GB/T 42929-2023Technical requirements of intelligent risk prevention and control for Internet finance (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents" Drafting. Please note that some content in this document may be subject to patents. The publisher of this document assumes no responsibility for identifying patents. This document is under the jurisdiction of the National Financial Standardization Technical Committee (SAC/TC180). This document was drafted by: China Internet Finance Association, Alipay (China) Network Technology Co., Ltd., Industrial and Commercial Bank of China Co., Ltd. Company, China Construction Bank Co., Ltd., Postal Savings Bank of China Co., Ltd., Guangdong Huaxing Bank Co., Ltd., China Agricultural Bank of China Co., Ltd., Ping An Insurance (Group) Co., Ltd. of China, Rural Credit Bank Fund Clearing Center Co., Ltd., JD.com Technology Holdings Co., Ltd., 4Paradigm (Beijing) Technology Co., Ltd., Shenzhen Tencent Computer Systems Co., Ltd., Duxiaoman Technology (Beijing) Co., Ltd., Shanghai Qiyu Information Technology Co., Ltd., Oriental Microbank Technology Co., Ltd., Jianjianhui Information Technology (Guangzhou) have Co., Ltd., Bairong Yunchuang Technology Co., Ltd., and Tongdun Technology Co., Ltd. The main drafters of this document. Yang Nong, Zhu Yong, Xin Lu, Shan Jianfeng, Yu Yuan, Zhang He, Peng Jin, Lu Bibo, Wang Weiqiang, Jin Ying, Meng Xianzhe, Wang Xue, He Linfang, Shen Shu, Yang Chun, Liang Jiawen, Guo Feng, Chen Lianghua, Guan Xiaohui, Zou Mingming, Zhang Xu, He Ying, Wang Ming, Zhao Chenglong, Zhang Yumeng, Xu Zehao, Chen Xin, Shen Yun, Chen Peiyao, Xu Xiao, Di Hongming, Yang Xiaowen, Zhang Honglin, Liu Jun, Chen Hewei, Zhao Feng, Dong Jiwei.

With the continuous development of Internet finance, new financial fraud risks based on Internet finance continue to emerge, showing specialization, industry New features such as industrialization, concealment, and cross-region pose challenges to traditional risk prevention and control technologies. To this end, Internet financial business practitioners have proposed Intelligent risk prevention and control technology has been developed to realize intelligent risk prevention and control through the use of big data, artificial intelligence and other technologies. However, there are problems in the actual application process. There are problems such as unclear concepts, disparate technologies, and uneven effects. In order to strengthen financial institutions and non-bank payment machines that carry out Internet financial services Institutions, as well as institutions that provide intelligent risk prevention and control technology services, regulate the use of intelligent risk prevention and control technology to protect the legitimate rights and interests of individuals and financial entities. benefit in developing this document. Technical requirements for intelligent risk prevention and control in Internet finance

1 Scope

GB/T 42929-2023 sets the technical requirements for intelligent risk prevention and control in internet finance. Online lending, payment and wealth management decide in milliseconds, at a volume no human review can touch, which means the risk controls are models rather than rules, and the models fail in ways rules do not: they drift as behaviour changes, they can be probed by an adversary who is also automated, and they discriminate in ways nobody intended. The standard sets the framework for intelligent risk control, the functions - risk monitoring, risk identification and analysis, risk assessment and risk treatment - the technologies behind them including the rules and models and the intelligent analysis and processing, and the security of the risk control system itself, both basic and application security, with an annex on the supervised, semi-supervised and unsupervised machine learning and relationship network methods used. It took effect on 1 December 2023.

This document stipulates the technical framework, functional requirements, technical requirements, and practical requirements that intelligent risk prevention and control technology must meet in the Internet financial scenario. Current safety requirements and operational requirements, etc. This document is applicable to organizations that carry out Internet financial business, as well as the construction and operation of institutions that provide intelligent risk prevention and control technical services. and optimize the intelligent risk prevention and control system to prevent and control Internet financial risks.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 35273 Information Security Technology Personal Information Security Specifications

GB/T 35274 Information security technology big data service security capability requirements

GB/T 37721 Functional requirements for information technology big data analysis systems

GB/T 37722 Information technology big data storage and processing system functional requirements

GB/T 37961 Basic requirements for information technology services

3 Terms and definitions

The following terms and definitions apply to this document.

3.1 Measures and methods taken to effectively control or reduce the possibility of risk events and reduce losses when risk events occur.

3.2 risk identification risk identification The process of comprehensively identifying potential matters or factors that affect the realization of various goals, systematically classifying them, and finding out the causes of risks. Note

1.Risk identification includes the identification of risk sources, events, their causes and potential consequences. Note

2.Risk identification may involve historical data, theoretical analysis, expert opinions and stakeholder needs. [Source: GB/T 42339-2023, 4.3.9, with modifications]

3.3 risk evaluationriskevaluation On the basis of risk identification and risk measurement, combined with other factors, comprehensive consideration is given to the probability of risk occurrence and degree of loss, and the assessment The possibility of risk occurrence and its degree of harm, and compared with recognized safety indicators to measure the degree of risk and decide whether it is necessary to take action The process of taking appropriate measures. [Source: GB/T 42339-2023,4.3.14]

3.4 risk monitoringriskmonitoring Track the development and changes of identified risks, the conditions under which risks arise, and the resulting changes in results, and make timely adjustments based on changes in risks.