台新金控

Natural disasters
Such as fires, earthquakes, typhoons

By their very nature, natural disasters are unpredictable, and in recent years the deteriorating greenhouse effects have heightened the probability of natural disasters. Not only will such disasters damage our operating premises, buildings, equipment and the like, but loan collateral and investment objects may also be affected, which may lead to defaulting on repayments or loss of collateral.

Man-made incidents
Such as political incidents, strikes, wars

Events due to human factors such as politics and strikes may lead to traffic blocks that make it impossible for our employees to commute between home and work and for our business to run normally. Under such circumstances, our business premises may be unable to provide regular services and operations. Intensifying conflicts, if they cannot be resolved in the short term, may cause business losses or other impacts for our business premises. 

Disaster Information System
Such as cyber security attacks, digital viruses, data corruption, system crashes,
computer room inoperability

Cyber attacks may lead to the suspension or remote operation of our systems, damage to the database, network interruption, tampering with or theft of customer data, exposure of customers and employees’ private information, violation of service contracts with partner stores, etc., and result in significant losses to our bank.

Others
Mass infectious diseases

When a major infectious epidemic occurs, it may affect the health of our employees, cause a lack of human resources, or even render it impossible for certain locations to continue operations or provide customer services. In addition, improper epidemic prevention measures may lead to increased operating costs or even disruption of operations and services.

Business Impact Analysis is used to determine the target time for recovery, tolerable data loss time and recovery priorities, and to assess in advance the minimum resource requirements.

Minimum Resource Requirements (MRR) refers to the assessment of the backup resources required to recover operations to an acceptable minimum level. MRR includes staff, office space and facilities, computer equipment, software, applications, systems communication equipment, computer networks, important documentation, electronic files, paper files, means of transportation, stationery, etc. MRR should be sufficient to continue operations for a period of time.

In principle, at least one drill is held every year and if necessary, drills may be conducted twice a year. For details, please see the "Drills and tests".

The Business Continuity Plan Drill (BCP Drill) is to ensure that after a disaster emerges, the BCP can be activated immediately and to ascertain that it is indeed feasible, so that key operations can be restored to their normal state within the recovery time limit. The test drill results ensure the following:

• The BCP Drill is to ensure that after a disaster emerges, the BCP can be activated immediately and to ascertain that it is indeed feasible, so that key operations can be restored to their normal state within the recovery time limit.
• The content of the BCP is complete, not only covering all key duties and various types of emergencies, but also leaving no ambiguity so that even those not familiar with the BCP can easily join in the implementation.
• The BCP is regularly reviewed and updated. Important members understand the BCP operations, their roles, and responsibilities.
• In principle, at least one drill is held every year and if necessary, drills may be conducted twice a year. When there are major changes in the operation items, personnel, business premises, or the external operating environment, the time schedule for testing must be adapted.

Each year, major anomalous incidents on the group’s major information systems are simulated, and contingency planning drills for different scenarios are conducted. The drill results and deficiencies in implementation are reviewed and presented in a report to the top management to safeguard the integrity of the system’s backup environment and to ensure that the data recovery processes run smoothly and stable so that reliable financial services can be provided, and the security of customer transactions is protected.

• We simulate various network hacking attacks and conduct emergency response planning exercises under different scenarios every year to familiarize employees with the procedures for processing information security incidents. The exercises in 2021 included distributed denial of service (DDoS) attacks and Red team drill.

• To ensure that the current assets position retains access to funds, the liquidity position is tested by a round of repurchase agreement and selling securities once every six months.
• The Financial Management Unit normally uses the interbank financing channels to test whether interbank financial transactions granted to the bank by other financial institution remain normal. The test adopts the principle of decentralization to avoid the risk of negative rumors caused by the market at the time of an incident.
• The Financial Management Unit incorporates the results of stress tests into the planning parameters of the Contingency Funding Plan, which is reviewed and revised regularly every year to ensure the plan’s efficacy and appropriateness.