Financial Data | Data Compliance China

Financial Data.

金融数据

The financial-sector data regime — the People's Bank of China's data-security measures for the banking and payments system, and the National Financial Regulatory Administration's data-security rules for banking and insurance institutions — stacked on top of the Data Security Law and PIPL.

The financial sector sits under a dedicated supervisory layer built by China’s two principal financial regulators on top of the general data regime. This domain collects the instruments that banks, insurers, payment institutions, and their technology vendors must layer onto the Data Security Law, the Cybersecurity Law, and PIPL: the People’s Bank of China (PBOC) Measures for Data Security Management in the Business Areas of the People’s Bank, and the National Financial Regulatory Administration (NFRA) Measures for Data Security Management of Banking and Insurance Institutions, together with the legacy CBIRC regulatory-data-security measures.

What distinguishes the financial regime is its own data-classification scheme keyed to the sensitivity of financial information, a heightened full-lifecycle security baseline, mandatory security assessments before outsourcing or sharing, and incident-reporting lines that run to the financial regulators in parallel with the general cybersecurity-incident channel. These rules operationalize the Data Security Law’s call for sector regulators to govern “important data” within their own remit.

§ BRIEFS

In this domain.

3 briefs.

§ 01 · AI-AGENTS

Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard

A full translation. 网安寻路人 opens a series, written with the core drafting group of the national standard Security Requirements for Data Processing by AI Agents (智能体数据处理安全要求), now being drafted, which shares the standard's preliminary research. The first installment is a case study, not a Chinese rule. It follows how US banks and retailers responded after Meta launched its personal agent Muse on September 8, 2026 and passed 10 million users in about six weeks. Amazon, JPMorgan, Schwab, and Morgan Stanley blocked or restricted outside agents, while Walmart, Shopify, and Best Buy opened controlled gateways. The author traces two fault lines. The first is identity, overreach, and liability: agents logging in with customers' credentials leave platforms unable to tell the customer, a mistaken agent, and an impostor apart. The second is control of shopping entry points and profit pools, from Amazon's roughly $70 billion ad business to banks' low-cost deposits. The industry's answer is moving from 'silent agents' toward verifiable agent identity (KYA), scoped credentials, read-only interfaces, and human approval for high-risk acts. With the original's seven charts, its timeline, its ten-row comparison of institutional policies, and its 26 notes.

2 NOV 2026 ai-agents · personal-agents · meta-muse
§ 02 · CONSENT

One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent

A bank customer buying RMB 100,000 of savings bonds signed electronically three times; the bank applied the first signature both to the bond slip and to a 'Personal Information Authorization Letter'. The courts held the authorization was never formed, at first instance and on appeal, where the Beijing Financial Court ruled on December 30, 2024 ((2024)京74民终1694号). The bank had not drawn attention to the document, the customer did not stop to read it, and there was no sign of the separate tick-box step the letter itself required. 数据何规 (What Rules for Data) agrees with the courts' scrutiny of what the customer knew. It parts company with their reasoning, which treats PI consent as contractual mutual assent. Following Cheng Xiao and Gao Fuping, the author argues that consent under the PIPL is not a declaration of intent, and that withdrawing consent is not rescinding a contract. The practical point is the larger one: where PIPL Article 13 supplies another legal basis, such as performing the contract or a statutory obligation, don't ask for consent at all. Proper notice is then enough.

26 OCT 2026 consent · separate-consent · legal-basis
§ 03 · CYBERSECURITY

NFRA Opens Consultation on Banking and Insurance Cybersecurity Measures: 72 Articles, a Four-Tier Incident Scale, and a Hard CII Chapter

The National Financial Regulatory Administration is consulting on the Measures for the Administration of Cybersecurity in the Banking and Insurance Sectors — a 72-article draft that would give banks, insurers, and financial holding companies a single cybersecurity rulebook under the CSL, DSL, PIPL, and CII Regulations. It fixes board-level responsibility, a six-month log-retention floor, annual penetration testing, a four-tier incident scale with a two-hour reporting clock, and a dedicated critical-information-infrastructure chapter with a one-hour reporting deadline, domestic-operation and disaster-recovery requirements, and annual procurement-list reporting. Comments close August 10, 2026.

13 JUL 2026 cybersecurity · financial-sector · critical-information-infrastructure

Financial Data.

Who Lets a Personal AI Agent In? Meta Muse, US Banks and Retailers, and the Pre-Research Behind China's Agent Data-Processing Standard

One Signature, Two Documents: A Beijing Financial Court Ruling and the Case for Asking for Less Consent

NFRA Opens Consultation on Banking and Insurance Cybersecurity Measures: 72 Articles, a Four-Tier Incident Scale, and a Hard CII Chapter