Taiwan KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Taiwan.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Portable implementation guide
Get the PDF checklist
11 control areas · 38 implementation checks
Last reviewed: 5 November 2026 · Version 1.0
Download the checklistDirect answer
What does the Taiwan compliance checklist cover?
The Taiwan checklist translates primary KYC, KYB and AML rules into 11 control areas and 38 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Money Laundering Control Act
- FIU
- Anti-Money Laundering Division, Investigation Bureau, Ministry of Justice
- Financial-sector STR
- Within 10 business days after discovery; urgent significant cases as soon as possible
- Cash reporting amount
- NT$500,000 or foreign-currency equivalent, subject to prescribed exemptions
- Cross-border wire CDD
- NT$30,000 or foreign-currency equivalent
- AML beneficial owner
- Natural person with more than 25% ownership, then other control, then senior manager fallback
- Records
- At least 5 years; longer where another law requires
- FATF public lists
- Not listed at 19 June 2026
Implementation detail
Taiwan compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify the activity and competent supervisor before launch.3 items+
Determine whether the business is a financial institution, VASP, third-party payment provider or DNFBP.
- Implementation action
- Map each service and Taiwan nexus to the Money Laundering Control Act and the current sector regulation; do not apply financial-institution thresholds to another sector without confirmation.
- Evidence to retain
- Perimeter memo, service map and legal-source register.
- Primary citation
- Money Laundering Control Act, Articles 5-6
Obtain each required registration, licence or approval.
- Implementation action
- Confirm FSC, Ministry of Digital Affairs, Ministry of Economic Affairs or other competent-authority requirements before operating regulated financial, payment, remittance, virtual-asset or DNFBP services.
- Evidence to retain
- Licence matrix, approvals and conditions.
- Primary citation
- Money Laundering Control Act, Article 6; applicable sector legislation
Use the correct reporting and supervisory authority.
- Implementation action
- Maintain a dated map of the FSC and sector supervisors, and route statutory reports to the Investigation Bureau in the prescribed format.
- Evidence to retain
- Authority map, portal procedure and acknowledgements.
- Primary citation
- Money Laundering Control Act; sector AML/CFT regulations
02Governance and risk assessmentControls must be risk-based, documented and tested.3 items+
Maintain an enterprise ML/TF/PF risk assessment.
- Implementation action
- Assess customers, geography, products, delivery channels, transactions, technologies and sanctions exposure, using current national and sector risk material.
- Evidence to retain
- Methodology, assessment, approval and update log.
- Primary citation
- Money Laundering Control Act, Article 7; FSC AML Regulations, Article 4
Maintain AML/CFT internal controls and audit.
- Implementation action
- Assign accountable leadership and compliance personnel, document procedures, train staff and conduct proportionate independent testing.
- Evidence to retain
- Governance map, policies, training and audit reports.
- Primary citation
- Money Laundering Control Act, Article 7
Apply group-wide controls lawfully.
- Implementation action
- Document overseas implementation, information sharing and conflict-of-law escalation without weakening Taiwan duties or personal-data protections.
- Evidence to retain
- Group standard, jurisdiction analysis and escalation log.
- Primary citation
- FSC AML Regulations, Article 4; Personal Data Protection Act
03Natural-person identificationCDD triggers and methods are sector-specific.4 items+
Identify and verify customers before establishing a relationship.
- Implementation action
- Use reliable, independent documents, data or information; retain the identity evidence or prescribed record.
- Evidence to retain
- Identity record, verification result and provenance.
- Primary citation
- FSC AML Regulations, Article 3
Apply financial-sector occasional-transaction triggers.
- Implementation action
- For covered financial institutions, perform CDD for cash transactions of NT$500,000 or more, linked transactions meeting that amount, and cross-border wires of NT$30,000 or more; confirm sector-specific variations.
- Evidence to retain
- Threshold table, configuration and test cases.
- Primary citation
- FSC AML Regulations, Articles 2-3
Verify representatives and authority.
- Implementation action
- Confirm the agency, identify and verify the representative, and retain authority evidence before accepting instructions.
- Evidence to retain
- Representative KYC, mandate and validation.
- Primary citation
- FSC AML Regulations, Article 3(4)(2)
Respond to failed or doubtful CDD.
- Implementation action
- Do not proceed contrary to the applicable rule; restrict activity, document the reason and consider an STR without tipping off.
- Evidence to retain
- Exception record, restriction and STR assessment.
- Primary citation
- FSC AML Regulations, Article 3(9)-(11)
04KYB, company information, and beneficial ownershipVerify existence, authority, ownership and ultimate control.4 items+
Verify the legal person or arrangement.
- Implementation action
- Obtain name, legal form, existence, governing documents, registered office, principal place of business and senior management information from reliable sources.
- Evidence to retain
- Company extract, constitutional documents and validation log.
- Primary citation
- FSC AML Regulations, Article 3(5)
Identify and verify beneficial owners.
- Implementation action
- Identify natural persons owning directly or indirectly more than 25%; if none or doubtful, identify control by other means; if none, identify the senior managing official.
- Evidence to retain
- Ownership chart, control rationale and verified identities.
- Primary citation
- FSC AML Regulations, Article 3(7)
Apply trust and similar-arrangement tests.
- Implementation action
- Identify the settlor, trustee, trust supervisor, beneficiaries and any other natural person exercising ultimate effective control, or equivalent roles.
- Evidence to retain
- Trust deed, role map and verified identities.
- Primary citation
- FSC AML Regulations, Article 3(7)(2)
Reconcile CDD with company reporting information.
- Implementation action
- Use the official company-information sources and investigate inconsistencies; do not treat registry information as a substitute for risk-based verification.
- Evidence to retain
- Registry extract, comparison and discrepancy resolution.
- Primary citation
- Company Act; Regulations Governing Company Registration
05PEPs, EDD, and remote onboardingHigher-risk relationships require enhanced controls.3 items+
Identify foreign, domestic and international-organisation PEP exposure.
- Implementation action
- Screen customers and beneficial owners and apply the current risk classification, senior approval, source-of-wealth, source-of-funds and monitoring requirements.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- FSC AML Regulations, Articles 6 and 10
Apply EDD to higher-risk relationships.
- Implementation action
- Obtain additional identity, purpose, ownership, wealth and funds evidence; increase approval and monitoring in proportion to risk.
- Evidence to retain
- EDD checklist, evidence and approval.
- Primary citation
- FSC AML Regulations, Article 6
Control non-face-to-face onboarding.
- Implementation action
- Use a method permitted by the relevant supervisor, test impersonation and fraud controls, and retain authentication and exception evidence.
- Evidence to retain
- Method assessment, session evidence and test results.
- Primary citation
- Applicable FSC and sector remote-onboarding rules
06Monitoring and suspicious reportingMonitoring must support timely reporting to the Investigation Bureau.4 items+
Monitor accounts and transactions on a risk basis.
- Implementation action
- Use documented scenarios, parameters, alert review and periodic tuning informed by the business risk assessment and published typologies.
- Evidence to retain
- Scenario inventory, alerts, tuning and governance.
- Primary citation
- FSC AML Regulations, Article 9
Report suspicious ML/TF activity regardless of amount or completion.
- Implementation action
- For covered financial institutions, file the prescribed STR with the Investigation Bureau within 10 business days after discovery and report obviously significant urgent cases as soon as possible through the permitted urgent route.
- Evidence to retain
- Trigger analysis, discovery time, approval, filing and acknowledgement.
- Primary citation
- FSC AML Regulations, Article 15
Prevent tipping off and protect report information.
- Implementation action
- Restrict access and communications and disclose only when legally permitted.
- Evidence to retain
- Access log, communication controls and training.
- Primary citation
- Money Laundering Control Act and applicable reporting rules
Document non-filing decisions.
- Implementation action
- Preserve facts, analysis, reviewer and decision time for alerts closed without an STR.
- Evidence to retain
- Closed-alert rationale and quality review.
- Primary citation
- FSC AML Regulations, Articles 9 and 15
07Cash reports, wires, payments, and virtual assetsSeparate CDD triggers, cash reporting and licensing duties.4 items+
File covered cash transaction reports.
- Implementation action
- For covered financial institutions, report cash transactions of NT$500,000 or more to the Investigation Bureau electronically within five business days, unless a prescribed exemption applies; still identify the customer and retain records where required.
- Evidence to retain
- Threshold result, exemption rationale, report and receipt.
- Primary citation
- FSC AML Regulations, Articles 2 and 13-14
Carry and screen required wire-transfer information.
- Implementation action
- Apply the current originator, beneficiary, missing-data, sanctions and intermediary controls for domestic and cross-border transfers.
- Evidence to retain
- Field matrix, samples, screening and repair queue.
- Primary citation
- FSC AML Regulations, Article 7
Classify payment and remittance models before launch.
- Implementation action
- Map wallets, stored value, acquiring, transfer, remittance and third-party payment functions to current registration and AML requirements.
- Evidence to retain
- Product memo, registration and control tests.
- Primary citation
- Money Laundering Control Act, Article 6; applicable payment laws
Register and control covered virtual-asset services.
- Implementation action
- Determine whether exchange, transfer, custody, wallet or related activity is a covered VASP function and complete the current AML registration before operating.
- Evidence to retain
- Classification, registration and AML programme.
- Primary citation
- Money Laundering Control Act, Article 6; VASP AML/CFT Regulations
08Targeted financial sanctionsImplement current Taiwan designations and prohibitions.3 items+
Screen designated sanctioned persons and entities.
- Implementation action
- Screen customers, beneficial owners, representatives and transactions at onboarding, periodically and on list updates against the competent authority's current list.
- Evidence to retain
- List version, screening logs and match decisions.
- Primary citation
- Counter-Terrorism Financing Act, Articles 4-5
Freeze and report property without unauthorized dealing.
- Implementation action
- Apply the statutory restriction immediately to a confirmed designation and report property, interests and location through the prescribed route.
- Evidence to retain
- Designation, restriction timestamp and report receipt.
- Primary citation
- Counter-Terrorism Financing Act, Articles 6-7
Use permits and releases only under written authority.
- Implementation action
- Document the legal basis, competent-authority approval and every condition before permitting access or releasing restrictions.
- Evidence to retain
- Permission, conditions and release record.
- Primary citation
- Counter-Terrorism Financing Act
09Records and authority accessRecords must reconstruct the customer and transaction lifecycle.3 items+
Retain transaction records for at least five years.
- Implementation action
- Preserve domestic and international transaction records for five years or longer where another law requires.
- Evidence to retain
- Retention schedule, trigger and retrieval test.
- Primary citation
- FSC AML Regulations, Article 12(1)
Retain CDD and relationship records for at least five years.
- Implementation action
- Run the period from relationship end or occasional-transaction date and retain identity, account, contract, correspondence and analysis records.
- Evidence to retain
- Schedule, source records and deletion controls.
- Primary citation
- FSC AML Regulations, Article 12(2)
Make records swiftly available to competent authorities.
- Implementation action
- Maintain controlled, auditable retrieval and production procedures.
- Evidence to retain
- Access matrix, production log and integrity checks.
- Primary citation
- FSC AML Regulations, Article 12(4)
10Privacy, biometrics, breaches, and transfersApply the operative Personal Data Protection Act text and sector rules.4 items+
Use a lawful, necessary and proportionate basis for personal data.
- Implementation action
- Map collection, processing, use, notices, rights, retention and processors to the operative statutory provisions and specified purpose.
- Evidence to retain
- Data map, notices, legal-basis register and rights log.
- Primary citation
- Personal Data Protection Act, Articles 5, 8-9 and 19-20
Protect identity and biometric data.
- Implementation action
- Minimise collection, apply security proportionate to sensitivity and document necessity, accuracy, access, liveness and deletion controls.
- Evidence to retain
- Assessment, security design, test results and approvals.
- Primary citation
- Personal Data Protection Act, Articles 2, 5 and 27; operative sector rules
Apply the operative breach-notification rule.
- Implementation action
- Confirm whether the 2025 amendments and sector rules are in force on the incident date; notify affected persons and authorities within the applicable scope and timing rather than assuming an uncommenced provision applies.
- Evidence to retain
- Commencement check, incident chronology, risk assessment and notices.
- Primary citation
- Personal Data Protection Act, Article 12 and commencement notes
Control international transfers.
- Implementation action
- Check competent-authority restrictions, purpose compatibility, contracts and security before transferring personal data abroad.
- Evidence to retain
- Transfer map, restriction check, safeguards and notices.
- Primary citation
- Personal Data Protection Act, Article 21
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting FSC AML Regulations, Articles 3-10
Maintain STR, cash-report and sanctions case packs.
- Implementation action
- Link trigger, analysis, decision time, approval, filing, receipt, confidentiality and restrictions.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- FSC AML Regulations, Articles 13-15; Counter-Terrorism Financing Act
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, thresholds, reporting, sanctions, privacy, vendors, source versions and tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
15 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Money Laundering Control ActFinancial Supervisory Commission laws system · Primary legislation - official text
- Regulations Governing Anti-Money Laundering of Financial InstitutionsFinancial Supervisory Commission · Official sector regulation
- FSC laws and regulations retrieving systemFinancial Supervisory Commission · Official regulatory repository
- Counter-Terrorism Financing ActFinancial Supervisory Commission · Primary legislation - official English text
- VASP AML/CFT RegulationsFinancial Supervisory Commission · Official sector regulation
- Anti-Money Laundering OfficeExecutive Yuan · Official AML policy and risk portal
- 2024 National ML/TF/PF Risk Assessment - EnglishExecutive Yuan Anti-Money Laundering Office · Official national risk assessment
- Company ActLaws and Regulations Database of the Republic of China · Primary legislation - official consolidated text
- Regulations Governing Company RegistrationMinistry of Economic Affairs · Official registry regulation
- Company responsible person and major shareholder reporting platform guidanceMinistry of Economic Affairs · Official registry guidance
- Personal Data Protection ActLaws and Regulations Database of the Republic of China · Primary legislation - official consolidated text and commencement notes
- National flag specifications and official artworkMinistry of the Interior · Official flag guidance
- APG mutual evaluation of Chinese TaipeiAsia/Pacific Group on Money Laundering · Authoritative mutual evaluation
- FATF increased monitoring - 19 June 2026FATF · Authoritative current public-list status
- FATF call for action - 19 June 2026FATF · Authoritative current public-list status
Direct answers
Taiwan KYC, KYB and AML questions
Who receives suspicious transaction reports?+
The Investigation Bureau, Ministry of Justice receives the prescribed reports; its Anti-Money Laundering Division performs the FIU function.
When must a financial-sector STR be filed?+
Within 10 business days after discovery under the FSC regulation; an obviously significant urgent matter is reported as soon as possible through the permitted urgent route.
What is the covered cash reporting amount?+
NT$500,000 or the foreign-currency equivalent for covered financial institutions, subject to the prescribed exemptions and sector rules.
What is the cross-border wire CDD trigger?+
NT$30,000 or the foreign-currency equivalent for covered financial institutions.
How is a beneficial owner identified?+
For financial-sector CDD, start with natural persons owning directly or indirectly more than 25%, then other control, then a senior managing official fallback.
How long are AML records retained?+
At least five years, with a longer period where another law requires.
Are virtual-asset services regulated?+
Covered VASP activities require the current AML registration and controls; classify each service before launch.
Is Taiwan on a FATF public list?+
No at 19 June 2026. Absence from a list is not a low-risk conclusion.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 5 November 2026. Confirm controlling Chinese texts, commencement status, sector rules, reporting formats, exemptions, sanctions designations, privacy requirements and licensing conditions with the competent authority and qualified Taiwan counsel.