Key Points of China Minsheng Bank’s Policies for Information Security and Privacy Protection

I. General Provision
To standardize information security, privacy protection, data governance, and the research, development and application of artificial intelligence (AI), and to protect the legitimate rights and interests of customers, employees and other stakeholders, China Minsheng Bank (the “Bank”) has formulated the Key Points based on applicable laws and regulations, regulatory requirements and industry standards, including the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Interim Measures for the Management of Generative Artificial Intelligence Services and the Guidelines for the Management of Information Technology Risks of Commercial Banks, as well as the Bank’s actual circumstances.

The Key Points is applicable for the Head Office, the branches, the sub-branches and the subsidiaries of the Bank, and all of its businesses, systems, data and operational activities. It also applicable for all employees and set corresponding requirements for suppliers, outsourcing institutions and other third parties that process information or data or provide technical services on behalf of the Bank.
II. Governance Structure and Responsibilities
The Bank incorporates information security, privacy and data security risks into its comprehensive risk management system. The Board of Directors and its special committees, including the Risk Management Committee and the Audit Committee, are responsible for reviewing and supervising information security, data governance and related risk management.

The Cybersecurity Leading Group of the Head Office coordinates cybersecurity, personal information and data security protection. The Sci-Tech Information Management Committee coordinates major matters relating to information technology, production operations, data governance and AI. The IT Department leads the management of information security and data security, while the departments of data management, consumer protection, risk management, legal and compliance and audit perform their respective responsibilities collaboratively.

The Bank has clarified information security and data protection responsibilities of institutions and job positions at all levels, and has incorporated the implementation of cybersecurity and data security responsibility system into inspections and assessments. The subsidiaries have established and improved corresponding management policies and control measures in accordance with the Bank’s unified requirements.
III. Information Security Management
1. Information Security Management System
The Bank has established an information security policy system covering overall strategies, management specifications, detailed rules and operational procedures, and continuously improves information security management. The Bank’s information security management system has obtained the ISO/IEC 27001 certification, and its data security capabilities have obtained the Data Security Capability Maturity Model Level 3 (DSMM L3) certification. The Bank continuously conducts system reviews and improvements in light of changes in its business and technology.
2. Data Integrity and Protection
The Bank implements data classification and grading management and adopts measures including identity authentication, graded authorization, least privilege, access control, encryption, digital signatures, de-identification, desensitization, monitoring and audit, to ensure the confidentiality, integrity and availability of data throughout its lifecycle, including collection, transmission, storage, use, sharing, deletion and destruction.
3. Threat Monitoring and Incident Response
The Bank has established the defense-in-depth and security operations mechanisms, continuously conducts asset identification, vulnerability management, monitoring and early warning, analysis and judgment, response and handling, and tracking and tracing. The Bank implements classified and graded management of information security incidents and data breach incidents, and has established mechanisms of emergency plans, reporting, handling, recovery, post-incident review and accountability, and conducts regular drills and emergency plan reviews.
4. Individual Responsibilities of Employees
All employees are responsible for information security, data security and confidentiality, and shall comply with the Bank’s policies for information security, data security, personal information protection and employee conduct management. It is prohibited to illegally collect, use, process, transmit, buy, sell, provide or disclose relevant information. The Bank provides cybersecurity and data security training for all employees, and strengthens the duty performance through responsibility assessments.
5. Information Security Requirements for Third Parties
The Bank manages IT suppliers and third parties in the aspects including access assessments, security clauses in contracts, confidentiality commitment of personnel, process supervision, risk monitoring, incident handling, rectification verification and exit. The third parties involved in customer information or important data shall process information in accordance with the principle of minimum necessity, and accept the Bank’s supervision and examination.
IV. Customer Privacy and Data Protection
1. Privacy Policy and Notice
The Bank publicizes applicable privacy policies through its official website, mobile banking, personal online banking, Weixin banking, and other offline channels, to explain to customers the matters including nature of the information collected, the purposes and methods of processing, retention periods, protection measures, customer rights and interests, third-party sharing, and complaint channels. The privacy policy applies to all of the Bank's operations and to relevant third parties entrusted by the Bank to process personal information on its behalf.
2. Principles for Data Collection and Use
The Bank follows the principles of lawfulness, legitimacy, necessity, good faith and openness and transparency, and informs individuals of personal information processing rules in a clear, understandable and reasonable manner, and obtains authorization and consent in accordance with the law. The collection and processing of personal information are limited to the minimum scope necessary to achieve business purposes, and information shall not be used beyond the purposes for which authorization has been obtained.
3. Customer Rights
Customers are legally entitled to exercise the rights to inquire, access, copy, correct, supplement and delete their personal information, close their accounts; withdraw or adjust authorization and consent, refuse personalized display or automated decision-making, and request the transfer of personal information in compliance with the laws and regulations. The Bank provides channels for customers to exercise the above rights and responds in a timely manner.
4. Data Retention and Deletion
The Bank retains personal information for the shortest period necessary in compliance with laws and regulations, regulatory requirements and the purposes of processing. Where the retention period has expired, the processing purpose has been achieved, or the service has been terminated and continued retention is no longer necessary, the Bank shall delete or anonymize personal information in accordance with the law. For those cannot be technically deleted temporarily, the Bank shall retain only the storage and necessary security protection measures.
5. Third-Party Sharing and Supervision
The Bank only jointly processes or provides personal information to third parties for lawful, legitimate, necessary, specific and explicit purposes, and informs customers or obtains consent in accordance with the law. The Bank supervises third parties in fulfilling their data protection and confidentiality obligations through agreements, assessments, technical monitoring, record retention, sampling inspections and rectification tracking.
6. Complaints and Supervision
Customers may submit inquiries, complaints relating to personal information protection through the public disclosure channels on the Bank’s official website, the 95568 customer service hotline and other customer service channels. The Bank accepts, transfers, investigates and provides feedback on such matters in accordance with its consumer rights protection and personal information protection procedures, and conducts rectification and accountability for violations.
V. Responsible Al Governance
1 Governance Principles and Highest Decision-Making Body
The Bank has incorporated AI risks into its comprehensive risk management system, with risk prevention and control spanning throughout the entire lifecycle of requirements analysis, data preparation, training and development, deployment and operation, maintenance and iteration, and evaluation and exit, to ensure that AI is lawful and compliant, prudent and secure, fair and transparent, and controllable and available. The Board of Directors is responsible for reviewing and approving the AI strategies and their material adjustments, supervising the implementation of AI strategies, and designating the Strategy and Consumer Rights Protection Committee to assist in performing the aforementioned duties. The Digital Finance Committee of the Head Office has incorporated AI into the bank-wide digital and intelligent transformation under unified leadership and coordinated deployment. The Bank leverages the roles of the Corporate Finance Committee, the Retail Finance Committee, the Financial Institutions Committee, and the Risk Management Committee to strengthen business-driven AI application and coordination across business lines, with AI incorporated into the comprehensive risk management system. The Sci-Tech Information Committee performs functions of architecture planning, solution formulation, and project portfolio implementation management, establishes cross-departmental coordination mechanisms, and implements the risk management responsibilities of the three lines of defense. The coordination mechanism has been established among the three lines of defense of business and technology, risk management and legal compliance, and independent audit, to achieve full coverage and controllability of AI governance.
2. AI Governance Commitments
When using and developing AI, the Bank is committed to: (1) respecting data privacy and processing customer and employee data in compliance with applicable laws and regulations; (2) incorporating AI systems into the cybersecurity protection framework; (3) identifying and avoiding unfair bias and discriminatory outcomes; (4) retaining human participation, review and intervention mechanisms in critical decision-making; (5) enhancing the transparency of AI systems and the explainability of generated results and decision-making grounds; (6) establishing clear accountability mechanisms for models and outcomes; (7) clearly defining permitted AI use scenarios and prohibited boundaries; and (8) refraining from developing, deploying or using AI systems prohibited by applicable laws and regulations, including those involving manipulative behavior, exploitation of vulnerabilities of specific groups, inappropriate social scoring or unauthorized biometric surveillance.
VI. Responsible AI Project Management
1. Lifecycle Management
AI applications and models are subject to full lifecycle management, covering requirements assessment, solution and cost review, data compliance review, development and testing, launch approval, application and production, monitoring and review, iterative optimization, or exit. The Bank adopts classified and graded risk management of AI applications and models, and applies differentiated controls. For high-risk or critical scenarios, the Bank conducts ethic, compliance, security, and model risk assessments.
2. Access Control for Sensitive Capabilities
For sensitive AI capabilities such as facial recognition, remote identity verification, and sensitive profiling, the Bank implements least-privilege authorization, role segregation, approval and audit, and conducts dedicated assessments according to risk levels.
3. Labeling, Monitoring and Fairness Assessment
The Bank has established the labeling or tracing mechanisms for AI-generated content and AL-engaged key decision outcomes. It continuously monitors model performance, input and output distributions, model drift and anomalies, and conducts fairness and bias assessments of models,  and takes measures including correction, retraining, use restriction or decommission as necessary.
4. Environmental Impact Management
The Bank concerns energy and resource efficiency in AI infrastructure construction, model training and inference activities, promoting the adoption of high-efficiency equipment, model compression and resource scheduling optimization. The Bank has gradually established statistical assessment mechanisms for the correlation between AI-related resources and value to reduce the AI ecological footprint.
5. Appeals, Training and External Verification
Customers or third parties affected by AI decisions may submit appeals through the Bank’s customer service and complaint channels. Appeals involving AI decisions are incorporated into model review and improvement processes. The Bank provides training on AI security, compliance and responsible use to personnel involved in AI research and development, data, risk management and business operations.

In accordance with regulatory requirements and business development, the Bank conducts external verification of its AI management capabilities through existing external certifications on its information security and data security and, where appropriate, through assessments or certifications on its AI management system.
VII. Handling of Violations
The Bank adopts a zero-tolerance policy for violations of the Key Points. Employees who violate the Key Points are handled in accordance with the Bank’s employee conduct and violation accountability policies. In case of violation of suppliers, outsourcing institutions or other third parties against laws and regulations, the Key Points or contractual provisions, the Bank may, depending on the circumstances, require remediation, pursue accountability, suspend cooperation or terminate contracts. Those suspected of illegal or criminal acts shall be transferred to the relevant authorities in accordance with the law.
VIII. Supervision and Audit
The Bank has incorporated information security, personal information protection, data security and AI governance into internal audits, internal control evaluations and compliance inspections, and accepts external supervision through external information system audits, cybersecurity classified protection assessments, management system certification reviews and regulatory inspections.
IX. Policy Review and Update
The Key Points is subject to interpretation and maintenance by the Bank, and shall be reviewed at least annually in light of applicable laws and regulations, regulatory requirements, technological developments, best practices, implementation status and incident experience. It shall be revised promptly  in the event of  significant changes or material risk incidents.