Press Release
FSC announces the primary examination findings and corrective actions for financial institutions in the first half of 2026
2026-09-29
To maintain the transparency of financial examination procedures, the Financial Supervisory Commission (FSC) has announced its primary examination findings for the first half of 2026, pursuant to the "Principles for Effective Financial Examination". The announcement comprises findings selected from various industry sectors that involve significant systemic issues or common deficiencies. These findings are categorized by business activity, accompanied by recommended corrective actions.
The FSC stated that the primary examination findings identified in the first half of 2026 cover 10 industry sectors including financial holding companies. The main concerned issues include “Fraud Prevention and Anti-Money Laundering (AML/CFT/CPF),” “Customer Protection,” “Internal Management,” and “Cyber Security.” The primary examination findings and corrective actions for relevant business activities are as follows:
1. Fraud Prevention and AML/CFT/CPF
(1) Primary Findings
A. For customers whose status was changed from a preparatory office to a formally established company, the required customer due diligence (CDD) procedures were not properly implemented. As a result, financial institutions failed to identify that the company exhibited multiple characteristics of accounts opened by shell companies as published by the National Police Agency. Shortly after the accounts were opened, the accounts were subsequently reported through the 165 Joint Anti-Fraud Defense Mechanism.
B. For customers exhibiting abnormal account activity indicators, including frequent reports of watch-listed accounts following applications for virtual account services and significant increases in collection transaction volumes, enhanced review procedures were not duly performed, and customer identities were not adequately verified before service provision.
C. Upon receiving notifications from police authorities regarding watch-listed electronic payment accounts, failed to promptly report the relevant information to the Joint Credit Information Center (JCIC).
D. Failed to retain supporting documentation evidencing proper verification of the agency relationship where remittance transactions were frequently conducted by third parties on behalf of such customers.
E. Failed to ascertain the authenticity of business dealings with corporate customers that had triggered multiple alerts for suspected money laundering transactions and exhibited payment and receipt patterns inconsistent with normal business operations.
(2) Corrective Actions
The FSC stated that, to prevent and stop fraud crimes through the inappropriate use of financial services, financial institutions should conduct proper reviews when processing account-opening applications and reject applications suspected of involving dummy account holders or shell businesses. For customers applying for virtual account services, financial institutions should implement ongoing transaction monitoring. Upon receiving notifications of watch-listed electronic payment accounts, they should immediately notify the JCIC, enabling other financial institutions to promptly obtain information on such accounts. For transactions frequently conducted by agents on behalf of customers, financial institutions should properly verify the agency relationship. They should also assess the reasonableness of transactions based on customers’ identities, income, or business scale. Through multiple measures, including account-opening reviews, transaction monitoring, and subsequent reporting of watch-listed accounts, financial institutions should strengthen their efforts to prevent fraud and money laundering.
2. Customer Protection
(1) Primary Findings
A. Failed to establish effective monitoring mechanisms to identify instances where customers' mailing addresses are identical to those of wealth management specialists, solicitation channels, or solicitors.
B. In conducting mortgage lending business, failed to adequately inform customers that they were free to decide whether to purchase mortgage life insurance, resulting in customers mistakenly believing that purchasing such insurance was a prerequisite for loan approval, or induced customers to purchase mortgage life insurance by offering the prospect of obtaining lower interest rates.
C. In conducting fund advertising and marketing activities, failed to disclose relevant information or required warnings in accordance with applicable regulations, or failed to prepare a simplified prospectus and disclose the relevant information as required.
D. Accepted orders from non-professional investors to purchase Total Loss-Absorbing Capacity (TLAC) bonds, or recommended the purchase or sale of specific securities to customers who had not entered into a recommendation agreement.
(2) Corrective Actions
To prevent wealth management specialists or solicitors from misappropriating customer funds, financial institutions should establish mechanisms to cross-check the contact information of customers against that of wealth management specialists or solicitors. In conducting mortgage lending business, financial institutions should neither engage in tying arrangements involving mortgage life insurance products nor improperly induce customers to purchase such products. When selling funds, financial institutions should disclose required warnings and relevant information in advertisements, present a balanced description of potential returns and risks, prepare simplified prospectuses as required, and ensure adequate disclosure of information to financial consumers. In conducting brokerage trading for foreign securities, financial institutions should explain the potential risks to customers, enter into recommendation agreements with customers, and recommend suitable financial products in accordance with applicable requirements.
3.Internal Management
(1) Primary Findings
A. In establishing records of related parties, there were instances where directors failed to make the required declarations, resulting in the relevant information not being recorded.
B. In conducting transactions other than credit extensions, there were instances where financial institutions failed to verify, prior to the transaction, whether the counterparty was a related party and to retain supporting documentation.
C. In conducting reviews to ensure that the terms of credit extended to related parties were no more favorable than those offered to other comparable borrowers, failed to compare such terms with those of borrowers granted credit within the most recent one-year period, as required.
(2) Corrective Actions
The FSC reminds financial institutions to properly report and maintain records of related-party information. Before extending credit or conducting transactions, financial institutions should first determine whether the counterparty is a related party and retain records of such inquiries. When extending credit to related parties, financial institutions should duly compare the credit terms with those offered to other comparable borrowers in accordance with applicable requirements.
4. Cyber Security
(1) Primary Findings
A. There were deficiencies in the design of website security headers, or public-facing websites used insecure third-party libraries without assessing their appropriateness or implementing remediation or enhancement measures.
B. For hosts running various operating systems, security hardening standards had not been established and periodically reviewed; privileged accounts with the highest level of access had not been retrieved and brought under proper control; and mechanisms for prior approval and periodic ex post reviews had not been established. In conducting reviews of account access privileges, certain hosts were not included within the scope of review.
C. Failed to establish a complete asset inventory and a centralized management mechanism for logs and audit trails of various operating systems and network devices, set appropriate alert indicators, and periodically review and revise them.
D. Reviews of mobile application (APP) permissions were not properly conducted; basic information security testing was incomplete; mechanisms for verifying the authenticity of the source and integrity of APP software upon delivery had not been established; APP parameter settings allowed data to be transmitted in plaintext over the network; security control software embedded by vendors had not undergone scanning or black-box testing; or medium-high risk vulnerabilities had not been remediated.
(2) Corrective Actions
The FSC emphasizes that financial institutions should review the security design mechanisms of their public-facing websites, strengthen the design of website security headers, and properly conduct security assessments of third-party libraries in use and implement necessary remediation and enhancement measures. Financial institutions should also establish system security hardening standards, place accounts with the highest level of privileges under proper control, and properly conduct reviews of account access privileges. Asset inventories, as well as operating system logs and audit trails, should be complete. Financial institutions should properly conduct APP security testing and permission reviews, establish mechanisms for verifying software upon delivery, and review APP parameter settings. Before updated versions of APPs are released, they should undergo information security testing and vulnerability remediation.
The FSC stated that it expects, through the regular announcement of primary examination findings and corrective actions, to help institutions stay abreast of supervisory priorities, proactively identify areas for improvement, reassess operational procedures, and establish appropriate control mechanisms, thereby promoting effective self-correction and ultimately contributing to the sound operation of financial institutions and the development of the financial market.
Please direct any questions or comments to: FSC MAIL
The FSC stated that the primary examination findings identified in the first half of 2026 cover 10 industry sectors including financial holding companies. The main concerned issues include “Fraud Prevention and Anti-Money Laundering (AML/CFT/CPF),” “Customer Protection,” “Internal Management,” and “Cyber Security.” The primary examination findings and corrective actions for relevant business activities are as follows:
1. Fraud Prevention and AML/CFT/CPF
(1) Primary Findings
A. For customers whose status was changed from a preparatory office to a formally established company, the required customer due diligence (CDD) procedures were not properly implemented. As a result, financial institutions failed to identify that the company exhibited multiple characteristics of accounts opened by shell companies as published by the National Police Agency. Shortly after the accounts were opened, the accounts were subsequently reported through the 165 Joint Anti-Fraud Defense Mechanism.
B. For customers exhibiting abnormal account activity indicators, including frequent reports of watch-listed accounts following applications for virtual account services and significant increases in collection transaction volumes, enhanced review procedures were not duly performed, and customer identities were not adequately verified before service provision.
C. Upon receiving notifications from police authorities regarding watch-listed electronic payment accounts, failed to promptly report the relevant information to the Joint Credit Information Center (JCIC).
D. Failed to retain supporting documentation evidencing proper verification of the agency relationship where remittance transactions were frequently conducted by third parties on behalf of such customers.
E. Failed to ascertain the authenticity of business dealings with corporate customers that had triggered multiple alerts for suspected money laundering transactions and exhibited payment and receipt patterns inconsistent with normal business operations.
(2) Corrective Actions
The FSC stated that, to prevent and stop fraud crimes through the inappropriate use of financial services, financial institutions should conduct proper reviews when processing account-opening applications and reject applications suspected of involving dummy account holders or shell businesses. For customers applying for virtual account services, financial institutions should implement ongoing transaction monitoring. Upon receiving notifications of watch-listed electronic payment accounts, they should immediately notify the JCIC, enabling other financial institutions to promptly obtain information on such accounts. For transactions frequently conducted by agents on behalf of customers, financial institutions should properly verify the agency relationship. They should also assess the reasonableness of transactions based on customers’ identities, income, or business scale. Through multiple measures, including account-opening reviews, transaction monitoring, and subsequent reporting of watch-listed accounts, financial institutions should strengthen their efforts to prevent fraud and money laundering.
2. Customer Protection
(1) Primary Findings
A. Failed to establish effective monitoring mechanisms to identify instances where customers' mailing addresses are identical to those of wealth management specialists, solicitation channels, or solicitors.
B. In conducting mortgage lending business, failed to adequately inform customers that they were free to decide whether to purchase mortgage life insurance, resulting in customers mistakenly believing that purchasing such insurance was a prerequisite for loan approval, or induced customers to purchase mortgage life insurance by offering the prospect of obtaining lower interest rates.
C. In conducting fund advertising and marketing activities, failed to disclose relevant information or required warnings in accordance with applicable regulations, or failed to prepare a simplified prospectus and disclose the relevant information as required.
D. Accepted orders from non-professional investors to purchase Total Loss-Absorbing Capacity (TLAC) bonds, or recommended the purchase or sale of specific securities to customers who had not entered into a recommendation agreement.
(2) Corrective Actions
To prevent wealth management specialists or solicitors from misappropriating customer funds, financial institutions should establish mechanisms to cross-check the contact information of customers against that of wealth management specialists or solicitors. In conducting mortgage lending business, financial institutions should neither engage in tying arrangements involving mortgage life insurance products nor improperly induce customers to purchase such products. When selling funds, financial institutions should disclose required warnings and relevant information in advertisements, present a balanced description of potential returns and risks, prepare simplified prospectuses as required, and ensure adequate disclosure of information to financial consumers. In conducting brokerage trading for foreign securities, financial institutions should explain the potential risks to customers, enter into recommendation agreements with customers, and recommend suitable financial products in accordance with applicable requirements.
3.Internal Management
(1) Primary Findings
A. In establishing records of related parties, there were instances where directors failed to make the required declarations, resulting in the relevant information not being recorded.
B. In conducting transactions other than credit extensions, there were instances where financial institutions failed to verify, prior to the transaction, whether the counterparty was a related party and to retain supporting documentation.
C. In conducting reviews to ensure that the terms of credit extended to related parties were no more favorable than those offered to other comparable borrowers, failed to compare such terms with those of borrowers granted credit within the most recent one-year period, as required.
(2) Corrective Actions
The FSC reminds financial institutions to properly report and maintain records of related-party information. Before extending credit or conducting transactions, financial institutions should first determine whether the counterparty is a related party and retain records of such inquiries. When extending credit to related parties, financial institutions should duly compare the credit terms with those offered to other comparable borrowers in accordance with applicable requirements.
4. Cyber Security
(1) Primary Findings
A. There were deficiencies in the design of website security headers, or public-facing websites used insecure third-party libraries without assessing their appropriateness or implementing remediation or enhancement measures.
B. For hosts running various operating systems, security hardening standards had not been established and periodically reviewed; privileged accounts with the highest level of access had not been retrieved and brought under proper control; and mechanisms for prior approval and periodic ex post reviews had not been established. In conducting reviews of account access privileges, certain hosts were not included within the scope of review.
C. Failed to establish a complete asset inventory and a centralized management mechanism for logs and audit trails of various operating systems and network devices, set appropriate alert indicators, and periodically review and revise them.
D. Reviews of mobile application (APP) permissions were not properly conducted; basic information security testing was incomplete; mechanisms for verifying the authenticity of the source and integrity of APP software upon delivery had not been established; APP parameter settings allowed data to be transmitted in plaintext over the network; security control software embedded by vendors had not undergone scanning or black-box testing; or medium-high risk vulnerabilities had not been remediated.
(2) Corrective Actions
The FSC emphasizes that financial institutions should review the security design mechanisms of their public-facing websites, strengthen the design of website security headers, and properly conduct security assessments of third-party libraries in use and implement necessary remediation and enhancement measures. Financial institutions should also establish system security hardening standards, place accounts with the highest level of privileges under proper control, and properly conduct reviews of account access privileges. Asset inventories, as well as operating system logs and audit trails, should be complete. Financial institutions should properly conduct APP security testing and permission reviews, establish mechanisms for verifying software upon delivery, and review APP parameter settings. Before updated versions of APPs are released, they should undergo information security testing and vulnerability remediation.
The FSC stated that it expects, through the regular announcement of primary examination findings and corrective actions, to help institutions stay abreast of supervisory priorities, proactively identify areas for improvement, reassess operational procedures, and establish appropriate control mechanisms, thereby promoting effective self-correction and ultimately contributing to the sound operation of financial institutions and the development of the financial market.
Please direct any questions or comments to: FSC MAIL
- Visitor： 386
- Update： 2026-09-29
