCSB has consistently demonstrated steady improvement in performance, thanks to the collective efforts of all staff members.

Reporting level of incidents on all levels

We follow the “Standards Governing the Security of Personal Data Files for the Designated Non-government Agency” established by the Financial Supervisory Commission to establish relative internal regulations for the personal file security maintenance. To prevent personal information from being accessed inappropriately, control measures have been established for the regulations and systems of related operations. These will effectively secure personal information, protect the customer’s right to personal information security, and maintain information security and privacy.

The SCSB has paid great attention to the security of personal data protection and adhered to the “Implementation Rules of Internal Audit and Internal Control System of Financial Holding Companies and Banking Industries” since 2017. A certified public accountant (CPA) conducts on-site audits of the design and implementation of the SCSB's personal data management system, and the relevant results are submitted annually to the FSC for review and approval.

There were no significant personal data breaches in 2024, while only one general personal data breach occurred in the same year, accounting for 100% of exposed personal information and affecting a total of 10 customers. In response, immediate measures were taken to mitigate damage to the affected parties. Additionally, improvements and preventive measures have been implemented to reduce the likelihood of similar incidents occurring in the future.

Customer Rights Notification

To respect the rights of customers to exercise their personal information, the SCSB formulates the “Personal Data Management Policy” to inform customers of the purpose of use of personal information, the type of personal information, the duration, area, target and method of use, the rights and methods in line with the Personal Data Protection Act. Similarly, the subject may exercise his rights in accordance with Article 3 of the Personal Data Protection Act and freely choose to provide his or her personal data when failing to provide impact harnessing the interests of subjects.

The SCSB’s website also clearly states “Notification for the Contents of the Obligation to Inform the Practice” based on Article 8, Paragraph 1 of the “Personal Data Protection Act” with the following key points:

- The type of personal data and information collected

- The purpose and use of personal data collected

- Protection for the type of personal data collected

- Our retention period of collected personal data based on regulations and the purpose of business

- The subject and situation of use of personal data by the third-party

The SCSB fully informs customers of their rights to give prior consent to rights to opt-in and opt-out, request access to data held by the SCSB, and request data correction, deletion, removal of personal data (including transferring personal data to other data service providers), termination of processing and utilizing data accordingly.

Customer Rights Notification

In addition, in order to enhance customers’ understanding of the SCSB’s personal data protection measures, the SCSB has set up a Personal Data Protection Q&A section on its webpage which enables customers to quickly acknowledge the SCSB’s personal data protection mechanism via simple and easy dialogues. As for putting customers’ personal data into secondary usage, which refers to initiating telemarketing on customers with a collaborative relationship in accordance with the Personal Data Protection Act and other regulations, the amount of calls accounts for 14.8% of the total number of the SCSB’s natural and legal persons. Moreover, internal regulations have been established to cater above activities and further comply with the following principles:

• Seek customers’ prior written consent or authorization
• Evaluate customers’ ability to maintain the confidentiality of customer data critically before establishing a sound partnership
• Transfer encrypted end-to-end customer data with collaborative partners, and only authorized persons could utilize data for business purposes
• Conduct both regular and spontaneous audits on collaborative partners to examine operations in compliance with legitimacy

The SCSB’s digital development is driven by the vision of offering clients the best digital experience. Focusing on clients’ needs and by applying data analysis, the SCSB strives to provide essential and convenient financial services to its clients. Additionally, it serves as a valuable partner in customer acquisition and retention for the SCSB’s business units and branches. In addition, the SCSB has long been a corporate laboratory member of FinTechSpace and has maintained good interaction with startup companies in the space. Through regular corporate events organized by the space, exchanges between startups and relevant departments of the SCSB can be arranged to explore collaboration opportunities. In 2024, the active mobile banking users for promotion of digital financial services resulted in a 4.9% increase, an 8% increase in active mobile banking users, and a 24.9% growth in digital account openings.

The SCSB has allocated budgets for system development, new feature implementation, and FinTech-related collaboration projects. In conjunction with the centralized application, management and advancement of artificial intelligence (AI) technologies across the bank, SCSB continues to drive the enhancement, innovation, and development of various digital financial services.

Looking ahead to 2025, the SCSB will continue to expand its digital service landscape by actively exploring the adoption of new FinTech technologies and partnerships with startups to develop innovative business models and deliver richer, smarter interactive experiences. The Main Initiatives Include:

• The Main Initiatives Include:
  • Personalized new online banking system
    In order to improve the usage and satisfaction of online banking services, the SCSB launched a new personalized online banking system construction project in August 2022. The project applies a new network technology, and provides new personalized online banking services with an interface that meets individual customer needs. Development test has been completed for the service function in the first step in Q4 2024. The new online bank will be fully launched before Q3 2025. Personalized new online banking system
  • Corporate Online Banking App
    Transaction functions "Multiple payment(TWD) " and "Salary payment(TWD)" were added in April 2024 to functions were launched to enhance the efficiency of payments for goods and salaries. The service scope is expected to expand in Q2 2025 to include transfer and remittance, foreign exchange, financing, import services, fixed deposits, and fund investments in both NTD and foreign currencies. A multilingual interface has also been introduced, currently supporting Traditional Chinese, Simplified Chinese, and English, with a Japanese version to be added. These enhancements aim to support customers in improving fund management efficiency, facilitating cross-border operations, and delivering a more user-friendly experience.

    
  • Corporate Online Banking Reconstruction
    Our corporate online banking system has been operating stably for years. Along with the increase in digital transformation needs, SCSB will initiate the corporate online banking system reconstruction project in Q2 2026 to satisfy customer needs for a smart office. The project will focus on increasing system flexibility and extensibility, help corporations optimize fund allocation through technical innovation, reduce transaction risk and increase operating efficiency. It aims to become the first choice for corporate fund management.
  • LINE Official Account Text Customer Service
    The text customer service for corporate customers is scheduled to launch in the first quarter of 2025 via the official LINE account. Powered by SmartRobot, this service will offer intelligent and convenient support by presenting frequently asked questions in visualized formats, such as infographics, step-by-step guides, and instructional videos, guiding corporate clients to complete tasks efficiently. For more complex issues, live text-based agents will be available to assist clients directly. By integrating robotic automation with human support, the system facilitates collaborative problem-solving for corporate clients using the SCSB’s eWB platform and Taiwan Pay merchant services, enhancing the overall satisfaction with digital experiences.

    
  • Digital Currency Applications
    The SCSB took part in the first phase (wholesale) and second phase (universal) retail payment pilot plans of CBDC. For B-end (business) and C-end (consumer), the SCSB designed an application scenario for receipt and payment and cross-border remittance to save time for transactions. As arranged by competent authorities, the SCSB was engaged in the SWIFT CBDC Sandbox Plan. The SCSB works with global institutions participating in this plan, facilitates digital currency exchange among platforms, and builds an international payment ecology. The SCSB will continue to adapt to the plans of competent authorities, pay attention to international development trends, and explore cross-border payment and the application in financial innovation.
  • Restructuring of the Digital Banking Department
    In response to the quick development of AI and the integration of the utilization, management, and development of AI technology application among the entire bank, the operation of customer experience and data governance and application under the Head Office Strategic Planning Department has been incorporated into the Digital Banking Department in January 2025.
  • CloudBank Digital Brand
    The SCSB conducted a revision of Cloud Bank, a digital brand website and an existing channel in 2023. Core functions were organized, and information was integrated. The new website was launched in 2024. The young user experience and brand exposure are enhanced via themed activities and gaming interface elements. There are 92 thousand visits and 22% return rate by the end of December 2024, setting a foundation for promoting a new digital business model.