The Fintech Landscape

1.1   Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?

Taiwan’s industries are actively exploring the application of fintech. In terms of the financial sector, according to a May 2023 survey by the Financial Supervisory Commission (“FSC”), 36% of financial institutions have integrated artificial intelligence (“AI”) into their operations, including intelligent customer service, robo-advisors, risk management, regulatory compliance, image recognition, process automation and data analytics.

Meanwhile, other sectors are also continuously seeking business opportunities related to fintech. The types of businesses that have drawn government attention due to their expanding development include Virtual Asset Service Providers (“VASPs”), third-party payment service providers, peer-to-peer lending platforms and Buy Now, Pay Later services.

One area of particular note is that the FSC has recently been strengthening its supervision of VASPs through the following key measures:

1. Implementation of the VASP Registration Regulations

Effective since November 30, 2024, VASPs are prohibited from offering regulated virtual asset services unless they have completed Anti-Money Laundering (“AML”) registration according to the amendment of the Money Laundering Control Act and the implementation of the Regulations Governing Anti-Money Laundering Registration of Enterprises or Persons Providing Virtual Asset Services (“VASP Registration Regulations”). Entities in violation may face penalties of up to NT$50 million or two years’ imprisonment, depending on their legal form.

VASPs that previously completed the AML declaration must finalise their AML registration with the FSC no later than September 30, 2025 to continue operating legally.

Under the VASP Registration Regulations, VASPs are categorised into five types:

• Virtual Asset Exchangers.
• Virtual Asset Trading Platforms.
• Virtual Asset Transferors.
• Virtual Asset Custodians.
• Virtual Asset Underwriters.
• The VASP Registration Regulations establish general compliance requirements applicable to all VASPs while also imposing differentiated legal obligations based on the specific services each VASP provides.

Specifically, all VASPs must operate in accordance with laws, articles of association, internal control systems and self-regulatory codes set by the VASP Association.  They are also required to implement appropriate information security management systems and customer complaint handling procedures, as well as comply with disclosure obligations and record-keeping requirements.

Regarding differentiated legal obligations, Virtual Asset Custodians are, for example, subject to specific requirements, including:

• Segregating customer assets from their own assets.
• Establishing and publishing clear custody policies and procedures.
• Maintaining records related to customer assets.
• Conducting periodic reconciliations of customer assets by engaging external auditors.

2. Creation of the VASP Association and Issuance of the Self-Regulatory Codes

To further strengthen oversight and promote industry self-governance, the VASP Association was officially established in June 2024.  According to the VASP Registration Regulations, VASPs must become members of the VASP Association before commencing business operations and must comply with the self-regulatory codes.

Between November 2024 and January 2025, the association issued seven self-regulatory codes, including:

• Code of Conduct for Members of the VASP Association.
• Self-Regulatory Codes for Virtual Asset Listing and Delisting.
• Customer Protection Self-Regulatory Codes.
• Self-Regulatory Codes for Anti-Money Laundering and Counter-Terrorism Financing.
• Self-Regulatory Codes for Anti-Fraud and Industry Collaboration Mechanisms.
• Cyber Security Management Self-Regulatory Codes.
• Asset Segregation and Custody Self-Regulatory Codes.

1.2   Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?

If the specific services of fintech businesses involve regulated services, such as accepting deposits or engaging in foreign exchange, the appropriate licences must be obtained before such operations can begin. Failure to do so may result in criminal liability. Furthermore, financial institutions that have already obtained the necessary licences must operate within the scope of their authorisation and are subject to strict supervision by the FSC.

Historically, the FSC has taken a cautious stance towards cryptocurrency-related services. For example, in January 2014, the FSC issued a press release stating that financial institutions, such as banks, are prohibited from accepting or exchanging Bitcoin, as well as from offering Bitcoin-related services at ATMs. However, more recently, the FSC has signalled a more progressive approach by exploring pathways for licensed financial institutions to participate in the virtual asset ecosystem. Notable developments include the following:

• Exchange-Traded Fund (“ETF”) Sub-Delegation Businesses

On September 30, 2024, the FSC announced that professional investors may invest in foreign virtual asset ETFs through sub-delegation.  Securities firms must confirm the client’s professional investor status and evaluate their understanding of virtual assets before their initial investment. The policy has gained positive industry feedback, with the first firm launching over 70 US virtual asset ETFs on December 24, 2024, providing professional investors access via sub-delegation.

• Custody Businesses

On November 28, 2024, the FSC announced that financial institutions can apply for a virtual asset custody business trial between January and April 2025. Required documents include custody models, compliance policies, security frameworks, customer service plans and other relevant documents. Currently, at least five financial institutions are interested in applying for this business trial.

• Stablecoin Issuance Businesses

On February 13, 2025, the FSC hosted a forum to discuss the draft Virtual Asset Service Act.  The event was attended by representatives from the Central Bank, the VASP Association, industry experts, scholars and other relevant organisations. One of the key discussion topics was the “Issuance of Stablecoins”.  According to the FSC’s proposal, the draft may allow banks to act as issuers of stablecoins. Under the draft, the issuer would be required to meet specific qualification criteria, maintain adequate reserve assets, undergo regular audits and fulfil disclosure obligations to ensure market transparency.

2    Funding For Fintech

2.1   Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?

Common corporate fundraising sources include capital increases, bank financing and bond issuance. Additionally, the Taiwan government provides subsidies or loans for SMEs and startups that meet specific criteria. For more details regarding the subsidies or loans, please refer to the website of the Small and Medium Enterprise and Startup Administration, Ministry of Economic Affairs: https://startup.sme.gov.tw/home/modules/rproject.

2.2   Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?

To encourage enterprise or venture capital (“VC”) investment in startups, from January 1, 2017, to December 31, 2029, a VC structured as a limited partnership that meets certain criteria and invests a specified amount and proportion in startups may apply to adopt the Fiscally Transparent Principle for up to 10 years from its establishment. Under this principle, the VC is exempt from enterprise income tax, and only its partners are subject to individual income tax.

The term “startup” refers to a company, including both companies incorporated under Taiwan law and foreign companies that actually conduct business operations in Taiwan, that has been established for less than five years at the time the VC acquires its newly issued shares.

2.3   In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?

Taiwan currently has a multi-tiered capital market that provides suitable fundraising channels for companies at different stages of operation.  These include applying for listing on the Taiwan Stock Exchange (“TWSE”) or Taipei Exchange (“TPEx”), as well as registering on the Taiwan Innovation Board or Emerging Stock Board (“ESB”).

For fintech startups with limited capital, registering as an Emerging Stock on the ESB is a relatively accessible IPO pathway.  The key requirements are as follows:

• Entering into an advisory contract with a securities firm and submitting the “Checklist for Financial or Operational Material Event” prepared by the securities firm.
• Obtaining written recommendations from at least two securities firms.
• Engaging a professional shareholder services agent to handle shareholder services.
• Committing to designate independent directors and establish a remuneration committee within six months after registration.
• After trading on the ESB for more than six months and meeting certain thresholds regarding paid-in capital, establishment duration and financial capability, a company may further apply for listing on the TPEx or TWSE.

2.4   Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?

On February 12, 2025, Systex Fintech Corporation was registered on the ESB. The company is the largest point-of-sale terminal provider in Taiwan and offers integrated online and offline payment services. In recent years, it has also expanded into the digital payment sector and is expected to be listed on TPEx later in 2025.

On January 21, 2025, MaiCoin, one of Taiwan’s major cryptocurrency exchanges, announced its plan to submit an application for listing on the TWSE this year.

On September 12, 2023, OwlTing Group announced its acquisition of PayNow INC. to enter the third-party payment industry.

3    Fintech Regulation

3.1  Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.

Taiwan does not currently have a dedicated regulatory regime specific to the fintech sector. However, fintech firms will be subject to regulation if they perform specific regulated activities in Taiwan. This regulation covers traditional financial services such as banking, securities and insurance, as well as fintech-related activities like electronic payments and virtual assets. Any firm seeking to engage in regulated activities in Taiwan must apply to the FSC for appropriate licences. Upon obtaining the licences, these firms will need to comply with additional laws and regulations published by the FSC.

3.2   Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?

The FSC has expressed continued support for responsible fintech innovation, emphasising that this must occur within the compliance framework. Recently, there have been signs of regulatory relaxation for certain sectors (see question 1.2).

Additionally, under the Financial Technology Development and Innovative Experimentation Act, fintech businesses can apply to test the feasibility of innovative ideas through a sandbox and work with regulators to explore the necessity of adjustments to existing regulations. For example, to lower the investment barriers for foreign bonds, Joinvest Co., Ltd. launched a bond group-buying platform and was approved to enter the sandbox in 2021. Following the sandbox experiment, the FSC concluded that it was innovative and contributed to financial inclusion. As a result, the FSC reviewed and amended relevant financial regulations based on the findings from the experiment. Consequently, in January 2025, the FSC announced draft amendments to three regulations, including the “Standards Governing the Establishment of Securities Firms”.  The key changes include:

• Allowing securities dealers to operate new types of business (i.e. the buying and selling of certain foreign bonds).
• Lowering the minimum paid-in capital requirement for securities dealers engaged only in the aforementioned business from NT$400 million to NT$100 million.

3.3   What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?

As explained in questions 1.2 and 3.1, regardless of whether the entity is foreign or domestic, if its fintech services in Taiwan involve regulated activities, it must obtain appropriate licences from the FSC. Additionally, before a foreign entity makes an investment in Taiwan (e.g. establishing a company or branch, acquiring shares or contributing capital to a Taiwanese company), it must apply for investment approval from the Department of Investment Review.

3.4   How is your regulator approaching the challenge of regulating the traditional financial sector alongside the regulation of big tech players entering the fintech space?

Given the increasing reliance of traditional financial institutions on technology, to control related risks, the FSC announced the “Guidelines for the Use of AI in the Financial Industry” in June 2024.  The key requirements are as follows:

• Establish Governance and Accountability Mechanisms: Financial institutions may establish a mechanism for third-party review and evaluation as necessary after assessing the risks, resources and expertise associated with their AI systems.
• Emphasise Fairness and Human-Centred Values: If financial institutions use generative AI developed by a third party and cannot control the training process and ensure that the data or calculation results are fair, the financial institutions must appoint their personnel to objectively and professionally manage the risks of the information the AI produce.
• Protect Privacy and Customer Interests: Financial institutions must adopt the “data minimisation principle” to avoid collecting excessive or unnecessary information.
• Ensure Transparency and Explainability: Financial institutions must understand how their “self-developed or commissioned AI systems” operate, as well as the logic behind their predictions or decision-making processes.
• For big tech players entering the fintech space, if their services involve regulated activities, they must obtain appropriate licences from the FSC.

4    Other Regulatory Regimes / Non-Financial Regulation

4.1   Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?

The Personal Data Protection Act (“PDPA”) is the primary law governing the protection of personal data. According to Article 2, Paragraph 1 of the PDPA, “personal data” refers to a person’s name, date of birth, ID number, passport number, physical characteristics, fingerprints, marital status, family information, educational background, occupation, medical records, healthcare data, genetic data, sexual life, records of physical examination, criminal records, contact information, financial status, social activities, and any other information that may be used to directly or indirectly identify a natural person. Entities must comply with the PDPA and other relevant regulations when collecting, processing and using personal data.  The key requirements are as follows:

(1)    Clear Notification Upon Collection: According to Article 8 of the PDPA, when collecting personal data, entities must clearly inform data subjects about the collector’s name, the purpose of collection, the categories of data being collected, and the period, region, targets and method of use.

(2)    Specific Purpose and Consent Requirement: Entities must collect or process personal data for a specific purpose and obtain the data subject’s consent. In certain exceptional situations under Article 19 of the PDPA, such as when there is a contractual relationship and appropriate security measures are adopted, data may be collected or processed without explicit consent.

(3)    Appropriate Security Measures: Under Article 27 of the PDPA, entities that hold personal data files are required to adopt adequate security measures to prevent personal data from being stolen, altered, damaged, destroyed or leaked. If fintech businesses operate within any industry related to the digital economy or the financial sector, or operate other designated business types (as detailed below), they must additionally comply with the Regulations Regarding the Security Maintenance and Administration of Personal Data Files (“Personal Data Files Regulations”) established by the competent authorities.

Digital economy-related businesses, including e-commerce, software publishing, computer programming/consulting services, data processing, third-party payment and other digital economy-related businesses, must comply with the Personal Data Files Regulations set by the Ministry of Digital Affairs (https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=K0010162).

Financial sector businesses, including financial holding companies, banking, securities, futures, insurance, electronic payment institutions, and other financial service providers designated by the FSC, must comply with the Personal Data Files Regulations set by the FSC (https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=G0380233).

For other industries designated to comply with additional Personal Data Files Regulations, please refer to the following link: https://www.pdpc.gov.tw/CP/130.

4.2   Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?

• The Application of the PDPA

The PDPA applies to foreign entities that collect, process or use personal data within Taiwan.

• Cross-Border Data Transfer Restrictions

Cross-border transfers of personal data are generally permitted in Taiwan, but – pursuant to the PDPA – there are restrictions in specific cases. Under Article 21 of the PDPA, such transfers may be restricted if they:

• Endanger national security.
• Violate international treaties or agreements.
• Involve recipients in jurisdictions with inadequate data protection.
• Attempt to circumvent the application of the PDPA.
• Notably, restrictions have primarily been applied to telecommunication businesses, social work offices and businesses in the human resources recruitment industry with regard to transferring personal data to China.

4.3   Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.

Entities violating the PDPA may be subject to civil, criminal and administrative liabilities, as outlined below:

• Civil Liability

If an entity fails to comply with the PDPA, resulting in the unlawful collection, processing or use of personal data, or infringement of an individual’s rights, it shall be liable for damages to the affected party (Articles 28 and 29 of the PDPA).

• Criminal Liability

If an entity collects, processes or uses personal data in violation of the PDPA, with the intent of obtaining unlawful gains for itself or a third party or impairing another person’s interests, causing damage to others, it shall be subject to imprisonment of up to five years and a fine of up to NT$1 million. Other criminal liabilities for PDPA violations are detailed in Articles 41 to 46 of the PDPA.

• Administrative Liability

An entity that fails to establish a personal data security maintenance plan as required by the competent authorities may be fined between NT$20,000 and NT$2 million. In severe cases, fines range from NT$150,000 to NT$15 million. If the violation is not corrected within the prescribed period, additional fines ranging from NT$150,000 to NT$15 million may be imposed for each instance of non-compliance.  Other administrative liabilities for PDPA violations are detailed in Articles 47 to 50 of the PDPA.

4.4   Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?

Fintech businesses must comply with relevant cyber security regulations based on their respective industries. For example, digital economy-related industries that collect, process or use personal data through information and communications systems must adhere to the key requirements, including but not limited to:

Implementing appropriate and necessary encryption measures when collecting, processing or using personal data.

Establishing and regularly updating countermeasures against external cyber intrusions, such as firewalls, email filtering or other intrusion detection systems.

For network-connected information and communications systems storing personal data, continuously updating and maintaining antivirus software and conducting regular malware scans.

4.5   Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.

Fintech businesses must comply with the applicable AML regulations based on their respective industries. Currently, in addition to traditional financial institutions (including electronic payment service providers), leasing companies, VASPs and other designated businesses or professionals (such as lawyers and accountants) are also subject to AML regulations. Taking VASPs as an example, the following are the AML regulations they are required to follow:

• The AML Requirements

Since 2021, Taiwan has incorporated VASPs into its AML framework through the implementation of the Regulations Governing Anti-Money Laundering and Countering the Financing of Terrorism for Enterprises or Persons Providing Virtual Asset Services. The key provisions of these regulations include conducting customer due diligence (“CDD”), refusing to engage in business relationships or transactions with suspicious customers, filing suspicious transaction reports and establishing necessary risk management mechanisms.

• The AML Registration Regulations

VASPs must apply to the FSC and complete the registration before they are allowed to operate virtual asset-related services. For more details, please refer to question 1.1.

4.6   Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction (for example, AI)?

In July 2024, Taiwan announced the implementation of the Fraud Crime Hazard Prevention Act, which imposes fraud prevention obligations on financial institutions, VASPs, telecommunication businesses, online advertising platforms, third-party payment service providers, e-commerce businesses and online gaming operators. For VASPs, the key requirements they must follow include:

·         Strengthening the CDD process for abnormal accounts suspected of being involved in fraud. Subsequent measures may include suspending all or part of the transaction functions of the account or declining to establish business relations. Relevant records of CDD and transactions must be maintained. When performing these requirements, inquiries may be made with other VASPs. The queried party is required to offer the relevant information.

·         Collaborating with law enforcement agencies to establish a joint defence reporting system, placing reported funds or virtual assets under freeze, and continuously monitoring them.

·         Under specific conditions, returning remaining funds or virtual assets in accounts with suspended transaction functions to the victims.

For details on AI-related regulations, please refer to question 3.4.

5    Technology

5.1   Please briefly describe how innovations and inventions are protected in your jurisdiction.

Taiwan offers comprehensive legal protection for intellectual property (“IP”) through multiple statutes, including the Copyright Act, Trademark Act, Patent Act, Trade Secrets Act, Plant Variety and Plant Seed Act, and the Integrated Circuit Layout Protection Act.

Overview of core IP protections:

Copyright protects literary, scientific, artistic or other intellectual creations. Authors obtain copyright upon the completion of their works, which remains valid for the duration of their lifetime plus 50 years after their death.

Trademarks follow a registration-based protection approach. Trademark rights are granted upon public announcement of the registration and are valid for 10 years. A renewal application may be filed within six months before or after the expiration date, with a double registration fee required if filed after the expiration.

Patents require a completed application for protection. The duration varies by patent type: invention patents last 20 years from the application date, while utility model and design patents last 10 and 15 years, respectively.

Trade secrets protect confidential business methods, techniques, processes, formulas, programs, designs and other commercially valuable information. To qualify for protection under the Trade Secrets Act, the information must:

Not be known to the individuals generally involved in the relevant field.

Have actual or potential economic value due to its secrecy.

Be subject to reasonable confidentiality measures by the owner.

5.2   Please briefly describe how ownership of IP operates in your jurisdiction.

Regarding copyright ownership, the economic rights of a work generally belong to its creator. However, in an employment relationship, if an employee creates a work within the scope of employment, the employee is considered the author, but the economic rights belong to the employer. Nonetheless, the parties may contractually agree to designate the employer as the author or specify ownership of the economic rights.

For trademark and patent rights, ownership is determined through a registration and application process, and the rights holder can be verified using the search system of the Taiwan Intellectual Property Office (“TIPO”). Notably, for patent rights, the patent applicant is, in principle, the inventor, creator of a utility model or designer. However, in an employment relationship, unless otherwise agreed in a contract, the right to apply for a patent and the resulting patent rights for an invention, utility model or design created as part of an employee’s job duties belong to the employer, who must provide the employee with appropriate remuneration. Conversely, if an invention, utility model or design is created outside the employee’s job duties, the right to apply for a patent and the patent rights belong to the employee. However, if the invention was developed using the employer’s resources or expertise, the employer may use it within its business upon paying the employee reasonable compensation.

5.3   In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?

Exercising trademark or patent rights in Taiwan requires filing an application and obtaining the respective rights locally.

As a member of the World Trade Organization, Taiwan adheres to the Agreement on Trade-Related Aspects of Intellectual Property Rights, which establishes protection standards for copyrights, patents, trademarks, geographical indications, industrial designs, integrated circuit layout designs and trade secrets.

However, Taiwan is not a member of the World Intellectual Property Organization or the United Nations Educational, Scientific and Cultural Organization.  As a result, international agreements such as the Patent Cooperation Treaty, the Paris Convention, the Berne Convention and the Universal Copyright Convention do not apply in Taiwan.

5.4   How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?

IP rights holders can exploit or monetise their IP through assignment, licensing or pledging.  Notably, assignments, licences and pledges of patent and trademark rights must be registered with the TIPO; otherwise, they cannot be asserted against third parties.

In principle, IP rights holders have the exclusive right to use their IP and may seek damages against unauthorised infringement. However, the law also requires them to tolerate certain fair uses of their IP in specific circumstances. For example, under copyright law, copyright holders must allow others to quote their published works within a reasonable scope for reporting, commentary, teaching, research or other legitimate purposes. Other types of fair use in copyright law can be found in Articles 44 to 66 of the Copyright Act.

Furthermore, to safeguard the public interest, the exercise of IP rights may be subject to restrictions. For instance, the Patent Act explicitly stipulates that, to promote public welfare or prevent unfair competition, a patent holder may be compelled to grant a licence.