Provides financial services, in China

Cybersecurity Law of the People's Republic of China (as amended by the Decision of October 28, 2025), Art. 23 · Read the law's page

• This binds a network operator, meaning any organization that owns or manages a network or provides services over one, so it reaches every declared activity and every declared role; the level of protection follows the classification of the network under the classified protection system.
• Formulate internal security management rules and operating procedures, designate a person responsible for network security and put network security protection responsibility into effect (Article 23, item 1).
• Take technical measures against computer viruses, network attacks and network intrusions (Article 23, item 2).
• Monitor and record the network's operating status and security incidents and keep the network logs for not less than six months (Article 23, item 3).
• Take data classification, backup of important data and encryption measures (Article 23, item 4).

Arts. 8 and 13, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security) · Read the law's page

• Applies to a network operator, meaning the owner or manager of a network or a provider of services over one, so it reaches an app developer that runs its own servers or service (Articles 2 and 8).
• On finding or learning that your network, information system or equipment has a security vulnerability, take measures at once, verify the vulnerability in good time and complete its repair (Article 8).
• Keep a channel for receiving vulnerability information open and unobstructed, and keep the receipt logs for at least 6 months (Article 5).

Data Security Law of the People's Republic of China, Art. 29 · Read the law's page

• Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.
• On an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness.
• This binds the same data processor as this jurisdiction's Data Security Law data-security-program duty; it adds a risk-monitoring and incident-response duty rather than reaching a different party.
• A processor of important data carries an additional, periodic risk-assessment-and-reporting duty under Article 30 tied to the important-data classification rather than to any activity in this vocabulary, so it is not flagged as its own instrument.

Regulation on the Security Protection of Critical Information Infrastructure (State Council Order 745), Arts. 18 and 40 · Read the law's page

• Applies to an owner or operator of critical information infrastructure designated as such by the protection-work department of its sector, an important network facility or information system in public communications and information services, energy, transport, water, finance, public services, e-government or defense science and technology (Articles 2, 8 and 10); a service of yours is reached only once it is designated and you are notified.
• When the infrastructure suffers a major cybersecurity incident, or you find a major cybersecurity threat, report to the protection-work department and the public security organ as the relevant provisions require (Article 18). The Regulation states no hour count of its own for this report; the separate incident reporting measures issued by the Cyberspace Administration of China in 2025 set the clock for incidents involving critical information infrastructure.

Regulation on the Security Protection of Critical Information Infrastructure (State Council Order 745), Arts. 6, 11-17, 19-21 and 39 · Read the law's page

• Applies to an owner or operator of critical information infrastructure designated as such by the protection-work department of its sector, an important network facility or information system in public communications and information services, energy, transport, water, finance, public services, e-government or defense science and technology (Articles 2, 8 and 10); a service of yours is reached only once it is designated and you are notified.
• Plan, build and put into use your security protection measures at the same time as the critical information infrastructure itself (Article 12).
• Set up a cybersecurity protection system and an accountability system, and guarantee the staff, funds and material for them; the head of the operator is overall responsible for protecting the infrastructure and leads the handling of major incidents (Article 13).
• Set up a dedicated security management body and run security background checks on its head and on key-post staff (Article 14).
• Carry out a cybersecurity inspection and risk assessment of the infrastructure at least once a year, yourself or through a cybersecurity service organization, correct the problems found promptly and report the results as the protection-work department requires (Article 17).
• Report to the protection-work department promptly when the infrastructure changes in a way that may affect its designation, and on a merger, division or dissolution (Articles 11 and 21).
• Give priority to secure and trustworthy network products and services, put a purchase that may affect national security through the national cybersecurity review, and sign a security and confidentiality agreement with each provider (Articles 19 and 20).

Regulation on Network Data Security Management (State Council Order 790), Arts. 9-11 · Read the law's page

• Applies to a network data processor, meaning an individual or organization that decides for itself the purpose and means of processing network data, for processing in China (Articles 2 and 62); because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express.
• Protect network data on the basis of classified cybersecurity protection: keep data security management rules in place and use encryption, backup, access control and security authentication (Article 9).
• On finding a security defect, vulnerability or similar risk in a network product or service you provide, take remedial measures at once, tell users as required and report to the competent department; where national security or the public interest is endangered, also report to the competent department within 24 hours (Article 10).
• Keep an emergency plan for network data security incidents; when an incident occurs, start the plan at once, act to stop the harm spreading and remove the hazard, and report to the competent department as provided (Article 11).
• Where an incident harms the lawful rights and interests of individuals or organizations, promptly tell those affected the incident, the risk, the harm and the remedial steps taken, by phone, text message, instant message, email or public announcement, unless a law or administrative regulation allows non-notification (Article 11).

Measures for the Administration of Cybersecurity Incident Reporting in the Business Areas of the People's Bank of China, Arts. 2, 6, 12 and 14-17 · Read the law's page

• Applies to a financial practitioner institution, meaning a financial institution or another institution the People's Bank of China has approved or recognized, for a cybersecurity incident in a business area the People's Bank of China supervises, including payment, credit reporting and interbank market business (Articles 2, 3 and 31); you are reached by declaring that you provide financial services.
• Set incident grading standards in your cybersecurity rules that rank incidents as especially major, major, relatively major or ordinary, review the standards each year, and grade each incident that occurs against them (Articles 6 and 12).
• After an incident of the relatively major grade or above, send the People's Bank of China, or its branch at your place of domicile, a brief incident report within 1 hour and an incident report within 24 hours (Articles 14 and 15).
• For a major incident or above, send a progress report at least every 2 hours until handling ends, and report at once when the grade is raised or a new problem is found (Article 16).
• Within 10 working days after handling ends, send a written post-incident investigation summary report; if you cannot, send a preliminary report on time that states a promised date within 40 working days (Article 17).
• Keep an incident ledger recording the incident time, the report time and the contact person who took the report, and keep it for at least three years (Article 25).

Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued September 11, 2025), Arts. 2, 4, 5, 8, 9, 12, 14 · Read the law's page

• On discovering or becoming aware of a cybersecurity incident affecting your own operations, grade it against China's four-tier National Cybersecurity Incident Classification and Grading Guide (especially major, major, relatively major, ordinary), and report only where you grade it relatively major or above; an ordinary incident carries no report duty under this instrument.
• Where the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident.
• Where you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident.for a public body
• Every other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident.
• Where your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly.
• Where an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer.
• Within 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report.
• This binds a network operator, meaning the owner, manager, or network service provider of a network, that builds or operates a network, or provides a service through a network, inside China; because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express rather than a narrower guess.
• A major or especially major incident additionally triggers an escalation between government bodies up to the national cyberspace administration after you report; that further escalation is not a step you perform yourself.
• Taking reasonable and necessary protective measures, disposing of the incident under your emergency plan, effectively reducing its impact and harm, and reporting it promptly as these Measures require can draw lighter treatment, or none at all, of the liability of your unit and its personnel for the incident.