Risk Management and Internal Control
Risk Management System
Operations of Risk Management Committee
Taishin FHC has the Risk Management Committee to follow the "Taishin FHC Organization Rules of Risk Management Committee " and the committee members are appointed by the board of directors. The number of members shall not be less than three, and more than half of the members shall be independent
director. The committee shall meet at least twice a year, and is responsible for reviewing risk management policies and reviewing regularly integrated risk management reports and TCFD. The average attendance rate of Risk Management Committee is 100% in 2024.
Day-to-day risk management is spearheaded by the Chief Risk Officer (CRO) and executed through the CRO Office. The CRO Office communicates with corresponding units of the 3 lines of defense to enforce risk management within the organization.
Risk Management Policy and Measures
Taishin has risk management policy in place to control primary risks associated with business operations. The policy also takes into account climate change risk and emerging risk etc.
The Company achieves its overall risk reward and operating strategy through risk management procedures, asset-liability allocation, and capital adequacy management for itself and its subsidiaries. Taking Taishin Bank as an example, the results of mandatory and voluntary stress tests are incorporated into the capital adequacy ratio plan, and stress tests are performed regularly every quarter for the overall and individual operating environment risks and specific scenarios that may be faced in the future. The tests are reported to the board of directors, and the annual stress test results are submitted to the competent authority. At the same time, the stress test results are incorporated into the considerations of operational strategy planning, and profitability and capital utilization efficiency are continuously improved through asset-liability allocation adjustments to further strengthen the overall financial structure and capital adequacy ratio.
Framework of the Risk Management
The Company operates a wide variety of business. The risk management process starts with the identification of risks related to the Company. Once they are confirmed, the risks are measured to find out the degree of each risk exposure, and then the relevant units will develop and discuss mitigation measures and management procedures. Afterwards, the risks undergo management and reporting. The actual management of each risk is summarized in reports to enhance risk management performance and allocate capital adequately to individual business units. The Group's required ratios for authorized capital are used as the basis to effectively manage the business development of Taishin FHC and subsidiaries while also taking into account risk management. Taking the major subsidiary banks as an example, the proportion of accrued capital calculated based on the risk-weighted assets (RWA) is used to compare and rank the materiality of the degree of exposure to different types of risks as well as the probability of occurrence. The main risk categories are, in order, credit risk (accounting for 90.8%) and operational risk (accounting for 5.6%). The risks encountered and risk management frameworks by business for Taishin FHC and subsidiaries are explained below. For details of the risk management methods and quantified data on risk exposure, please see Chapter VII, Section 7.6 of the 2024 Taishin FHC annual report for more details.
Internal Audit
Taishin has an internal audit system in place and an Audit Division that reports directly to the Board of Directors in regard to its audit practices. Apart from the Chief Auditor, the Audit Division also has 8 full-time audit personnel who are responsible for audit of the Company and its subsidiaries business and operational practices, supervising and management of subsidiary audits, supervising internal control self-audits, evaluating internal audit practices of subsidiaries, coordination of financial examination, tracking, management and reporting of identified defects, and consultation from other units. The audits on the Company and subsidiaries in 2024 showed that there were no discrepancies or irregularities with material impact in the systems of the Company and subsidiaries. The audit opinions proposed and the improvement measures formulated by the inspected units were included as items to be tracked in routine audits to follow up on the improvements of the audited units.
Management of Emerging Risks
Taishin FHC implements procedures specifically to identify, manage and respond to emerging risks, and prepares assessment worksheets based on documents published by local and foreign institutions. All subsidiaries are required to assess emerging risks associated with their business activities to assess the possible impacts and devise response measures, which are consolidated by Taishin Holdings to facilitate ongoing monitoring on the effectiveness of risk control and mitigation measures
-
1.Identification
Taishin FHC has designed assessment worksheets based on documents published by local and foreign institutions
-
2.Assessment
Subsidiaries are required to assess impacts of emerging risks and devise response measures based on the state of their business activities.
-
3.Integration
Based on subsidiaries' assessments, Taishin reports impacts and mitigation measures
-
4.Observation
Impacts and mitigation measures of identified risks are monitored on an ongoing basis.
-
[New Financial Frauds -Counterfeiting and AI-assisted Frauds] - Technologic
In the Risks Report 2025 published by the World Economic Forum (WEF), fake news generated by AI has topped the list of the "biggest risk facing the world in the next two years" for two consecutive years. The number of financial crimes has increasing rapidly due to the widespread use of generative AI. According to statistics from the Criminal Investigation Bureau, there were a total of 122,805 fraud cases in 2024, a significant increase from 37,823 cases last year. Among which, fake investment fraud was the most serious, with 43,015 cases and financial losses of NT$37.22 billion. Due to the widespread use of AI, risk of traditional financial fraud continues to rise as a result of the complex fraudulent techniques and increased difficulty of identifying them.
-
- Through generative AI, Deepfake voice and image technology, scammers forge the identities of financial institution employees or customers to commit crimes such as online banking frauds, investment frauds and fraudulent loans. Such frauds may not only cause financial losses to
customers, but also affect banks' reputation and customer trust. - AI-generated fake news and erroneous financial information may also exert a serious impact on market stability and investor confidence, and in turn affect Taishin's own business activities.
- Through generative AI, Deepfake voice and image technology, scammers forge the identities of financial institution employees or customers to commit crimes such as online banking frauds, investment frauds and fraudulent loans. Such frauds may not only cause financial losses to
-
- Enhancing information security monitoring and fraud prevention mechanisms: We will establish a security operation center (SOC) to enhance real-time monitoring and response capabilities in order to swiftly identify and block potential risks. At the same time, the risks of fake identities and fraudulent transactions may be reduced by strengthening identity recognition technology, such as multi-factor authentication and enhancement in KYC and audit mechanisms.
- Payment security and fraud prevention: Taishin Bank leverages AI technology to analyze suspicious transaction patterns and abnormal behaviors, and has developed the "Taishin War God Model" to identify the latest fraud patterns. The model can instantly identify suspected fraudulent transactions and issue warnings. Once suspicious behavior is detected, it will immediately block fraudulent transactions. Taishin Bank cooperates with the public sector to share fraud intelligence and improve overall fraud prevention capabilities. In addition, it actively promotes consumer education and raise awareness of payment security and credit card risks to reduce the occurrence of frauds.
- Establishing a warning and abnormal transaction handling mechanism: The Company will strengthen identity authentication and transaction review of abnormal accounts involving suspected fraud crimes, take control measures such as freezing and suspending transactions, and notify the judicial police authorities as and when necessary. Transaction records for relevant operations should be retained, and regulations governing AML and CFT should be implemented. Abnormal account information should be shared with peers to enhance financial security.
-
[Turmoil in Global Economic Markets] - Economic
According to the "Economic Situation and Outlook in 2025" published by the National Development Council, Taiwan's economic growth rate in 2025 could reach more than 3%. However, international political and economic uncertainties, geopolitical risks, China's economic downturn and climate change may have made the outlook for the global economy and markets uncertain.
Since returning to the White House, U.S. President Trump has introduced a number of tariff measures and may impose additional tariffs on more imported goods. Countries affected by tariffs may take countermeasures. Trade barriers between global economies will rise, resulting in an increase in the risk of a global economic downturn.
-
- High tariffs will directly lead to higher costs of imported goods, reduced consumer purchasing power and lower corporate competitiveness, which may result in weaker overall demand and affect economic stability.
- The risks posed by ongoing regional conflicts to international trade may increase uncertainty in shipping costs of customers.
- Regional conflicts will create barriers to international trade (such as the U.S.-China trade war and the U.S. tariff increase), affect the uncertainty of capital flows and restrict transactions in specific products, thereby increasing credit or non-credit risks.
-
- Continuously strengthening risk monitoring and early warning mechanisms: We will continue to monitor tariff developments and their impact on various markets, and adjust response measures as and when appropriate.
- Adopting diversified trading portfolio and dynamic asset allocation to diversify risks: We will adjust trading portfolio according to market changes, diversify market volatility risks, and avoid over-reliance on a single type of asset or market. We will utilize financial instruments to hedge related market volatility risks and ensure the stability of the asset portfolio.
- Reducing leverage and strengthening liquidity management: In an event of increased market uncertainty, we will reduce leverage appropriately to ensure sufficient liquidity in trading operations to cope with extreme market conditions.
-
[Information Security - Introduction of AI and Cloud Services] - Technologic
Artificial intelligence (AI) and cloud services can improve business operational efficiency, but also pose challenges to information security. AI may affect information security and decision-making accuracy due to training data bias and hacker attacks. Cloud services, on the other hand, involve risks such as insufficient data access control, supplier security vulnerabilities, and DDoS attacks, which may lead to the leakage of confidential information or system paralysis. Hackers can attack software suppliers and implant malicious programs in the bank's core systems or payment platforms, causing large-scale information security incidents.
-
- The introduction of AI and new fintech products is expected to reduce costs and improve productivity, but it may also increase the risk of theft of customer information or assets. The risk of confidential information of Taishin FHC or its subsidiaries and relevant customer information becoming the target of cyber crime may also increase.
- Third-party software and cloud services expose the company to the risk of software supply chain attacks. Hackers can attack software suppliers and implant malicious programs in the bank's core systems or payment platforms, causing large-scale information security incidents. If critical business systems are affected, this may lead to business interruption, leakage of customer information and even regulatory penalties.
-
- Enhancing information security protection and monitoring: The Company has established a comprehensive information security management framework and introduced a data loss protection (DLP) system to strictly control the access and transmission of sensitive information to prevent the risk of data leakage. The information security protection mechanism covers technologies such as firewalls, email auditing and web security gateways, and is adjusted and optimized based on the latest information security environment.
- Information security education and cross-departmental collaboration: The Company has joined the Forum of Incident Response and Security Teams (FIRST) to proactively collaborate with outstanding teams in response to changing and complex cyber threats. It has also actively participated in domestic and international information security joint defense organizations to jointly respond to borderless cyber threats, thereby enhancing the overall resilience of the global information security protection network.
- Cloud resources and artificial intelligence (AI) governance: The Company has strengthened the information security assessment of cloud services, identified potential risks, and regularly reviewed the security of cloud resources to ensure the stability and compliance of data storage and transmission. With respect to AI technology application, the Company has introduced AI guidelines promulgated by the competent authorities, formulated policies on the use of AI to ensure data privacy and fairness, established AI governance regulations and control measures, and built a trustworthy and responsible AI system to ensure compliance with ethical and regulatory standards.
Establishment of Measures for Creating a Corporate Risk Sensitivity Culture
A culture of risk awareness is an important foundation for Taishin's sustainable development. In addition to introducing the Loss Event Database (LED), Key Risk Indicators (KRIs), Risk and Control Self-Assessment (RCSA), and regular reporting to senior management and the Board of Directors, we continue to expand risk education and training to embed the culture of risk awareness in our operations and increase the risk awareness of all employees.
Taishin understands the importance of risk management. To create an effective risk management system, we link risk management performance with remuneration, and use a balanced scorecards (BSC) and key performance indicators (KPI) to make operational risk related indicators part of performance evaluation. In addition, performance evaluation for Level 1 managers and above covers at least 4 risk related items, including anti-money laundering, operational risk losses, compliance, and internal and external audits. Regarding the workplace conduct evaluation for all employees, risk management performance indicators are included through the item "compliance and support for company policies", and the item "enforcement of a risk culture in everyday business" is also added. These two items account for more than 15% of the workplace conduct evaluation. This regular performance evaluation process creates a link between risk management and employee remuneration.
Taishin encourages employees to put forward ideas and proposals for improvement anytime through the innovation and reform platform. Division heads lead their teams to participate in the business process management (BPM) program every year. Activities include combining the company's strategic development and process reform strategies, inspecting end-to-end processes in transactions between customers and the bank, identifying opportunities for optimization and risk control points in businesses and processes, and preventing and monitoring risks. These activities effectively reduce the chance of incurring risks and make companies pay more attention to the risk culture, which translates to a higher number of proposals. A total of 1,196 risk proposals were made in 2024, up by 30.9% compared to the previous year. A process improvement proposal competition is held every year. In particular, the Best Risk Proposals selects outstanding proposals from all submissions (including creative reform and BPM proposals) in the current year. The competition encourages employees to take the initiative to implement risk control points in processes and make constructive suggestions regarding operational risk, credit risk, friendly banking, and net zero related topics in order to develop better risk management and enhance the risk culture and awareness.
Best risk management proposals in recent years
-
2022
-
NT$1.36 million
-
Use AI and big data to identify credit card customers, and add a NCCC ACS system module verification process. No password verification is required for low risk network transactions, providing customers with a faster purchase experience.
-
2023
-
NT$1.38 million
-
Having the systems automatically generate irregularity reports in order to increase audit efficiency and enable early identification of fraud and corruption committed by financial advisors. Aimed to prevent failure to identify irregularity when a financial advisor shares one mobile device with a customer.
-
2024
-
NT$1.03 million
-
Automatically issue life insurance payment slips through the system, effectively reducing the rate of erroneous issuance, enhancing the printing and management of blank forms, significantly improving operational efficiency, eliminating the collection of policyholders' checks by salespersons, effectively controlling the risk of check loss, improving service quality, and strengthening the prevention of salespersons from misappropriating premiums.
Legal Compliance
Performance evaluation System
Taishin FHC and its subsidiaries conduct “Internal Compliance Self-assessment” semiannually to evaluate the effective of compliance. Legal Compliance Division reviews these self-assessments of the units and reports to the President for rating reference. This practice helps enforce a compliance culture. In addition, the assessment of the management and the supervisors of each unit now also include the compliance unit’s assessment opinions on the degree of compliance of their units.
Compliance Training
Taishin incorporates the basic concepts of compliance into its training courses for new employees, and provides education and training to new employees through online courses or physical lectures. Key items include personal data protection, Ethical Corporate Management Best Practice Principles, whistleblowing system, money laundering prevention, and key introductions and practices of financial-related laws and regulations.