Financial Crime World

Here is the converted article in markdown format:

Design Requirements for Electronic Payment Institutions

=====================================================

The Financial Supervisory Commission of Taiwan outlines the design requirements for electronic payment institutions to operate payment services via agreed linked deposit accounts.

  • The electronic payment institution applies directly to the financial institution holding the account for a financial certificate and enters an agreement with it.
  • The electronic payment institution applies to the dedicated deposited account bank for a financial certificate, which is then authenticated by both parties.

Agreed Linkage Procedure

  1. User Application: Users apply for account linkage through their banks or directly through the electronic payment institution.
  2. Financial Institution Verification: Financial institutions verify user identities and limit transaction amounts based on risk assessment methods.

Transaction Procedure

  • The electronic payment institution gives a payment deduction instruction to the financial institution holding the account, which disburses funds after authenticating the agreed-upon certificate and checking relevant data.

Security Requirements

Private Key Protection

  • Private keys for certificates must be stored in a hardware security module with at least EAL 4+ or FIPS 140-2 Level 3 security strength to prevent unauthorized access.

Access Control

  • Electronic payment institutions should restrict access to private keys and programs related to agreed linked deposit account operations by unauthorized personnel or programs.

Notification Mechanism

  • Financial institutions must notify users instantly after making fund transfers through the electronic payment institution.

Risk Control

  • Dedicated deposited account banks or financial institutions holding accounts must establish reasonable transaction flow control mechanisms.

Termination of Agreed Linkage

Users can terminate agreed linkage by applying to their banks or directly to the electronic payment institution, and the financial institution holding the account will notify the user instantly.