On July 10th, the National Financial Regulatory Administration (NFRA) released a draft of the "Cybersecurity Management Measures for the Banking and Insurance Industries" for public consultation.

The draft stipulates that financial institutions must establish a cybersecurity responsibility system. The Party Committee (Leading Party Members Group) and the Board of Directors (Board of Supervisors) bear primary responsibility for cybersecurity management. The chief executive of the financial institution is designated as the first person responsible for cybersecurity, while the senior management member in charge of cybersecurity is the directly responsible person. Financial institutions are also required to establish a cybersecurity performance evaluation and奖惩 mechanism, regularly assess the implementation of cybersecurity responsibilities, and incorporate this into the annual performance evaluation system.

According to the draft, financial institutions must establish a sound cybersecurity risk monitoring and early warning mechanism, building a multi-layered and multi-channel monitoring and protection system. They are required to optimize monitoring indicators, promptly evaluate monitoring and early warning information, and report to the NFRA or its local派出机构 as required. Institutions must also enhance their tracking and analysis of the cybersecurity threat landscape, fully identify risks that could significantly impact their operations, timely optimize their monitoring and warning systems, and implement necessary protective measures.

The draft further mentions that financial institutions must conduct serious accountability and追究责任 for incidents where management failures lead to a major (Level 3) or higher cybersecurity event, or for cases involving the concealment, omission, false reporting, or intentional delayed reporting of such major cybersecurity events.