JR/T 0200-2020Financial technology innovation risk monitoring regulations (English PDF)

5.1 Overview

Financial technology innovation risk monitoring is mainly through data collection and correlation analysis of financial technology innovation applications, etc., to identify and discover possible Existing security incidents and risks are displayed and warned, to grasp the risk situation of financial technology applications, and to ensure the safety and stability of financial technology applications Operation to protect the legitimate rights and interests of consumers. The financial technology innovation risk monitoring framework is shown in Figure 1.

Figure 1 Risk monitoring framework for fintech application

5.2 Monitoring objects and content

5.2.1 Monitoring object

It mainly covers the business system, API, SDK, APP, etc. of financial technology innovation institutions (hereinafter referred to as innovation institutions).

5.2.2 Monitoring content

The monitoring content mainly includes personal financial information protection, financial transaction security, business continuity, service quality, technology use security, Internal control management, network security, complaints, public opinion, etc.

5.3 Basic principles

5.3.1 Principles of safety and control

Risk monitoring and prevention and control should be carried out in accordance with the principle of safety and control, to ensure that the risks of systems and services are controllable, and to respond to threats and risks in advance.

Plan for the disposal of risks.

5.3.2 Open sharing principle

According to the principle of open sharing, risk information reporting and risk data sharing should be carried out.

5.3.3 Privacy protection principle

In accordance with the principle of privacy protection, effective measures should be taken for the privacy information of individuals or financial transactions that may be involved in the risk monitoring process.

Security protection measures to ensure that private information is not leaked.

5.3.4 Principles of Disclosure and Supervision

In accordance with the principles of disclosure and supervision, actively disclose system and application risks, publish reports on a regular basis, actively accept supervision, and ensure that the system and the application runs safely.

6.1 Basic requirements

Innovative institutions shall accept the risk monitoring of monitoring institutions in accordance with this document, and conduct risk disposal in accordance with the requirements of regulatory agencies and self-regulatory organizations.

The monitoring process includes data collection, data analysis, risk warning, risk treatment, and information sharing.

During the risk monitoring process, all participants should take technical measures to ensure data security storage, access control, and sensitive information desensitization.

Data is safe throughout its entire life cycle.

6.2 Data collection

The monitoring organization shall classify the monitoring objects, clearly define the type, interface and communication method of data collection, and collect monitoring data for Data analysis provides source data, including.

a) Unified data collection interface.

b) Standardize the data.

6.3 Data analysis

The monitoring agency should clarify the analysis purpose and select the appropriate data analysis tool according to the technical and business risk prevention requirements of the monitored object and methods for data analysis and processing, including.

a) Select data, perform feature extraction, establish, train, and optimize analysis models, and calculate analysis results.

b) Verify the analysis process and results, format the output, and generate analysis reports.

6.4 Risk warning

The monitoring agency should identify the type of risk and the severity of the impact based on the results of data analysis, determine the level of early warning, and trigger the early warning.

The body includes.

a) Classified according to the types of monitoring objects of early warning.

b) Classified according to the trigger reason of the warning, including but not limited to system vulnerabilities, virus Trojan horses, phishing websites, suspicious activities, Scan detection, denial of service, authentication/authorization/access alarms, such as database collision, botnet, etc.

c) Display of visual reports for early warnings, including but not limited to the status, events, early warning information, and event intervals of the monitored object the relationship and so on.

d) Early warning methods include, but are not limited to, SMS, email, instant messaging, in-site messaging, and push of interconnection interfaces between systems, etc.

6.5 Risk treatment

Innovative institutions should deal with risks in a timely manner, including.

a) In response to system-level risks, timely measures are taken to deal with risks.

b) For process management risks, timely analyze and improve related mechanisms.

c) In response to the risk of counterfeiting and phishing, communicate with relevant management agencies in a timely manner and shut down.

d) In response to public opinion risks, timely response measures will be taken in accordance with relevant mechanisms.

e) In view of the opinions and complaints, analyze the reasons and deal with them in a timely manner.

f) Establish risk provision funds, insurance plans, and risks in case of failure to effectively prove the loss of funds due to customer reasons Compensation and other systems provide compensation to customers to protect their legitimate rights and interests.

g) Develop emergency response plans for potential risks caused by the integration of new technologies and businesses.

h) For risks involving multiple agencies, relevant agencies need to take the initiative to carry out joint prevention and control.

7.1 Implementation method

7.1.1 Institutional submission

In accordance with the requirements of risk monitoring, report the status of related facilities and change letter of financial technology innovation application through information filling, file uploading, etc.

Information, operating data and logs, etc., provide information for risk identification. Innovative institutions that fail to submit as required should be reminded...