These Rules are adopted pursuant to Article 33 of the Act Governing Electronic Payment Institutions (referred to as the "Act" hereunder).

The term "professional training institution" used in these Rules shall mean a training institution recognized as such in accordance with the Guidelines for Reviewing Training Institutions for Financial Holding Companies and Banking Enterprises.

A specialized electronic payment institution shall establish internal control system and ensure the on-going and effective implementation of the system to promote sound operation of its business.
A specialized electronic payment institution shall formulate overall business strategy, risk management policies and guidelines, and draft business plans, risk management procedures, and execution guidelines.

The primary purpose of a specialized electronic payment institution's internal controls are to promote sound business operations and, through joint compliance by its board of directors, management, and all employees, to reasonably ensure that the following objectives are achieved:
1. Effectiveness and efficiency of operations;
2. Reliability, timeliness, transparency and compliance of reporting; and
3. Compliance with applicable laws and regulations.
The objective of effectiveness and efficiency of operations referred to in Subparagraph 1 of the preceding paragraph includes objectives such as profits, performance, and safeguarding asset security.
The "reporting" referred to in Subparagraph 2 of Paragraph 1 includes internal and external financial reporting and non-financial reporting on the specialized electronic payment institution, where the objectives of financial reporting for external purpose include ensuring that it is prepared in accordance with the generally accepted accounting principles (GAAP), and that transactions are made with proper approval.

The internal control system of a specialized electronic payment institution shall be passed by its board of directors. If any director expresses dissent or reservation, those opinions and reasons therefor shall be recorded in the meeting minutes of the board of directors, which, together with the internal control system passed by the board, shall be submitted to the supervisors or the audit committee. The preceding provision applies to revisions of the internal control system.

The board of directors of the specialized electronic payment institution must be aware of the operational risks that the company faces, supervise its performance of operations, and bear the ultimate responsibility for ensuring its internal control system to be established and maintained appropriately and effectively.