-
What are the regulators for fintech companies in your jurisdiction?
The primary regulator for fintech companies in Taiwan is the Financial Supervisory Commission (FSC). The FSC’s mandate encompasses the development, supervision, regulation, and inspection of the financial markets and financial services providers. In addition, it actively promotes fintech innovation and oversees the operation of the regulatory sandbox.
The FSC establishes four bureaus: the Banking Bureau, the Securities and Futures Bureau, the Insurance Bureau, and the Financial Examination Bureau. Depending on the nature and scope of their business activities, fintech companies may fall under the jurisdiction and supervision of different bureaus.
Another less prominent regulator is the Central Bank of the Republic of China (Taiwan). Its involvement is primarily focused on the development of the Central Bank Digital Currency (CBDC). The Central Bank is currently in the process of constructing a prototype platform for the digital New Taiwan Dollar.
-
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
When it comes to the financial services industry, the local regulatory environment usually places emphasis on consumer protection and fraud prevention over disruptive growth. This emphasis can lead to a wait-and-see approach when considering fintech innovations and disruptive services that can bring efficiency for consumers. While this approach is not a risk to growth per se, it does slow down disruptive fintech innovation in favor of moderation and incremental development of technological innovation in the financial services industry.
As result, local financial startups often opt to collaborate with traditional financial institutions to mitigate operational and regulatory risks. However, the infusion of traditional perspectives can also stifle innovation, making it challenging for creative solutions to emerge.
-
Are fintechs required to be licensed or registered to operate in your jurisdiction?
In Taiwan, financial service providers are generally subject to strict regulation and licensing requirements. Consequently, generally speaking, fintech companies aiming to operate in areas such as insurance, banking, asset management, securities, futures, and electronic payment services must obtain licenses from the FSC in advance, unless they obtain the regulatory sandbox approval from the FSC.
A recent major regulatory change is the implementation of a registration system for Virtual Asset Service Providers (VASPs) in November 2024. To enhance anti-money laundering (AML) supervision of VASPs, Article 6 of the Money Laundering Control Act requires VASPs and individuals providing virtual asset services must register with the FSC for AML compliance before offering their services. Non-compliance carries criminal penalties of up to two years of imprisonment.
According to the Regulations Governing Anti-Money Laundering and Countering the Financing of Terrorism for Enterprises Handling Virtual Currency Platform or Transaction (the “AML and CFT Regulations”), a VASP refers to a business that engages in the following activities on behalf of others:
- Exchange between virtual currencies and fiat currencies, such as New Taiwan Dollar, foreign currencies, and currencies issued by Mainland China, Hong Kong, or Macao.
- Exchange between one and more forms of virtual currencies.
- Transfer of virtual currencies.
- Safekeeping or administration of virtual currencies or instruments enabling control over virtual currencies.
- Participation in and provision of financial services related to an issuer’s offer or sale of virtual currencies.
-
What is a Regulatory Sandbox and how does it benefit fintech start-ups in your jurisdiction?
Under the “Financial Technology Development and Innovative Experimentation Act,” the regulatory sandbox refers to an innovative experimentation approved by the FSC. The term “Innovative Experimentation” refers to utilizing technological innovation or business model innovation to conduct financial business experimentation requiring the permission, approval, or concession of the competent authority.
The legislative purpose reveals that lawmakers aim to encourage the development of financial technology while protecting participants in innovative experiments and financial consumers. This framework allows fintech companies to test their innovative products, services, or business models under less regulatory oversight.
That said, despite the launch of the regulatory sandbox in April 2018, only 9 applications have been approved, 4 of which have been successfully implemented, and there have been zero approvals in the past two years.1
Footnote(s):
1 https://www.fsc.gov.tw/ch/home.jsp?id=665&parentpath=0,7,478
-
How do existing securities laws apply to initial coin offerings (ICOs) and other crypto assets, and what steps can companies take to ensure compliance in your jurisdiction?
The FSC’s definition of security tokens closely resembles the Howey Test, which is: (1) an investment of money, (2) investment of money is in a common enterprise or project, (3) investors have an expectation of profits, and (4) the profit primarily depends on the efforts of the issuer or third parties.2 Therefore, if ICOs and any crypto assets constitute security tokens, then it is securities governed by the Securities and Exchange Act.
Depending on the fundraising scale, those security token offering (STO) exceeding NT$30 million need to apply for financial regulatory sandbox approval for issuance and trading.
For amounts no more than NT$30 million, issuers (limited to Taiwanese-established private limited companies and cannot not be a company listed on the Taiwan Stock Exchange, Taipei Exchange Mainboard, or the Taipei Exchange Emerging Stock Board) are required to follow the rules set by the Taipei Exchange. For example, when submitting an application to the Taipei Exchange, the Taipei Exchange requires opinions from various professionals, including information technology experts, financial experts (e.g., certified public accountants), and lawyers, on the security of information technology systems, the reasonableness of the issuance price, and legal compliance of the issuance of security tokens. Furthermore, issuers can only issue and trade through trading platforms operated by licensed securities firms. Securities firms are also bound by various regulations related to their operations imposed by the Taipei Exchange and must conduct due diligence on issuers. The subscription and trading of security tokens are limited to “Professional Investors.” After the Taipei Exchange issued the relevant regulations in 2020, there were no applications for the first two years. It was not until 2023 that a Taiwanese securities firm, in collaboration with a renewable energy power retailer, issued Taiwan’s first security token offering (STO).3
Footnote(s):
2 Order No. 1080321164 issued by the Financial Supervisory Commission (FSC).
-
What are the key anti-money laundering (AML) and Know Your Customer (KYC) requirements for cryptocurrency exchanges in your jurisdiction, and how can companies implement effective compliance programs to meet these obligations?
Cryptocurrency exchanges are regulated by the AML and CFT Regulations and the Regulations Governing Anti-Money Laundering Registration of Virtual Asset Service Providers (the “Registration Regulations”), which provide key anti-money laundering (AML) and Know Your Customer (KYC) requirements for cryptocurrency for all VASP, including cryptocurrency exchanges. Additionally, VASP are required to join the Taiwan Virtual Asset Service Provider Association (the “TW VASP Association”) and comply with the Self-Regulatory Standards for AML and CFT published by the TW VASP Association on November 30, 2024. Most of the content in these self-regulatory standards aligns with the requirements of the AML and CFT Regulations.
Regarding AML compliance, the AML and CFT Regulations require VASP to establish internal control and audit systems for AML and CFT, based on money laundering and terrorism financing risks and business scale. These systems must include laying down relevant operational and control procedures, appointing management-level personnel as designated officers, establishing high-quality employee selection and hiring procedures, providing ongoing employee training, and preparing and periodically updating AML and CFT risk assessment reports to manage and mitigate these risks. Key requirements include:
- KYC Requirements: A risk-based approach should be adopted to determine the intensity of KYC measures, and ongoing customer identity verification should be conducted when establishing business relationships or at appropriate times (e.g., significant identity changes or new business relationships).
- Cash Transaction Reporting: VASP must report cash transactions equal to or exceeding NT$500,000 (including the equivalent in foreign currencies issued by Mainland China, Hong Kong, or Macao) to the Investigation Bureau of the Ministry of Justice (the “Investigation Bureau”) within five business days of the transaction.
- Sanction List Monitoring: VASP must report to the Investigation Bureau any property, assets, or interests located in Taiwan belonging to individuals, legal entities, or organizations listed on the Terrorism Financing Review Committee’s sanctions list.
- Record Keeping: VASP must maintain records of all business relationships and transactions with their customers.
- Annual Risk Assessment Reports: VASP must take appropriate actions to identify, assess, and understand their AML and terrorism financing risks, including preparing an annual risk assessment report and submitting it to the FSC.
- Pre-Launch Risk Assessments: VASP must conduct AML and CFT risk assessments before launching new products, services, or businesses and establish corresponding risk management measures to mitigate identified risks.
On November 30, 2024, the Registration Regulations came into effect. These regulations further require all VASP to complete AML Registration with the FSC before commencing operations. VASP that had already completed the AML compliance declaration under the 2021 version of the AML and CFT Regulations must file for AML Registration by March 31, 2025, and complete the registration by September 30, 2025. Failure to file or complete the registration within the specified deadlines will result in the company being prohibited from continuing its operations.
As part of the registration process, VASP must submit documentation detailing their AML and CFT internal control and audit systems. Additionally, companies must provide a checklist of internal controls reviewed by a certified public accountant and an audit opinion issued by the certified public accountant.
In essence, for VASP to legally operate virtual asset-related businesses in Taiwan, they must join the TW VASP Association and complete AML Registration with the FSC. VASP companies that meet the relevant requirements and pass the rigorous review process for AML Registration can then implement effective compliance programs to meet these obligations.
-
How do government regulations requiring licensing or regulatory oversight impact the operations of cryptocurrency and blockchain companies in your jurisdiction, and what strategies can be employed to navigate these varying requirements?
Government regulations impose licensing and regulatory oversight primarily on Virtual Asset Service Providers (VASPs) as defined under the AML and CFT Regulations and Registration Regulations. This includes compliance with AML & CFT obligations and the AML registration. For blockchain companies that do not fall within the VASP definition, the primary regulatory concerns revolve around information security and personal data protection.
Under the Registration Regulations, the newly established AML registration system introduces both benefits and challenges for VASPs. On the one hand, VASPs now face stricter legal compliance obligations, requiring enhanced internal controls, AML procedures, and regulatory reporting. These obligations lead to risen compliance costs and make it more challenging for new market entrants due to the higher barriers to entry. On the other hand, unlike the previous regime, the registration requirement ensures that only registered entities can operate legally, clarifying the legitimacy of businesses in the market.
In terms of strategies for navigate these varying requirements, VASPs should allocate sufficient resources to legal compliance and internal controls in accordance with the AML and CFT Regulations and the Registration Regulations, and consider engaging experienced accountants and legal professionals for drafting and reviewing regulatory policies and documentation. Furthermore, VASPs should join the TW VASP Association to stay informed about regulatory developments and participate in shaping self-regulatory frameworks. Active engagement with industry stakeholders can provide insights into best practices and regulatory expectations.
-
What measures should cryptocurrency companies take to comply with the governmental guidelines on tax reporting and obligations related to digital assets in your jurisdiction?
As of now, Taiwan does not have explicit laws governing the taxation of virtual currencies. However, according to a ruling by the Taxation Administration of the Ministry of Finance, the trading of security tokens issued under the Taipei Exchange’s management regulations is subject to a 0.1% securities transaction tax in accordance with Article 2, Paragraph 2 of the Securities Transaction Tax Act.4
Additionally, in 2025, a report submitted by the Ministry of Finance to the Legislative Yuan (Taiwan’s Parliament) on the “Taxation Rules for Cryptocurrency Income” proposed that virtual currency transactions should be taxed differently based on whether they exhibit securities-like characteristics.5 For companies:
Trading security tokens: The income portion is subject to the Basic Tax.
Trading non-security tokens: Any income derived is subject to the company’s corporate income tax.
According to the Business Entity Accounting Act, companies must employ accounting personnel or engage certified public accountants to handle accounting affairs, maintain proper books, and file their corporate income tax returns by May of each year.
Footnote(s):
4 Order No. 10900005070 issued by the Ministry of Finance.
5 https://ppg.ly.gov.tw/ppg/SittingAttachment/download/2024111536/02412002157210040003.pdf
-
How can blockchain companies address data privacy and protection regulations in your jurisdiction, while ensuring transparency and security on decentralized networks?
According to Article 19 of the Personal Data Protection Act of Taiwan (the “PDPA”), when a business collects, processes, or uses personal data, it must be for specific purposes and must be based on one of the lawful grounds prescribed by the PDPA. Additionally, personal data may only be used within the specified purpose, except in circumstances permitted by the PDPA.
Additionally, the PDPA grants data subjects rights, including the right to rectify personal data and the right to erase personal data, which may conflict with the immutability of blockchain technology. To address this, blockchain companies can incorporate the principles of “Privacy by Design” and “Privacy by Default” during development and consider measures such as off-chain storage, smart contract-based data deletion, or on-chain personal data protection (e.g., data encryption, privacy-enhancing protocols).
Blockchain companies can consider adopting the Taiwan Personal Information Protection and Administration System (TPIPAS) and apply for TPIPAS certification to ensure compliance with PDPA requirements. Furthermore, companies should allocate qualified data protection personnel and provide appropriate training to enhance compliance capabilities.
-
How do immigration policies, such as the U.S.’s H-1B and L-1 visas, impact the ability of fintech companies to hire international talent in your jurisdiction?
According to the Manpower Supply and Demand Information from the National Development Council, there is a potential shortage of fintech talent in the financial industry from 2023 to 2025, especially in the securities investment trust and consulting sectors, as well as the insurance sector.6
However, several factors deter foreign professionals from entering Taiwan’s financial sector:
- Stringent financial regulations;
- Relatively modest salary levels;
- Language barriers; and
- Recruiting international fintech talent is not the primary choice for most local enterprises, which continue to focus on hiring domestic professionals.
To attract high-level international talent, the Taiwan government commenced the Employment Gold Card program in 2018.
The gold card application process doesn’t operate under a quota system or immigration caps; instead, each application undergoes a case-by-case review. Functioning as a 4-in-1 card encompassing a work permit, resident visa, Alien Resident Certificate (ARC), and re-entry permit, the Gold Card is designed to attract individuals with specialized expertise.
The Gold Card offers various benefits and incentives. This card serves as an open work permit, enabling holders to change jobs freely and work for different employers under a single Gold Card. Moreover, individuals whose salary income exceeds NT$ 3 million in a particular tax year while engaged in professional work in Taiwan may enjoy certain tax benefits. Additionally, spouses and underage children of cardholders are eligible to apply for family reunion residence in Taiwan. Those employed, acting as employers, or operating their own businesses in Taiwan, along with their dependent relatives, can directly enroll in the National Health Insurance.
Footnote(s):
6 https://theme.ndc.gov.tw/manpower/cp.aspx?n=8FDEB38F0F17B561
-
What are the key regulatory and compliance requirements that a fintech must address when entering the market in your jurisdiction, and how can the company ensure adherence to all applicable laws and regulations?
Generally speaking, in Taiwan, financial institutions are highly regulated and subject to licensing requirements. The various statutes governing financial institutions, such as the Banking Act, the Securities Transaction Act, the Insurance Act, etc., grant the regulator FSC broad powers to regulate and discipline various financial institutions. Most of the time, a financial institution (for example, a bank, an asset management service provider or an insurance company) cannot operate a new business without a formal license and/or approval from the FSC.
To align with the global trend of financial innovation, fintech businesses seeking to provide licensed financial services or those with a risk of non-compliance with local laws can apply for the financial experimentation sandbox through the FSC in accordance with Financial Technology Development and Innovative Experimentation Act (the “Sandbox Act”). The application process involves submitting a comprehensive business outline to the FSC, including details on the business model, operations, associated risks, and potential impacts on consumers due to financial innovation. Upon approval of the sandbox experiment, the applicant can operate the business for a specified period. Based on the outcomes of the experimental phase, the FSC may consider modifying relevant regulations to allow the continued operation of such businesses.
-
How should a fintech approach market entry strategy in your jurisdiction, considering factors such as target customer demographics, competitive landscape, and potential partnerships with banking and other financial institutions?
Taiwan’s fintech market is relatively small and presents challenges for international companies due to obligations to comply with local regulations when providing financial services to consumers and language barriers.
Despite the launch of the regulatory fintech Sandbox program from 2018, only 9 applications have been approved, of which 4 successfully implemented, and there have been zero approvals in recent years.7
This outcome is closely tied to the traditional mindset of Taiwanese regulatory authorities, who continue to scrutinize fintech Sandbox applications with a focus on overseeing traditional financial service providers and institutions. Additionally, entities entering the Sandbox not only have to undergo a trial period but also must possess sufficient funds to await regulatory amendments. As a result, stakeholders in the fintech industry remain relatively unenthusiastic about participating in the Sandbox.
As result, financial startups often opt to collaborate with traditional financial institutions to mitigate risks. These partnerships can help reduce entry barriers, ensure compliance with local regulations, and provide a smoother pathway to market entry and sustainable growth.
Footnote(s):
7 https://www.fsc.gov.tw/ch/home.jsp?id=665&parentpath=0,7,478
-
What are the primary financial and operational risks associated with entering the market in your jurisdiction, and how can the fintech effectively mitigate these risks to ensure a smooth transition and sustainable growth?
Please see answer above.
-
Does your jurisdiction allow certain business functions to be outsourced to an offshore location?
As previously mentioned, financial institutions in Taiwan are highly regulated, and in principle, all business operations require licensing and approval. Within this framework, outsourcing services are also subject to stringent regulatory oversight. Before proceeding with service outsourcing, fintech companies must thoroughly review the nature of their services to ensure compliance with applicable laws and regulations.
For example, the Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation were established to assist banks in fulfilling their legal obligations under the Banking Act. These regulations aim to safeguard customer rights and provide clear guidance for managing risks effectively when outsourcing to third parties.
-
What strategies can fintech companies use to effectively protect their proprietary algorithms and software in your jurisdiction, and how does patent eligibility apply to fintech innovations?
To effectively protect proprietary algorithms and software in Taiwan, fintech companies can utilize a combination of intellectual property protections, including patents, copyrights and trade secrets.
- Patents: There are three types of patents in Taiwan—invention, utility model, and design patents—all of which require an application to the Taiwan Intellectual Property Office (TIPO) for approval. Algorithms and software may be protected under invention patents. “Invention” means the creation of technical ideas, utilizing the laws of nature. Furthermore, to be eligible for a patent, the algorithm or software must meet the statutory criteria of industrial applicability, novelty, and non-obviousness. Detailed examination guidelines are provided in Chapter 12 of Part II in the “Patent Examination Guidelines for Computer Software-Related Inventions” published by TIPO. If granted, patents provide exclusive rights to the creator, and infringements may result in damages, though there are no criminal penalties for patent violations. It’s important to note that Taiwan is not a member of the Patent Cooperation Treaty (PCT), so applicants cannot file PCT applications directly in Taiwan.
- Copyrights: Copyrights protect the expression of ideas rather than the ideas themselves. If the algorithms involved are purely mathematical methods, they are generally not eligible for copyright protection. However, software developed from these algorithms can still be protected, as it represents the expression of an idea. Copyright protection is granted automatically upon creation, and no registration is required. However, copyright only prevents others from reproducing the program, not from writing a program with the same functionality in a different language or format.
- Trade Secrets: Trade secrets can be used to protect algorithms and software as long as they meet the following three requirements: (i) it is not known to persons who generally deal with the information in question; (ii) it has economic value, actual or potential, due to its secretive nature; and (iii) its owner has taken reasonable measures to maintain its secrecy. Trade secrets are protected in Taiwan without registration.
-
How can a fintech company safeguard its trademarks and service marks to protect its brand identity in your jurisdiction?
To safeguard their trademarks and service marks and protect their brand identity in Taiwan, fintech startups can apply for trademark registration with the TIPO.
The registered owner of a trademark has the exclusive right to use the trademark in relation to the designated goods or services. Using a similar or identical trademark in goods or services that is similar to the designated goods or services of a registered trademark constitutes an infringement under the Trademark Act. Furthermore, knowingly using a trademark that is identical or similar to a well-known registered trademark, and hence creating a likelihood of dilution of the distinctiveness or reputation of the well-known trademark, is also deemed trademark infringement.
-
What are the legal implications of using open-source software in fintech products in your jurisdiction, and how can companies ensure compliance with open-source licensing agreements?
In Taiwan, there are no specific laws or regulations addressing the use of open-source software. However, the financial services sector is subject to strict regulatory oversight, including compliance requirements related to outsourcing, cybersecurity, and user rights. These requirements indirectly impact the use of open-source software in fintech products. Financial service providers must ensure that all aspects of their operations, including the software used to deliver services, comply with applicable regulations.
To ensure compliance with open-source licensing agreements, fintech companies can take the following steps:
- Understand Licensing Terms: Thoroughly review the open-source software licenses to understand their obligations, such as requirements for attribution, disclosure of modifications, and any restrictions on commercial use.
- Maintain an Open-Source Inventory: Establish an internal inventory of all open-source software used within the organization, tracking license types, versions, and usage.
- Adopt Compliance Policies: Develop and implement internal policies and procedures for managing the use of open-source software, ensuring that licenses are adhered to and risks are minimized.
- Review Modifications and Distributions: If the company modifies open-source software or incorporates it into its products, review whether the license requires public disclosure of modifications or source code.
- Conduct Regular Audits: Periodically audit software and compliance with licensing agreements to identify and address any potential risks early.
- Legal and Expert Consultation: Engage legal counsel or licensing experts to ensure that the company’s use of open-source software complies with both licensing terms and applicable regulations in Taiwan.
-
How can fintech startups navigate the complexities of intellectual property ownership when collaborating with third-party developers or entering into partnerships?
To navigate these complexities effectively, fintech startups may consider taking the following steps:
1. Clearly Define Ownership in Contracts:
Include specific provisions in the contract that define the ownership of intellectual property (“IP”) created during the collaboration. Clearly identify pre-existing IP owned by each party and specify how it will be used in the collaboration, including whether licenses are required and under what terms. Address the allocation of ownership for any newly developed IP, outlining how it will be assigned or shared. Additionally, include an obligation for the ownership-assigned party to complete any necessary intellectual property registrations, such as patent filings or trademark applications.
2. Due Diligence and Representations/Warranties:
Conduct thorough due diligence to confirm that all third-party developers or partners involved in the collaboration have the rights to any tools, frameworks, or code they provide. Alternatively, include representations and warranties in the contract requiring the other party to affirm that their contributions do not infringe on third-party rights and that they hold the necessary rights or licenses to use any third-party materials. Include indemnification clauses to protect against potential legal disputes arising from IP infringement claims.
3. Confidentiality and Non-Disclosure Agreements (NDAs):
Require all parties involved in the collaboration to sign a Non-Disclosure Agreement to safeguard confidential information. The NDA should include provisions prohibiting the misuse, unauthorized sharing, or disclosure of sensitive information. Clearly define what constitutes confidential information, outline the duration of confidentiality obligations, and specify any exceptions (e.g., information that becomes publicly available through no fault of the receiving party).
-
What steps should fintech companies take to prevent and address potential IP infringements, such as unauthorized use of their technology or brand by competitors?
Patents, trade secrets, copyrights, and trademarks can be utilized to safeguard fintech companies. There are three types of patents—invention, utility model, and design patents—all of which require application with the Taiwan Intellectual Property Office (“TIPO”) before being granted, provided they meet the statutory criteria. Trade secrets, on the other hand, receive legal protection as long as they meet statutory requirements (see above) and do not require registration. Similar to trade secrets, once a work is completed, copyright is protected by the Copyright Act without registration, provided it meets statutory requirements. For fintech startups wishing to protect their trademarks, they can apply for trademark registration with the TIPO.
For any incident that could potentially constitute infringement of IP such as patents, trade secrets or trademarks, fintech companies can seek remedy via the Intellectual Property and Commercial Court in Taiwan, which specializes in intellectual property and commercial disputes.
-
What are the legal obligations of fintechs regarding the transparency and fairness of AI algorithms, especially in credit scoring and lending decisions? How can companies demonstrate that their AI systems do not result in biased or discriminatory outcomes?
In June 2024, the FSC promulgated and announced the Guidelines for Artificial Intelligence (AI) Applications in the Financial Industry, which is generally directed at financial services companies licensed and/or regulated by the FSC such as financial holding companies, banks, electronic payment companies, insurance agency companies, etc. The Guidelines is not legally binding but is intended as a policy directive intended for financial services companies to self-regulate.
Many fintech companies may not fall the scope of financial services companies to which the Guidelines is specifically directed. For the financial services companies that do fall under the scope for which the Guidelines is intended, the Guidelines does stipulate that such financial services companies should design, train and deploy AI models in manners that will ensure fairness and transparency (e.g. the lending terms are not unreasonable), explainability, and that such AI decision shall be subject to human oversight, auditing and supervision.
Please note that when facing consumers, fintech companies generally need to comply with the Consumer Protection Act, which stipulates in Article 12 that any standard terms and conditions used with consumers that are in violation of the principle of good faith and are patently unfair to consumers (e.g. in violation of the principle of equality and reciprocity) shall be null and void. Therefore, if a fintech company offer services that, based on its terms of services, is decided by AI and the AI model produces results that are not in good faith and patently unfair, it could theoretically be argued under the Consumer Protection Act that such terms of service shall be considered as null and void.
-
What are the IP considerations for fintech companies developing proprietary AI models? How can they protect their AI technologies and data sets from infringement, and what are the implications of using third-party AI tools?
At the present time, there is no formal legislation in Taiwan on whether the training of AI models using third-party materials such as images or other works constitutes IP infringement. Currently, the Taiwan Intellectual Property Office (TIPO) has expressed the view that if the AI tool (which may be provided by a third party) is able to generate a likeness to an existing copyrighted work for commercial use, then such generation can be an infringement of existing copyright unless the IP owner’s consent or license is obtained beforehand.
-
What specific financial regulations must fintechs adhere to when deploying AI solutions, and how can they ensure their AI applications comply with existing financial laws and regulations? Are there specific frameworks or guidelines provided by financial regulatory bodies regarding AI?
As mentioned above, the FSC promulgated and announced the Guidelines for Artificial Intelligence (AI) Applications in the Financial Industry in June 2024. Please note that the Guidelines is non-binding and actually many fintech companies that do not require a license from the FSC may fall outside of the scope of financial services companies to which the Guidelines is specifically directed.
The Guidelines do provide for a framework for the responsible use of AI in financial institutions, drawing from international regulations and best practices. An outline of the Guidelines is as follows:
- Definition of AI and generative AI
- Describes the AI system lifecycle: planning & design, data collection, model development, deployment & monitoring.
- Discusses risk assessment factors, including customer impact, use of personal data, decision-making autonomy, complexity, and mitigation strategies.
- Establishes supervision of third-party AI providers.
- Governance & Accountability
- Financial institutions should establish clear governance structures, designate responsible executives, and ensure internal oversight of AI usage.
- AI risk management should be integrated into existing risk controls.
- Staff training on AI governance is recommended.
- Fairness & Human-Centered AI
- AI systems should be designed to prevent discrimination and bias.
- Human oversight mechanisms should be in place (human-in-command, human-in-the-loop, etc.).
- Financial institutions must offer remedies for unfair AI decisions.
- Privacy & Consumer Protection
- Emphasizes data minimization and security when handling customer data.
- AI-driven financial services must inform customers and provide alternative options when possible.
- System Security & Stability
- Ensures AI models are robust, reliable, and secure from cyber threats.
- Financial institutions should conduct stress testing and adversarial testing to identify vulnerabilities.
- Transparency & Explainability
- AI decisions should be interpretable for both internal and external stakeholders.
- Financial institutions should disclose AI usage to customers and regulators while balancing trade secrets and security concerns.
- Sustainable Development
- Encourages responsible AI usage to reduce environmental impact and promote financial inclusion.
- Financial institutions should support employee adaptation to AI-driven transformations.
The Guidelines generally serves as a non-binding directive to encourage regulated financial institutions to responsibly implement AI while managing risks effectively.
- Definition of AI and generative AI
-
What risk management strategies should fintech companies adopt to mitigate potential legal liabilities associated with AI technologies?
As mentioned above, if the AI tool is able to generate a likeness to an existing copyrighted work for commercial use, then such generation can be an infringement of existing copyright unless the IP owner’s consent or license is obtained beforehand. Furthermore, fintech companies should be mindful of whether the AI technology is developed or used in a manner that is not in good faith and obviously unfair to the consumers. Under Taiwan’s Consumer Protection Act, if the user service terms of a fintech companies requires consumers to accept an AI-generated result that is not in good faith and obviously unfair, it can be argued under Article 12 of the Consumer Protection Act that user terms should be considered as null and void, thereby exposing the fintech service provider to legal uncertainties.
-
Are there any strong examples of disruption through fintech in your jurisdiction?
Taiwan is generally a conservative jurisdiction when it comes to financial services and the financial regulator prefers to observe what is being done in other jurisdictions before permitting financial services that could impact consumer rights and interests. Therefore, it may indeed be hard to specify any particular areas of disruptive fintech innovations. Currently, there is a flux of electronic payments services in the last couple of years in Taiwan, which does bode well for fintech developments that can eventually lead to changes in societal habits of cash payments and promote the use of cashless payments.
-
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B, etc.)?
According to investment data compiled by the FINDIT research team at the Taiwan Institute of Economic Research, most of the significant fintech investments made during late 2023 to early 2024 are in the blockchain and corporate services sectors. Most of those investments, as identified and compiled by the FINDIT research team, are in the Pre-A or Series A stages.8
Footnote(s):
Taiwan: Fintech
This country-specific Q&A provides an overview of Fintech laws and regulations applicable in Taiwan.
-
What are the regulators for fintech companies in your jurisdiction?
-
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
-
Are fintechs required to be licensed or registered to operate in your jurisdiction?
-
What is a Regulatory Sandbox and how does it benefit fintech start-ups in your jurisdiction?
-
How do existing securities laws apply to initial coin offerings (ICOs) and other crypto assets, and what steps can companies take to ensure compliance in your jurisdiction?
-
What are the key anti-money laundering (AML) and Know Your Customer (KYC) requirements for cryptocurrency exchanges in your jurisdiction, and how can companies implement effective compliance programs to meet these obligations?
-
How do government regulations requiring licensing or regulatory oversight impact the operations of cryptocurrency and blockchain companies in your jurisdiction, and what strategies can be employed to navigate these varying requirements?
-
What measures should cryptocurrency companies take to comply with the governmental guidelines on tax reporting and obligations related to digital assets in your jurisdiction?
-
How can blockchain companies address data privacy and protection regulations in your jurisdiction, while ensuring transparency and security on decentralized networks?
-
How do immigration policies, such as the U.S.’s H-1B and L-1 visas, impact the ability of fintech companies to hire international talent in your jurisdiction?
-
What are the key regulatory and compliance requirements that a fintech must address when entering the market in your jurisdiction, and how can the company ensure adherence to all applicable laws and regulations?
-
How should a fintech approach market entry strategy in your jurisdiction, considering factors such as target customer demographics, competitive landscape, and potential partnerships with banking and other financial institutions?
-
What are the primary financial and operational risks associated with entering the market in your jurisdiction, and how can the fintech effectively mitigate these risks to ensure a smooth transition and sustainable growth?
-
Does your jurisdiction allow certain business functions to be outsourced to an offshore location?
-
What strategies can fintech companies use to effectively protect their proprietary algorithms and software in your jurisdiction, and how does patent eligibility apply to fintech innovations?
-
How can a fintech company safeguard its trademarks and service marks to protect its brand identity in your jurisdiction?
-
What are the legal implications of using open-source software in fintech products in your jurisdiction, and how can companies ensure compliance with open-source licensing agreements?
-
How can fintech startups navigate the complexities of intellectual property ownership when collaborating with third-party developers or entering into partnerships?
-
What steps should fintech companies take to prevent and address potential IP infringements, such as unauthorized use of their technology or brand by competitors?
-
What are the legal obligations of fintechs regarding the transparency and fairness of AI algorithms, especially in credit scoring and lending decisions? How can companies demonstrate that their AI systems do not result in biased or discriminatory outcomes?
-
What are the IP considerations for fintech companies developing proprietary AI models? How can they protect their AI technologies and data sets from infringement, and what are the implications of using third-party AI tools?
-
What specific financial regulations must fintechs adhere to when deploying AI solutions, and how can they ensure their AI applications comply with existing financial laws and regulations? Are there specific frameworks or guidelines provided by financial regulatory bodies regarding AI?
-
What risk management strategies should fintech companies adopt to mitigate potential legal liabilities associated with AI technologies?
-
Are there any strong examples of disruption through fintech in your jurisdiction?
-
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B, etc.)?