Anti-money Laundering and Combating the Financing of Terrorism

To integrate and promote the establishment and operation of overall risk management mechanism, E.SUN has set up its risk management department, which is responsible for formulating risk management policies and procedures, supervising the implementation of each subsidiary, and regularly reporting to the board of directors, audit committee, and risk management committee.
The AML/CFT management mechanism and structure of E.SUN's subsidiaries are as follows:

• A dedicated supervisor is appointed to be responsible for promoting, coordinating, and supervising the implementation of various AML/CFT matters and report regularly to senior management.
• The dedicated unit and personnel are responsible for formulating AML/CFT policies as well as operation standards. They are also responsible for the management of overall transaction monitoring, suspicious transaction reporting, sanctions compliance, group-wide training sessions, as well as managing AML-related matters in overseas branches. The current status and performance are reported to the dedicated supervisor and parent company on regular and irregular basis.
• AML/CFT supervisory officers are appointed in risk management or compliance departments under each domestic business units as well as overseas branches. They are responsible for supervising the implementation of AML/CFT-related matters in their subordinate units.
• The audit department formulates audit items in accordance with relevant internal control regulations and conducts regular audits.

Policies and Procedures

E.SUN FHC and its subsidiaries have established AML/CFT policies and procedures with regard to aspects such as due diligence, name screenings (watch list filtering), transaction monitoring, employee management, and record keeping. In 2023, E.SUN conducted regular review on relevant policies and procedures. The company has formulated "Guidelines on Group-wide Information Sharing" to set up procedures of group-wide customer due diligence information sharing, and include the overall implementation as a part of the annual performance report to the board of directors. Additionally, based on the "Risk Appetite Declaration for Money Laundering and Financing of Terrorism", the risk appetite standards of institutional risk assessment are precisely defined. Key risk indicators are monitored by the AML/CFT Risk Dashboard.

In 2023, subsidiary E.SUN Bank amended the "Anti-Money Laundering and Combating the Financing of Terrorism Policy", adjusting the criteria of customer involved with virtual currency and definition of virtual currency activities referring to the "Regulations Governing Anti-Money Laundering and Countering the Financing of Terrorism for Enterprises Handling Virtual Currency Platform or Transaction". Regulations and guidelines related to customer due diligence are also revised to include Third-Party Payment Providers (TPPP) as industry/occupation of high-risk, and online lending platform operators (P2P) as well as Virtual Asset Service Providers (VASP) as special high risk. Exceptions for beneficial owner identification of are also added.

For subsidiary E.SUN Securities, in 2023, the "Risk Appetite Declaration for Money Laundering and Financing of Terrorism" is revised to include the FATF grey list as high risk countries, in line with the Country Risk Assessment methodology of the parent company. Additionally, the "Anti-Money Laundering and Counter-Terrorism Financing Guidelines" and the "Anti-Money Laundering and Counter-Terrorism Financing Guidelines for Concurrent Futures Brokers" will be revised to establish a consistent approach and principles for accepting VASPs within the group.

Customer Due Diligence

E.SUN's due diligence procedures are as follows:

E.SUN continuously develops its IT systems, optimizes operational processes, and integrates customer information to improve Customer Due Diligence (CDD) / Enhanced Due Diligence (EDD) operations. Subsidiary E.SUN Bank has launched its self-developed CDD/EDD system, "Customer Due Diligence Platform (CAML)". CAML provides one-stop service for various due diligence scenarios, covering onboarding stage, ongoing stage and trigger events, with a view to increase the mastery of customers' identification. The platform allows employees to access up-to-date customer information as well as retained documents, and automatically integrates external public equity structure information to assist in identification of ultimate beneficial owners. Subsidiary E.SUN Securities has also launched its self-developed "Account Review Platform" to complete account review operations and access up-to-date customer information and retained documents.

Senior Management Approval and Sign Off

When assessing customer risk, various factors such as background, industry, socioeconomic activity characteristics, region, organization type, and structure of non-natural person customers must be considered. This includes whether the customers are from high-risk money laundering and terrorism financing countries or industries prone to money laundering and terrorism financing. For customers identified as high risk or possessing specific high-risk factors, enhanced due diligence will be executed, including verification on the source of funds and wealth. The aforementioned customer transactions can only be undertaken with the approval of senior management. Moreover, transactions involving extremely high-risk jurisdictions such as Iran and DPRK are prohibited, nor are onboarding entity customers whose business involves certain virtual currency activities acceptable.

Non-Face-to-Face Due Diligence

For due diligence measures of customers from "non-face-to-face" channels, E.SUN has both applied confirmation procedures equivalent to those for face-to-face customers, and adopted adequate measures to mitigate risk. E.SUN Bank and E.SUN Securities provide specific, clear instructions for applying for digital bank accounts and online securities accounts on their official websites, including the required documents, application qualifications, and inquiry instructions on approval progress and supplementary document. Furthermore, both subsidiaries continually encourage customers to use online banking, mobile banking, or the "Personal Basic Information Update Platform (eKYC)" for online data updates to assist customers in completing account reviews. For entity customers, online data updates for account reviews are also available in 2023.

Watch List Filtering

E.SUN improves its watch list filtering operations through the continuous development of IT systems. E.SUN Bank has launched its self-developed "Name Screening System (SAML)". SAML enhances the update frequency of important sanction lists by directly connecting to relevant official websites, prevents duplicate case reviews, and increases matching accuracy with scanning engines utilizing big data and language analysis. In 2023, the system further integrates SWIFT message screening of overseas units. E.SUN Securities strengthens its efficiency and effectiveness of watch list filtering operations by utilizing the AML/CFT query system established by the Taiwan Depository & Clearing Corporation with the aid of Dow Jones Risk & Compliance database.

Combating the Financing of Terrorism and Countering Proliferation Financing

For establishing business relationship or providing new services, E.SUN conducts real-time checks on customer names and those of their associates, as well as daily batch scanning and name list updates. When conducting specific transactions, the related parties, such as remitters and beneficiaries, are also checked. The lists adopted by E.SUN include, but are not limited to, the Taiwan Ministry of Justice (MOJ) Sanctions List, the United Nations Security Council (UNSC) Comprehensive Sanctions List, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) Specially Designated Nationals List (SDN-List), and lists published by the local regulatory authorities of overseas branches. In response to the recent international sanctions against Russia, subsidiary E.SUN Bank has announced relevant information on the official website, reminding customers to be cautious of whether their counter parties and goods are involved with sanctions regimes in order to ensure the transactions are clear of sanctions.

PEP / RCA (Politically Exposed Person / Relative and Close Associate)

To verify whether customers and the corresponding ultimate beneficial owner belong to PEP/RCA, identifications are conducted via IT systems with name list databases during specific events, including the establishment of business relationships, the addition of new relationships, regular reviews, and trigger event reviews. If confirmed as PEP/RCA, enhanced due diligence and strengthened transaction monitoring will be conducted. Verification on source of funds and wealth along with senior management approval are also required before proceeding. Moreover, high-risk PEP/RCA customers must undergo annual reviews, and related transactions will be subject to enhanced monitoring.

Suspicious Transaction Reporting (STR)

In terms of suspicious transaction monitoring, E.SUN refers to typologies published by regulatory authorities, and conducts transaction monitoring for all transactions through system assistance and manual processes, covering customers, employees, and financial institutions involved with E.SUN. Alerts generated by the system are investigated by dedicated personnel to verify the reasonableness of customer occupation/industry, source of funds, purposes of transactions, and whether transaction activities are consistent with past patterns, while also retaining investigation records. Suspicious transactions discovered by branch staffs and relevant information are reported to dedicated units via internal reporting mechanism, and further investigations will be conducted by dedicated personnel.

IIf deemed suspicious, the transactions will be reported to the Financial Intelligence Center (FIU). The entire reporting processes are conducted through a dedicated computer with all portable devices blocked. All personnel in dedicated units are obliged to confidentiality agreements with a view to ensure reporting information cannot be leaked to unrelated third parties. In 2023, subsidiary E.SUN Bank has launched it self-built "Internal Suspicious Transaction Report Platform (ISTR)", optimizing the process of filing internal STR from business units to the dedicated unit. ISTR is also connected with the "Transaction Monitoring System (GAML)" for enhancements in the accuracy and efficiency of case management.

Technology Application

In order to enhance operational efficiency and reduce the risk of manual error, E.SUN has self-developed Robotic Process Automation (RPA) programs to handle highly repetitive, routine tasks through automation or semi-automation. Machine learning models and platforms are also applied in practical scenarios, including adverse media collection, watch list filtering, and abnormal transaction detection, combined with business logic or manual operations to improve case review efficiency. Moreover, E.SUN has exploited the technology of Artificial Intelligence (AI) by integrating self-built model into the transaction monitoring system. To assist in case investigation and analyze of customer abnormal behaviors, Alert Model and Customer Cohort Model are developed and launched at the end of 2023.

Record Keeping

E.SUN maintains records and files related to the implementation of AML/CFT, as well as records and vouchers of customer transactions, for at least five years after the end of customer business relationships or temporary transactions. This is done to facilitate future inspections and inquiries, and to provide evidence of efforts in AML/CFT.

Annual Independent Assessment

Disclosure of AML/CFT Related Information

E.SUN FHC discloses its AML/CFT policies, risk appetite, and AML questionnaires (Wolfsberg CBDDQ Questionnaire) on its official website, while subsidiary E.SUN Bank and E.SUN Securities also disclose internal control statements for AML/CFT on their official websites to enhance transparency.