tw-fintech-compliance

asgard-ai-platform ｜ 金融與投資 ｜ 原文 ｜ MIT

整理台灣金融科技法規：電子支付、VASP、AML/KYC 與監理沙盒

---
name: "tw-fintech-compliance"
description: "摸清台灣的金融科技法規，包括金管會監理、電子支付法規、VASP 規則、AML/KYC 要求，以及監理沙盒。當使用者要在台灣做金融科技產品、需要了解執照要求、評估加密貨幣/VASP 合規，或申請監理沙盒時使用這個 skill，就算他們說的是「我們需要執照嗎」、「台灣的加密貨幣法規」、「KYC 要求」或「金融科技沙盒申請」也一樣。"
metadata:
  category: "WP-12 產業知識"
  tags: ["industry", "taiwan", "fintech", "compliance", "regulation"]
---

# 台灣金融科技合規

## 框架

```
IRON LAW: In Fintech, Regulation Comes BEFORE Product
（鐵律：在金融科技，法規先於產品）

不像多數科技產品可以先上線再迭代，台灣的金融服務
必須「先取得執照」。沒有適當執照就營運是刑事犯罪（不只是罰款）。
在寫任何程式碼「之前」，先確定你的監理類別和執照要求。
```

### 金管會監理框架

**金融監督管理委員會（FSC）** 監管台灣所有金融服務：

| 類別 | 適用法律 | 是否需要執照 | 金管會主管單位 |
|----------|-------------|-----------------|-------------|
| **電子支付** | 電子支付機構管理條例 | 電子支付機構許可 | 銀行局 |
| **第三方支付** | 第三方支付服務業管理辦法 | 登記（較輕） | 銀行局 |
| **P2P 借貸** | 金融科技發展與創新實驗條例（沙盒）或群眾募資規則 | 個案認定 | 證券期貨局 |
| **智能投顧** | 證券投資信託及顧問法 | 投資顧問執照 | 證券期貨局 |
| **保險科技** | 保險法 | 保險經紀人/代理人執照 | 保險局 |
| **VASP（加密貨幣）** | 虛擬資產服務提供者管理辦法（2024） | VASP 登記 + AML 合規 | 證券期貨局 |
| **開放銀行** | 金融機構間資料共享指引 | 與銀行建立 API 合作 | 銀行局 |

### 電子支付 vs 第三方支付

| 特性 | 電子支付 | 第三方支付 |
|---------|---------------------------|-------------------------------|
| 儲值 | 有（電子錢包） | 沒有（僅代收代付） |
| P2P 轉帳 | 可以 | 不行 |
| 資本額要求 | NT$500M 以上 | NT$5M |
| 執照 | 金管會核准（12-18 個月） | 登記（1-3 個月） |
| 例子 | LINE Pay Money、街口支付、icash Pay | 綠界 ECPay、藍新 NewebPay |

### VASP（加密貨幣）法規（2024 年起）

| 要求 | 細節 |
|------------|--------|
| 登記 | 必須向金管會登記為 VASP |
| AML/CFT | 完全遵循洗錢防制法 |
| KYC | 所有使用者都要身分驗證 |
| 保管 | 必須隔離客戶資產 |
| 行銷 | 廣告受限（不得承諾報酬） |
| 申報 | 向調查局申報可疑交易報告（STR） |

### AML/KYC 要求（所有金融服務）

| KYC 等級 | 何時需要 | 蒐集的資料 |
|-----------|-------------|---------------|
| **簡化** | 低風險、小額交易 | 姓名、身分證字號、出生日期 |
| **標準** | 開戶、多數交易 | + 地址、職業、資金來源 |
| **加強** | 高風險客戶、PEP、大額交易 | + 詳細的財富來源、持續監控 |

**持續性義務：**
- 交易監控（異常模式）
- 向法務部調查局申報可疑交易報告（STR）
- 制裁名單篩查（OFAC、UN、EU 名單）
- 紀錄保存：帳戶結清後 5 年以上

### 監理沙盒（金融科技創新實驗）

| 面向 | 細節 |
|--------|--------|
| 目的 | 在不需完整執照的情況下，測試創新金融服務 |
| 期間 | 最長 18 個月（可延長到 36 個月） |
| 申請 | 向金管會提交：創新說明、消費者保護計畫、風險評估 |
| 核准時間 | 60 個工作日 |
| 範圍限制 | 必須界定使用者人數、交易上限、地理範圍 |
| 退場計畫 | 取得完整執照的路徑，或有序結束 |

### 開放銀行（三個階段）

| 階段 | 共享的資料 | 狀態 |
|-------|-----------|--------|
| 第一階段 | 產品資訊（利率、費用） | 2019 年上線 |
| 第二階段 | 客戶資訊（經同意） | 2021 年上線 |
| 第三階段 | 交易發動（付款、轉帳） | 開發中 |

## 輸出格式

```markdown
# Fintech Compliance Assessment: {Product}

## Product Classification
- Service type: {payment / lending / advisory / crypto / insurance}
- Regulatory category: {electronic payment / third-party / VASP / etc.}
- License required: {specific license name}

## Licensing Pathway
| Step | Action | Timeline | Cost |
|------|--------|----------|------|
| 1 | {step} | {months} | NT${X} |

## AML/KYC Requirements
- KYC level: {simplified / standard / enhanced}
- Transaction monitoring: {required / not required}
- STR reporting: {required / not required}

## Key Risks
| Risk | Impact | Mitigation |
|------|--------|-----------|
| {regulatory risk} | H/M/L | {action} |

## Recommendation
- Proceed with licensing / Use sandbox / Restructure product to avoid licensing
```

## 常見陷阱

- **第三方支付 vs 電子支付**：差別在於儲值。如果你的 app 持有客戶的錢（電子錢包），就需要重得多的電子支付執照（資本額 NT$500M）。如果只是處理付款（把錢從買家轉給賣家），第三方支付登記就夠了。
- **沙盒不是捷徑**：沙盒讓你暫時免於執照要求，但你還是必須遵守 AML、消費者保護和資料隱私。而且要商業化，你還是得取得完整執照。
- **VASP 法規很新，還在演變**：2024 年的 VASP 規則是台灣第一部完整的加密貨幣法規。預期會有修正和額外的指引。要建立有彈性、可調整的合規基礎設施。
- **外國金融科技進入台灣**：外國公司必須設立台灣的實體，並取得台灣專屬的執照。在其他司法管轄區的執照不能移轉過來。
- **這是教育性質的指引，不是法律/法規建議**：金融法規很複雜，違規的處罰包括刑事責任。請聘請專精台灣金融服務的法規事務律師。

## 參考資料

- 金管會執照申請指南，見 `references/fsc-licensing.md`
- AML/KYC 實作檢查表，見 `references/aml-kyc-checklist.md`

---
name: "tw-fintech-compliance"
description: "Navigate Taiwan fintech regulations including FSC oversight, electronic payment laws, VASP rules, AML/KYC requirements, and the regulatory sandbox. Use this skill when the user is building a fintech product in Taiwan, needs to understand licensing requirements, assess crypto/VASP compliance, or apply for the regulatory sandbox — even if they say 'do we need a license', 'crypto regulation in Taiwan', 'KYC requirements', or 'fintech sandbox application'."
metadata:
  category: "WP-12 產業知識"
  tags: ["industry", "taiwan", "fintech", "compliance", "regulation"]
---

# Taiwan Fintech Compliance

## Framework

```
IRON LAW: In Fintech, Regulation Comes BEFORE Product

Unlike most tech products where you can launch and iterate, financial
services in Taiwan require LICENSING FIRST. Operating without the proper
license is a criminal offense (not just a fine). Determine your regulatory
category and licensing requirements BEFORE writing code.
```

### FSC Regulatory Framework

**金融監督管理委員會 (FSC)** oversees all financial services in Taiwan:

| Category | Governing Law | License Required | FSC Division |
|----------|-------------|-----------------|-------------|
| **Electronic payment** | 電子支付機構管理條例 | 電子支付機構許可 | Banking Bureau |
| **Third-party payment** | 第三方支付服務業管理辦法 | Registration (lighter) | Banking Bureau |
| **P2P lending** | 金融科技發展與創新實驗條例 (sandbox) or crowd-funding rules | Case-by-case | Securities Bureau |
| **Robo-advisory** | 證券投資信託及顧問法 | Investment advisory license | Securities Bureau |
| **Insurance tech** | 保險法 | Insurance broker/agent license | Insurance Bureau |
| **VASP (crypto)** | 虛擬資產服務提供者管理辦法 (2024) | VASP registration + AML compliance | Securities Bureau |
| **Open banking** | 金融機構間資料共享指引 | API partnership with banks | Banking Bureau |

### Electronic Payment vs Third-Party Payment

| Feature | Electronic Payment (電子支付) | Third-Party Payment (第三方支付) |
|---------|---------------------------|-------------------------------|
| Stored value | Yes (e-wallet) | No (pass-through only) |
| P2P transfer | Yes | No |
| Capital requirement | NT$500M+ | NT$5M |
| License | FSC approval (12-18 months) | Registration (1-3 months) |
| Examples | LINE Pay Money, JKoPay, icash Pay | 綠界 ECPay, 藍新 NewebPay |

### VASP (Crypto) Regulations (2024+)

| Requirement | Detail |
|------------|--------|
| Registration | Must register with FSC as VASP |
| AML/CFT | Full compliance with 洗錢防制法 |
| KYC | Identity verification for all users |
| Custody | Customer asset segregation required |
| Marketing | Restrictions on advertising (no promises of returns) |
| Reporting | Suspicious transaction reports (STR) to 調查局 |

### AML/KYC Requirements (All Financial Services)

| KYC Level | When Required | Data Collected |
|-----------|-------------|---------------|
| **Simplified** | Low-risk, small transactions | Name, ID number, DOB |
| **Standard** | Account opening, most transactions | + Address, occupation, source of funds |
| **Enhanced** | High-risk customers, PEPs, large transactions | + Detailed source of wealth, ongoing monitoring |

**Ongoing obligations:**
- Transaction monitoring (unusual patterns)
- Suspicious Transaction Reports (STR) to 法務部調查局
- Sanctions screening (OFAC, UN, EU lists)
- Record keeping: 5+ years after account closure

### Regulatory Sandbox (金融科技創新實驗)

| Aspect | Detail |
|--------|--------|
| Purpose | Test innovative financial services without full licensing |
| Duration | Up to 18 months (extendable to 36) |
| Application | Submit to FSC with: innovation description, consumer protection plan, risk assessment |
| Approval time | 60 business days |
| Scope limitation | Must define user count, transaction limits, geographic scope |
| Exit plan | Path to full license or orderly shutdown |

### Open Banking (Three Phases)

| Phase | Data Shared | Status |
|-------|-----------|--------|
| Phase 1 | Product information (rates, fees) | Launched 2019 |
| Phase 2 | Customer information (with consent) | Launched 2021 |
| Phase 3 | Transaction initiation (payment, transfer) | In development |

## Output Format

```markdown
# Fintech Compliance Assessment: {Product}

## Product Classification
- Service type: {payment / lending / advisory / crypto / insurance}
- Regulatory category: {electronic payment / third-party / VASP / etc.}
- License required: {specific license name}

## Licensing Pathway
| Step | Action | Timeline | Cost |
|------|--------|----------|------|
| 1 | {step} | {months} | NT${X} |

## AML/KYC Requirements
- KYC level: {simplified / standard / enhanced}
- Transaction monitoring: {required / not required}
- STR reporting: {required / not required}

## Key Risks
| Risk | Impact | Mitigation |
|------|--------|-----------|
| {regulatory risk} | H/M/L | {action} |

## Recommendation
- Proceed with licensing / Use sandbox / Restructure product to avoid licensing
```

## Gotchas

- **Third-party vs electronic payment**: The distinction is stored value. If your app holds customer money (e-wallet), you need the much heavier electronic payment license (NT$500M capital). If you just process payments (pass money from buyer to seller), third-party registration is sufficient.
- **Sandbox is not a shortcut**: The sandbox exempts you from licensing temporarily, but you must still comply with AML, consumer protection, and data privacy. And you still need to get a full license to commercialize.
- **VASP regulation is new and evolving**: The 2024 VASP rules are Taiwan's first comprehensive crypto regulation. Expect amendments and additional guidance. Build compliance infrastructure that's adaptable.
- **Foreign fintech entering Taiwan**: Foreign companies must establish a Taiwan entity and obtain Taiwan-specific licenses. A license in another jurisdiction does not transfer.
- **This is educational guidance, not legal/regulatory advice**: Fintech regulation is complex and penalties for non-compliance include criminal charges. Engage a regulatory affairs lawyer specializing in Taiwan financial services.

## References

- For FSC licensing application guides, see `references/fsc-licensing.md`
- For AML/KYC implementation checklist, see `references/aml-kyc-checklist.md`