Regulations Governing the Standards for Information System and Security Management of Electronic Payment Institutions Article 5

An electronic payment institution shall conduct identity verification when a user logs on to the e-payment platform; the user shall use the account number and one of the transaction security designs, Type A, Type B, Type C or Type D, as set forth in Article 7 to log on.The foregoing account number and the security design of fixed password are as below:1. If the account number uses only explicit data (such as uniform business number, ID card number, mobile phone number, email address, and credit card number) for identification, a user code should be used for additional identification, which may not use any explicit data mentioned above.2. The password shall comprise of no less than six characters.3. The password shall not be identical to the account number or the user code.4. The password should not be made up of identical alphanumeric characters, continuous English alphabets or numbers, with the exception of default password.5. The password is recommended to be a combination of alphanumeric characters, and preferably contain upper case and lower case English alphabets or symbols.6. When wrong password is inputted five consecutive times, access to e-payment platform should be restricted and the user must reapply for the setting of password.7. Changed password shall not be the same as the previously set password.8. If the password has not changed for more than one year, the electronic payment institution should take proper actions.9. If the electronic payment institution issues a default password at the time the user registers, the user shall be required to change the default password when he/she logs in the first time.In the case where a security design in the first paragraph adopts pattern lock or gesture lock, subsections 6 and 7 of the foregoing paragraph shall apply mutatis mutandis.