Newsletter
Potential Impact on Telecommunications Industry and Digital Economy Industry of the Draft "Fraud Crime Harm Prevention Act" announced by Taiwan's Executive Yuan
To prevent and combat the harm of fraud, Taiwan's Executive Yuan passed the draft " Fraud Crime Harm Prevention Act" ("Draft Act") on May 9, 2024, along with the accompanying draft "Technology Investigation and Protection Act", the amendment draft to the "Money Laundering Control Act", and the amendment draft to the "Communication Security and Surveillance Act", and submitted them to the Legislative Yuan for deliberation.
The key points of the Draft Act and the highlights of the related discussions focus on the anti-fraud mechanism, which aims to prevent fraud and scams at their sources. This mechanism is introduced in Chapter 2 of the Draft Act and includes three parts of anti-fraud measures: financial anti-fraud measures (taken by financial institutions and virtual asset service providers), telecom anti-fraud measures (taken by the telecommunications industry), and digital economy anti-fraud measures (taken by online advertising platform operators, third-party payment service providers, e-commerce operators, and online gaming operators).
Once the Draft Act is formally passed by the Legislative Yuan, the compliance costs for the specific industries would increase accordingly. This article focuses on the important provisions of "telecom anti-fraud measures" and "digital economy anti-fraud measures", which are summarized as follows:
1. Telecom Anti-Fraud Measures (Taken by the Telecommunications Industry)
The key points of the anti-fraud obligations imposed by the Draft Act on the telecommunications industry under the supervision of the National Communications Commission ("NCC") are as follows:
(1) User identity verification and registration mechanism: When users apply for and sign contracts, transfer services, or are suspected of using telecommunications services for fraudulent activities as notified by judicial police authorities, the telecommunications companies shall implement user identity verification or re-verification and registration. Upon receiving a notification from judicial police authorities of fraudulent use of telecommunications services, the telecommunications companies shall restrict or cease to provide related services and re-verify and register the user's identity. When conducting user identity verification, telecommunications companies shall interface with the database designated by the NCC. For high-risk users applying for telecommunications services, the telecommunications companies shall limit the number of applications (Articles 15 to 19, Article 23 of the Draft Act).
(2) Management of international roaming services by high-risk overseas telecommunications companies and prepaid cards for non-nationals: For international roaming services provided by high-risk overseas telecommunications companies and prepaid cards for non-nationals, the telecommunications companies shall verify user identity and immigration status through database interface (Articles 19, 20, 22 of the Draft Act).
(3) Suspension of international roaming service to specific numbers: Upon receiving a notification from the NCC or judicial police authorities, if the specific telecommunications services provided by overseas telecommunications companies are suspected of violating Taiwan laws, the telecommunications companies shall suspend international roaming services to specific numbers under those services (Article 21 of the Draft Act).
2. Digital Economy Anti-Fraud Measures (Taken by Online Advertising Platform Operators, Third-Party Payment Service Providers, E-commerce Operators, and Online Gaming Operators)
The key points of the anti-fraud obligations imposed by the Draft Act on digital economy industries under the supervision of the Ministry of Digital Affairs ("MODA") are as follows:
(1) Online Advertising Platform Operators: The Draft Act defines online advertising platform operators as the operators hosting end-user online platforms that allow the public to directly access advertisements (including domestic and offshore online advertising platform operators) and providing services for posting or pushing advertisements through their online platforms or advertising placements. Only those operators that reach a certain business scale will be regulated ("Regulated Advertising Operators"), and their main anti-fraud obligations include:
a. Offshore Regulated Advertising Operators to report a local legal representative to assist in compliance with anti-fraud obligations: Offshore Regulated Advertising Operators that have yet to establish a presence in Taiwan shall designate and report a local legal representative (such as a natural person, a legal entity, a lawyer or law firm, or an accounting firm) to the MODA to assist in compliance with anti-fraud obligations (Article 29 of the Draft Act). Failure to report may result in penalties and measures ordered by the MODA, such as suspending or restricting access to the relevant domains (Article 39 of the Draft Act).
b. Information disclosure, identity verification of advertisers and funders, and establishment of anti-fraud plans and transparency reports: Necessary information shall be disclosed on advertisements, such as information about advertisers and funders, and use of deep fake technology or AI-generated personal images. Regulated Advertising Operators shall also verify the identity of advertisers and funders through digital signatures, Fast Identity Online (FIDO) or other technologies, and establish anti-fraud plans and transparency reports (Articles 30 and 31 of the Draft Act).
c. Takedown and reporting of fraudulent advertisements: Regulated Advertising Operators shall takedown, restrict access to, or cease displaying fraudulent advertisements, and temporarily suspend the services to fraudulent users on its own initiative or upon receiving a notice from judicial police authorities, the MODA or other competent authorities. Additionally, Regulated Advertising Operators shall report information about advertisers and funders and fraudulent communication information in the advertisements to judicial police authorities (Article 32 of the Draft Act). Failure to takedown or suspend provision of services may result in penalties and measures ordered by the MODA, such as network traffic control, or even suspending or restricting access to the relevant domains (Article 39 of the Draft Act).
d. Takedown of fraudulent online content and cooperation with criminal investigations: Regulated Advertising Operators shall restrict access or take down fraudulent online content upon receiving a notice from judicial police authorities or competent authorities. Additionally, they shall retain user and usage-related data, and provide relevant information within 3 days of receiving a notification from a court, prosecutor's office, or judicial police (Articles 33 and 37 of the Draft Act).
(2) Third-Party Payment Service Providers:
a. Anti-fraud measures: Third-party payment service providers shall strengthen customer identity verification procedures against users suspected of involving in fraudulent crimes, and may take control measures such as continuous review/verification of customer identity, deferring payments, refusing to establish business relationships or provide services, and use joint defense systems to notify industry peers (Article 34 of the Draft Act).
b. Record keeping and reporting: Third-party payment service providers shall retain the data and transaction records obtained from the customer identity verification process, and may report to judicial police authorities. Upon receiving such reports, the judicial police authorities shall notify the third-party payment service providers within a reasonable period in relation to the subsequent control or release of control on the aforementioned deferred payments. (Article 35 of the Draft Act).
(3) E-commerce and Online Gaming Operators:
a. Anti-fraud measures: E-commerce and online gaming operators shall fulfill the duty of care as a good administrator, prevent fraud, and, upon notification from judicial police or competent authorities, cooperate in suspending services to fraudulent users, and may use joint defense systems to notify industry peers (Article 36 the Draft Act).
b. Retention and provision of information for criminal investigations: E-commerce and online gaming operators shall retain user and usage-related data, and provide relevant information within 3 days of receiving a notification from a court, prosecutor's office, or judicial police (Article 37 of the Draft Act).
The Draft Act has passed the first review by the Internal Administration Committee of the Legislative Yuan on June 5, 2024. Based on the amendments passed in the first review, the maximum fine for failure to report a local legal representative by an offshore Regulated Advertising Operator or failure to remove fraudulent advertisements or suspend services has been increased from the originally proposed NT$25 million to a maximum of NT$100 million.
Given the importance and tight scrutiny of the Draft Act by the ruling party and the opposition, relevant operators likely to be regulated should conduct impact assessments and take measures in response to the related anti-fraud obligations.