Taiwan Regulator Seeks Input on Security Rules for Financial AI Agents

Taiwan’s Financial Supervisory Commission opened a 30-day consultation on security controls for AI agents in finance, proposing risk-based reviews as institutions consider systems that can act across tools and data environments.

The consultation document, released Oct. 13, addresses governance, risk classification and security controls. It describes agents as systems that can plan steps, call tools and access data across systems to carry out tasks.

The proposal makes each application scenario the unit of review. Financial institutions would define the business purpose, responsibilities, accessible data and tools, permitted actions, and destinations for outputs. They would also plan how to respond to abnormal activity, disable an agent and trace its actions.

The proposed classification considers three dimensions: data sensitivity, the impact of an agent’s actions, and the boundaries and potential spread of its capabilities. When those dimensions indicate different levels of risk, the scenario would receive the higher classification. Institutions would use that level to set approval thresholds, testing and launch criteria, control depth and subsequent reviews.

The document treats an agent as a nonhuman identity and applies zero-trust principles, including continuous verification, least privilege and traceability. Its proposed baseline and advanced controls cover identity, runtime environments, networks, applications and workloads, data, behavior, and visibility.

The consultation document would not replace existing laws, supervisory rules, outsourcing requirements or internal controls. The commission plans to use feedback in further policy work, guidance and supervisory discussions. The 30-day comment period began Oct. 13.