Regulations Governing Authorization and Administration of Service Enterprises Engaged in Interbank Credit Information Processing and Exchange Article 29

To ensure the confidentiality and security of information, a service enterprise engaged in interbank credit information processing and exchange shall periodically reassess and improve its maintenance measures and plans for information confidentiality and security controls, and shall report its actions to the Competent Authority for acknowledgement.A service enterprise engaged in interbank credit information processing and exchange shall enter into a membership protocol with its member financial institutions, and in the membership protocol shall include stipulations regarding suspension and reinstatement of access, liability for damages, etc., in the event there are violations of the security control mechanism, access procedures, or the terms and conditions of information confidentiality. A service enterprise engaged in interbank credit information processing and exchange may carry out inspections as necessary to ascertain whether and how well its member organizations are implementing security control mechanisms and abiding by access procedures and the terms and conditions of information confidentiality.