We appointed the Corporate Governance and Nomination Committee that is under the direct management of the Board of Directors as the dedicated unit for ethical management to be in charge of the establishment, supervision, and implementation of the ethical management policy. The regulatory compliance and corporate governance unit under the direct management of the President shall assist the Corporate Governance and Nomination Committee to promote and execute the ethical management policy. The compliance status of the ethical management shall be reported to the Board of Directors every year. Relevant personnel are given regular training to deliver the concept of the ethical management and cultivate corporate culture of ethical management.

To ensure the corporate culture of ethical management and its sound development as well as the establishment of good business operating structure, the Company formulated “Ethical Corporate Management Best Practice Principles” and “Operating Procedures for Ethical Management and Conduct Management Policy” through the resolution by the Board of Directors to prohibit all forms of unethical behaviors, including improper gifts or hospitality. We also formulated “Methods Governing Gifts and Hospitality” to restrain our employees receiving gifts or hospitality. Anyone who receive gifts or hospitality with a value over NT$3,000 or unable be to evaluated objectively should declare it to HQ Regulatory Compliance Office. Besides, we established diverse whistleblowing channels. Anyone who has objective evidences for reasonably believing our employees may involve crime, fraud, or violation of laws when performing their duty is welcomed to submit a complaint. Investigation on HQ and branch companies shows there is no fraud, insider trading, anti-competitive behavior, anti-trust behavior, incidents related to ethical management in the market operated in 2023.

All the Company’s directors and office and field personnel signed the declaration of complying with the ethical management policy, and we also requested contractors to sign on the “letter of integrity commitment”. We also established a conflict of interest prevent mechanism for domestic equity product investment. The relevant personnel for domestic equity product investment shall ensure the business is conducted based on the interest of customers as well as fully perform the principles of honesty and integrity to avoid any behaviors that conflict with our investment profits or other behaviors that are unfavorable to the Company’s business reputation or interest. Relevant personnel are required to sign the declaration letter. The directors in the Company all signed the letter.

To implement information security management, the Company formulated “Information Security Policy” and “Information Security Code of Conduct” as well as established intrusion prevention system, network firewall, website content filter, endpoint protection, email audit, log management, and database auditing management system for information security control. Abnormal incidents detected will be investigated, and its cause, scope of impact, and handling measures shall be recorded on the “abnormal incident analysis report” and be reviewed and checked regularly every month. In 2019, the company also completed an “information Security Governance Maturity Assessment”.Besides, we introduced ISO27001 Information Security Management System and BS10012 Personal Information Management System and conduct information security assessment regularly every year to fulfill workplace information security and personal data protection and reduce the risk of sensitive information disclosure.

By the end of 2023, the pass rate of training received by all employees was 100%. The content of training included concept of information security protection, information security topics and strategies for remote work, personal data protection and information disclosure, IoT information security and protective measures, and social engineering prevention. We conduct email social engineering exercise every quarter, personnel failed to pass the exercise will be provided training to enhance their awareness on email security risks. In 2023, the average open rate was 3.74%. It was higher than that in 2022. For units exceeded the standard, we have requested the manager at the department to strengthen the promotion. Besides, we provided content of training on social engineering recognition through information security e-newsletters and annual information security training to reinforce information security awareness. To encourage and cultivate information personnel with diverse specialty, our information security dedicated personnel obtained 17 international information security certificates in 2023.

The Company introduced a personal information management system under the consideration of complete operating procedures for collecting, handling, and using personal data of our policy holders. In 2023, we passed the verification of BS 10012:2017 Personal Information Management System (PIMS) again. The scope of verification covers the whole company (including HQ, branch companies, service centers, regional divisions, and communication offices). We offer “personal data protection legal regulation promotion training” at least once every year to ensure data to be well-protected.
In terms of customer privacy protection and control mechanism, we reduce risks of personal data disclosure through network & email personal data filtering protection system and USB control mechanism. By personal information management system (PIMS) certification, introduction of the personal information management system to all departments and branch companies, and environmental inspection and educational training conducted at 33.3% of communication offices, employees’ awareness on personal data protection is strengthened. We conduct exercise on regular personal information security procedures, host activities of workplace environmental inspection, and strengthen the external control mechanism to lower the risks of sensitive information disclosure. Moreover, a third-party fair institution is entrusted to test our mobile device APP to ensure its security and reduce information security risks.

We set up a Money laundering Prevention Department to focus on anti-money laundering and antiterrorism financing and established “Mercuries Life Insurance Money laundering Evaluation and Terrorism Financing Risk Policy”, “Mercuries Life Insurance Notice for Money laundering Prevention and Countering Terrorism Financing”, and “Mercuries Life Insurance Operating Procedures for Money laundering Prevention and Countering Terrorism Financing”. These regulations comprise our internal control system in money laundering prevention and countering terrorism financing, and the content covers how the Company identifies and evaluates risks of money laundering and terrorism financing in each business, the establishment of policies, procedures and controls related to money laundering and terrorism financing risks to fully implement each step of the money laundering prevention procedures, and regular discussion to enhance the efficiency of money laundering prevention and the countering of terrorism financing. In 2023, we completed optimization of the anti-money laundering system items, including facing up the substantial influence of resigned politically exposed persons, adjusting logics of list collection for the systematic risk database as well as taking reference to 2021 National Money Laundering, Terrorism Financing and Proliferation Financing Risk Assessment Report to update the threat level of involvement with the crime of money laundering, adjust classification regulations for system lists, add a column for crime information, and, at the same time, revise the scope of interpretation of list of negative newsmaker categories provided by the business and human resource units in order to verify the names of new and on-the-job employees and strengthen the prevention of unethical behaviors among sales representatives.