JR/T 0199-2020General Specification for Fintech Innovation and Security (English PDF)

5.1 Transaction verification

a) Transaction verification can combine the following 3 types of elements.

--Elements that are only known to the customer;

- Elements that are only held by the customer and unique, and cannot be copied or reused;

--The biological characteristics of the customer.

b) The use of transaction verification elements shall meet the following requirements.

--Should ensure that the elements used are independent of each other, that is, damage or leakage of some elements should not cause damage or leakage of other elements dew;

--Strictly restrict the use of initial transaction passwords and prompt customers to modify them in time, establish a transaction password complexity verification mechanism, and avoid the transaction-free password is too simple (such as "111111", "123456", etc.) or is related to personal financial information (such as date of birth, ID number, mobile phone number, etc.) are too similar;

--Where digital certificates and electronic signatures are used as authentication elements, the digital certificates and the process of generating electronic signatures shall comply with the relevant Laws and regulations, JR/T 0118-2015 and other relevant regulations to ensure the uniqueness, integrity and resistance of transactions Dependent - If a one-time password is used as a verification element, the one-time password acquisition end and the transaction instruction initiation end should be prevented from being the same the risks caused by the same physical equipment, and the one-time password validity period is strictly limited to the shortest necessary time;

- If the customer's biometrics is used as the verification element, it shall comply with national and financial industry standards and relevant information security management Management requirements to prevent illegal storage, copying or replay;

--Technical measures that match the transaction verification strength and the transaction amount should be taken to improve the security of the transaction;

--Should go through customer confirmation and transaction verification. Transaction verification should use two of the above three types of elements at the same time.

The corresponding risk compensation measures shall be taken for those in the second category.

5.2 Transaction confirmation

Transaction confirmation should meet the following requirements.

a) Effective measures should be taken to ensure that customers can confirm transaction information such as transaction content and transaction amount before executing transaction instructions, and after the transaction instruction is completed, the transaction information will be displayed or the customer will be notified of the result in time.

b) The authenticity, completeness, traceability and consistency of the transaction information shall be ensured, and shall not be tampered with or hidden Hidden transaction information.

c) Reliable technical means such as static passwords, dynamic passwords, digital certificates, etc. should be used to realize the self-confirmation to ensure the user's knowledge Rights, property security rights and other legal rights.

5.3 Transaction monitoring

5.3.1 Establishment of transaction monitoring system

Fintech innovation institutions should establish an effective transaction monitoring system to meet the following requirements.

a) A transaction monitoring system should be established to identify and warn transactions with potential risks, and generate risk monitoring reports.

b) A risk transaction model should be established according to the risk characteristics of the transaction, suspicious transactions should be effectively monitored, and reports, review, and review of suspicious transactions should be established.

Check mechanism.

c) Big data analysis, customer behavior modeling and other means should be used to establish transaction risk monitoring models and systems, and conduct monitoring of abnormal transactions.

Early warning, and take measures such as investigation and verification, risk warning, and delayed settlement.

d) The risk assessment model should be continuously optimized through transaction behavior analysis, machine learning, etc., to increase the success rate of fraudulent transaction interception, and reduce errors.

Judgment rate, and effectively improve transaction security protection capabilities.

5.3.2 Transaction risk identification

Fintech innovation institutions should support the knowledge of fraud risks and compliance risks...