• Font Size：
  • S
  • M
  • L
友善列印
WORD

Article Content

Title：

Guidelines for the Work-From-Home Application by Securities Firms in Response to COVID-19  CH

Amended Date： 2023.10.03 (Articles 1, 2, 3 amended,English version coming soon)
Current English version amended on 2021.05.25 
Categories： Market Supervision > Regulation of Securities Firms
Article Content Content Search Article No. Search Amended Article Legislative History Chinese
1     Conditions for securities firms to initiate a work-from-home program
    A securities firm shall first seek other places of business (including outside backup places of business) to work in unless:
  1. the Central Epidemic Command Center declares a major epidemic (e.g., community-acquired infections)
  2. any employee of the place of business becomes a confirmed case
  3. any major business personnel and agent of the place of business must undergo home isolation, home quarantine, or self-health monitoring
 Info
2     Securities firm work-from-home application process and application documents
  1. Application process
    1. A securities firm applying for working from home to handle brokerage trading and transactions, dealer trading and transactions, and clearing and reporting etc. shall make the application to the Taipei Stock Exchange Corporation for special transfer to the competent authority for approval, in accordance with Article 1.(5) of the Securities Firms COVID-19 Response Measures. Notwithstanding, the securities firm may prepare the relevant documents to apply to the TWSE for preliminary examination to shorten the application procedure; if prevented by an emergency (e.g., lockdown, any confirmed case among employees etc.) from making a written application according to normal procedure, said firm may make a report to the TWSE by special means (e.g., email), followed by the submission of the relevant documents to the TWSE for the record after the incident.
    2. A securities firm applying for working from home to handle businesses other than brokerage trading and transactions, dealer trading and transactions, and clearing and reporting etc. shall make a report to the TWSE for recordation purposes, with the relevant documents (including the period, personnel deployment, business activities, and management measures in regard to the work-from-home arrangement) submitted, within three days prior to the, or from the date of, work-from-home.
  2. Application documents
    3.     A securities firm applying for working from home shall make a special application to the TWSE in advance, with a contingency plan and case list (as attached) containing the following presented:
    1. Availability period: The period available for work-from-home being sought may not exceed three months, provided an application with good cause may be made prior to expiration to the TWSE for special transfer to the competent authority for approval of a three-month extension. If prevented by an emergency from making a written application according to normal procedure, a securities firm may make a report to the TWSE by special means, followed by the submission of the relevant documents to the TWSE for the record after the incident.
    2. Personnel deployment: Information such as the names and residential addresses of the personnel. A senior officer must be designated as a point of contact with the TWSE. Changes shall be reported to the TWSE in advance for recordation.
    3. Business activities: Businesses handled during the work-from-home period are limited to those stated in the application (e.g., transactions, clearing). If the work-from-home application is to handle transactions only, clearing not covered by the application may be handled at the place of business only. If changes are necessary, an application shall be made to the TWSE for special transfer to the competent authority for approval. If prevented by an emergency from making a written application according to normal procedure, a securities firm may make a report to the TWSE by special means, followed by the submission of the relevant documents to the TWSE for the record after the incident.
    4. Operation and procedure: The operation and procedure of work-from-home must expressly describe the differences with working at the place of business.
    5. Management measures:
      1. The company shall establish measures to monitor the activities and communications of employees working from home. Work-from-home activities are limited to those approved by the company. Stricter reviews shall be conducted of the personal transactions of work-from-home employees, including that methods for managing the employees’ communications and activities in connection with brokerage trading etc. shall be expressly prescribed. In principle no personnel responsible for reviewing and monitoring the activities of work-from-home employees may work from home, unless such personnel’s review and monitoring will not be hindered by their working from home.
      2. The company shall inform work-from-homers of their rights and obligations and explain the importance of legal compliance fully.
      3. The company shall adopt measures to protect and expressly prescribe management measures for client privacy and the safety of client data and records etc.
      4. The company must verify client identity (e.g., when accepting orders) and step up measures to manage client accounts.
      5. The company shall publish an outline of the work-from-home arrangement on the company website (home page) and assist clients in understanding company operations and risk of suspension of transactions etc.
    6. Test report: The company must first test the remote access system for work-from-home purposes and ensure employees may access the company system only through safe connection.
    7. Information security measures:
      1. The company must update the security measures concerning connection to the virtual private network, VPN, and other remote access systems, adopt multi-factor authentication, and educate work-from-homers on cyber vigilance etc.
      2. The company must establish safe channels for remote access, restrict log-in to company employees only, fully track in writing operation of equipment, and prescribe regulations governing the hours that connection is available subject to the schedule of the employees’ performance of duties.
    8. Issue a statement on the Establishment of Information Security Inspection Mechanisms.
    9. Measures for the prevention of conflicts of interest and violations of rules and regulations: Prescribe comprehensive and express measures to prevent conflicts of interest and violations of rules and regulations by work-from-homers.
    10. Minutes of the board of directors’ meeting where the board of directors agrees to the work-from-home, or in lieu thereof, the consent of the head office or regional center of the group.
 Info
3     Complementary measures for work-from-home management of securities firms
  1. Brokerage trading and transactions
    1. Brokerage trading personnel shall conduct business honestly and in good faith and avoid misusing non-public information and conflicts of interest.
    2. Personal computers for use at home shall all be allocated by the company. Use of a personal computer not provided by the company is subject to company approval and information security testing in advance. Relevant computer equipment may be used only for official business purposes during work-from-home hours.
    3. Work-from-homers may not proceed with transactions until after VPN connection and authorized log-in. All user log-ins and transactions shall be fully tracked in writing.
    4. Multi-factor authentication: To enhance safety of use and operation, two-factor authentication of the multi-factor authentication shall be adopted for personal account numbers and passwords (employee account number and password, dynamic password, one-time password) to verify user identity.
    5. A principal shall dial the brokerage order number of the place of business to have the call transferred to the mobile phone or home phone of a brokerage trading representative (the call to be recorded by company equipment). If existing company equipment cannot record the entire call, it will be recorded either by the mobile phone of, or by, said representative, with the following measures adopted: After placing the order, the representative must, as soon as possible, make an audio recording of the time and content of the order and file such recording with the recording equipment of the company or email the recording to the company and client.
    6. Personnel responsible for reviewing and monitoring the activities of work-from-home employees must verify the audio recordings of work-from-homers periodically to ensure both conformance to those kept at the place of business and that the audio recordings of work-from-homers are distinguishable as such.
    7. Brokerage trading personnel will access the order system of the company’s personal computer through the VPN. Trading limits of principals are governed by existing mechanisms.
    8. Express modes of operation and management methods shall be in place for personal transactions of work-from-home employees, including communications and activities pertaining to brokerage trading etc.
  2. Dealer trading and transactions
    1. Dealer trading personnel shall conduct business honestly and in good faith and avoid misusing non-public information and conflicts of interest.
    2. Personal computers for use by dealer trading personnel at home shall all be allocated by the company, with hardware and software appropriate for the business performed by the personnel installed for management purposes.
    3. Work-from-homers may not proceed with transactions until after VPN connection and authorized log-in. All user log-ins and transactions shall be fully tracked in writing.
    4. Multi-factor authentication: To enhance safety of use and operation, two-factor authentication of the multi-factor authentication shall be adopted for personal account numbers and passwords (employee account number and password, dynamic password, one-time password) to verify user identity.
    5. The company shall provide sufficient computer monitors at the work-from-home space of a trader. Video equipment and headsets shall also be provided to ensure unimpeded communications. Whole transactions shall be videotaped throughout the trading hours and documented.
    6. A trader must remain connected to the video equipment and keep all communication channels connected at all times throughout the trading hours. The system shall have the function to close a transaction should the trader be disconnected in the course of the transaction.
    7. System closure during non-trading hours: In respect of work-from-homers responsible for day trading orders, the trading system shall immediately be closed after the close of the day trading session, and such personnel shall be prohibited from accessing the system to trade.
    8. Personnel responsible for reviewing and monitoring the activities of work-from-home employees verify the audio recordings of transactions of work-from-homers periodically to ensure both conformance to the audio recordings kept at the place of business and that the audio recordings of work-from-homers are distinguishable as such.
    9. With regard to the risk exposure of a close position, the company shall be able to control trading limits and position risks, whether in the event of working at the place of business or from home.
    10. Control of personal transactions of work-from-homers: The company may allow or prohibit personal transactions of work-from-homers upon careful assessment in accordance with company management policies. If it so allows, the ways of control of such transactions shall include prescribing express modes of operation and management methods in regard to communications and activities pertaining to brokerage trading (e.g., stipulating that audio recordings be made of whole telephone orders, recordings be made of all electronic orders placed on computers allocated by the company).
  3. Clearing and reporting
    1. A securities firm shall complete clearing and settlement in accordance with the TWSE Operating Rules and relevant regulations and also complete all clearing procedures and the reporting that is required by laws and regulations. Said firm shall in principle handle the above at the place of business (including an outside backup place of business) or assign work-from-homers to assist in handling.
    2. When performing procedures pertaining to settlement of payment, non-trading activities of a credit transaction (such as demand of payment, cash repayment, return of securities), and borrowing and transfer of securities, a principal shall in principle do so at the place of business (including an outside backup place of business) or assign work-from-homers to assist in doing so.
    3. Clearing and settlement procedures may be performed only at the original place of business if the applicant does not apply for handling clearing from home in its work-from-home application. Said applicant shall still make an application to the TWSE for special transfer to the competent authority for approval if, after its work-from-home application, it must assign work-from-homers to handle clearing and settlement as a result of the original place of business being subject to isolation. If prevented by an emergency from making a written application according to normal procedure, a securities firm may make a report to the TWSE by special means, followed by the submission of the relevant documents to the TWSE for the record after the incident.
  4. Information Security
    1. No unauthorized expansion of capability or installation of software/hardware equipment and tools that are not required for official business is allowed in respect of computer equipment, including notebooks and tablets, used by work-from-homers.
    2. Log-ins to major systems and transactions by all work-from-homers shall be fully tracked and documented.
    3. Computers for home may be used for entering data only. No access to the data of the computer equipment of the company is allowed through computers for home use.
    4. To mitigate data breach risks, specific information security software shall be installed on the computer equipment of work-from-homers to control access authority of applications; non-essential service and operating systems on the computers, as well as the USB and Bluetooth devices and optical disc drives of the aforementioned equipment, shall be disabled; and the VPN shall be set up in a way as to restrict two-way file copying and transfers.
    5. A virtual private network that uses the Secure Sockets Layer protocol (SSL-VPN) and multi-factor authentication (employee account number and password, dynamic password, one-time password) shall be adopted. Safe channels for remote access shall be established. Log-in shall be restricted to company employees only. Operation of equipment shall be fully tracked in writing. Regulations governing the hours that access is available shall be prescribed subject to the schedule of the employees’ performance of duties.
    6. Firewalls shall be set up against malicious or unauthorized connection. Rules shall be established in accordance with the principle of least privilege. Non-essential ports shall be closed. Network traffic and warning and disconnection mechanisms shall be monitored.
    7. Functions of the work-from-home system shall be designed with differential levels of control, with settings configured to permit the lowest level of authority. Authorization for non-essential functions of the system shall be disabled. The system shall apply differential management by user. Users of work-from-home computers shall be granted differential authorization for use in accordance with the risk policy of the company. Work-from-homers may be authorized to use functions necessary for conducting business only.
  5. Prevention of conflicts of interest and violations of rules and regulations
    1. To ensure confidentiality of trading information, a work-from-homer must conduct business in an independent instead of public space, with no one allowed in the independent space during trading hours.
    2. A work-from-homer must properly retain all transaction related records as requested by competent authorities, the TWSE, and the company.
    3. The company shall appoint a senior officer as chief supervisor responsible for implementing relevant monitoring measures during trading hours.
  6. The work-from-home procedures of a securities firm shall be included in the scope of internal audit and internal control. Internal control systems shall also be strictly enforced.