您的位置: 首页 » 法律资料网 » 法律法规 »

黑河市人民政府办公室关于转发黑河市地方税务局《出租房屋税收征收管理办法》《土地增值税管理办法》和《销售不动产营业税管理办法》的通知

时间:2024-07-11 16:50:49 来源: 法律资料网 作者:法律资料网 阅读:9150
下载地址: 点击此处下载

黑河市人民政府办公室关于转发黑河市地方税务局《出租房屋税收征收管理办法》《土地增值税管理办法》和《销售不动产营业税管理办法》的通知

黑龙江省黑河市人民政府办公室


黑市政办字〔2002〕71号


黑河市人民政府办公室关于转发黑河市地方税务局《出租房屋税收征收管理办法》《土地增值税管理办法》和《销售不动产营业税管理办法》的通知


各县(市)区人民政府、五大连池管委会,中、省、市直各单位:
经市政府同意,现将《黑河市地方税务局出租房屋税收征收管理办法》、《黑河市地方税务局土地增值税管理办法》和《黑河市地方税务局销售不动产营业税管理办法》转发给你们,望认真贯彻执行。



二○○二年十一月二十二日








黑河市地方税务局
出租房屋税收征收管理办法


第一条 为加强对出租房屋税收的征收管理,根据《中华人民共和国营业税暂行条例》、《中华人民共和国城市维护建设税暂行条例》、《中华人民共和国房产税暂行条例》、《中华人民共和国企业所得税暂行条例》、《中华人民共和国个人所得税法》和《征收教育费附加的暂行规定》有关规定,结合我市实际,制定本办法。
第二条 凡在我市出租房屋的单位和个人,均应依照本办法缴纳营业税、城市维护建设税、房产税、企业所得税(个人所得税)、教育费附加。
第三条 纳税人出租房屋取得租金收入(以装修、修缮、安装设施及其他项目抵顶租金的行为视为取得租金收入),应在次月10日前到房产所在地的主管地方税务征收机关申报纳税。
第四条 纳税人在征期内未申报缴纳税款,由承租人作为代扣代缴义务人负责代扣代缴税款。
第五条 出租房屋缴纳税款,按年核定,分期(或分次)征收。具体纳税期限由各县(市)区地方税务机关确定。
第六条 对会计账簿健全,能准确、完整地进行会计核算的,由地方税务机关按租金收入和适用税率计征税款。对无法查实征
收的,实行定额征收办法,由委托代征单位代征税款。
第七条 各地地方税务机关应在典型调查、测算的基础上,根据房屋所在地的地段等级、房屋用途、建筑面积制定本地的出租房屋定额征税标准。
第八条 对实行定额征收的,由地方政府确定委托代征单位,地方税务机关与委托代征单位签订《委托代征税款协议书》,发给委托代征人员《委托代征证书》,并按规定付给代征手续费。
第九条 各地地方税务机关应借助当地房产部门户籍管理档案,对出租房屋税收征收管理利用微机建立征收台账,对房屋权属(租赁还是自有)、房屋用途、房屋面积、纳税情况等实行动态管理。
第十条 各地地方税务机关应建立与委托代征单位、工商、房产、公安等部门的联系制度,及时勾通反馈信息,掌握各类房产出租情况,避免出现漏征漏管问题。
第十一条 房屋的承租人应向出租人索取正式发票,房屋的出租人应给承租人开据发票。出租人无发票应到主管地方税务征收机关换取发票并缴纳应纳税款。对未按照规定开具(换取)发票或取得发票的,应按照《中华人民共和国发票管理办法》的有关规定予以处罚。
第十二条 纳税人、承租人、委托代征人违反本办法,弄虚作假,逃避纳税,应按《中华人民共和国税收征收管理法》及有
关规定予以处罚。
第十三条 本办法由黑河市地方税务局负责解释。
第十四条 本办法自2002年7月1日起执行。



黑河市地方税务局土地增值税管理办法


一、总 则
第一条 为加强土地增值税的征收管理, 根据《中华人民共和国土地增值税暂行条例》和《中华人民共和国土地增值税暂行条例实施细则》及有关规定,结合我市实际制定本办法。
第二条 凡在我市辖区内转让国有土地使用权、地上建筑物及其附着物(以下简称转让房地产)并取得转让收入的企事业单位、国家机关、社会团体、其他组织及个人, 均为土地增值税的纳税义务人。
第三条 在我市辖区的一切转让国有土地使用权、地上建筑物及其附着物的行为均应依法缴纳土地增值税。
二、土地增值税的计算
第四条 土地增值税按照转让房地产所取得的土地增值额和规定的税率计算征收。
具体计算办法是:增值额乘以适用税率减去扣除项目金额与速算扣除系数的乘积。公式如下:
(一)增值额未超过扣除项目金额50%的
土地增值税税额=增值额×30%
(二)增值额超过扣除项目金额50%,未超过100%的
土地增值税税额=增值额×40%-扣除项目金额×5%
(三)增值额超过扣除项目金额100%,未超过200%的
土地增值税税额=增值额×50%-扣除项目金额×15%
(四)增值额超过扣除项目金额200%的
土地增值税税额=增值额×60%-扣除项目金额×35%
公式中的5%、15%、35%为速算扣除系数。
三、土地增值税的减免
第五条 纳税人建造普通标准住宅出售,增值额未超过扣除项目金额20%的,免征土地增值税。标准住宅是指:钢筋混凝土结构的住宅,每平方米建筑面积的建筑安装工程费在800元以下的;砖混结构的住宅,每平方米建筑面积的建筑安装工程费在600元以下的,可视为普通标准住宅。
第六条 因国家建设需要依法征用、收回的房地产,免征土地增值税。
第七条 纳税人既建普通标准住宅又搞其他房地产开发的, 应分别核算增值额。不分别核算增值额或不能准确核算增值额的, 其建造的普通标准住宅不能适用第(一)项的免税规定。
第八条 对于以房地产进行投资、联营的,投资、联营的一方以土地(房地产)作价入股进行投资或作为联营条件,将房地产转让到所投资、联营的企业中的,暂免征收土地增值税。对投资、联营企业将上述房地产再转让的,应征收土地增值税。
第九条 对于一方出土地,一方出资金,双方合作建房,建成后按比例分房自用的,暂免征收土地增值税。建成后转让的应征收土地增值税。
第十条 对居民个人拥有的普通住宅,在其转让时暂免征收土地增值税。
四、土地增值税的征收管理
第十一条 凡从事房地产开发的纳税人, 在获得开发项目许可后, 30日内持有关批件到开发项目所在地主管地税机关, 填报《土地增值税项目登记表》。经审核后确定其土地增值税的征免或预缴税额。
第十二条 对于已经完税的,由主管地税机关发给完税证明,对于符合免税规定的,由主管税务机关发给免税证明。
第十三条 纳税人在项目全部竣工结算前转让完成开发的房地产, 预售房地产取得的收入, 按所在地地税机关审核后确定其土地增值税的预缴税额, 在月末终了后7日内办理申报纳税, 待工程竣工决算后, 60日内进行清算, 多退少补。
第十四条 土地增值税实行专人征收管理。征收管理人员对辖区内从事房地产开发的纳税人, 在获得开发项目许可后, 应及时告知企事业单位、国家机关、社会团体、其他组织及个人办理税务登记, 填报《土地增值税项目登记表》, 并将有关资料录入微机, 进行跟踪管理。
第十五条 征收管理人员应依法对从事房地产开发的纳税人进行检查, 在检查中发现的问题要查清原因、弄清环节、核准数据、取足证据、准确定性, 按户认真填写税务检查或稽查底稿和《土地增值税检查明细表》, 并要求被检查人签署意见。按照“四个环节”履行程序, 报经局长审批做出税务处理决定后,应将查补税款滞纳金罚款追缴入库。
第十六条 从事房地产开发的纳税人未按照规定的期限办理纳税申报和报送纳税资料的,由税务机关责令限期改正,可以处2000元以上10000元以下的罚款。
第十七条 征收管理人员徇私舞弊或者玩忽职守,不征或者少征应征税款,致使国家税收遭受重大损失,构成犯罪的,依法追究刑事责任;尚未构成犯罪的,依法给予行政处分。
五、征管工作机制
第十八条 计划部门批准房地产项目投资计划时要将批准的项目投资计划文件提供主管地方税务机关,确保土地增值税征收工作依据详实。
第十九条 土地管理部门应凭主管地税机关出具的完税(或免税)证明, 办理土地使用权的权属变更登记, 更换《国有土地使用证》。凡未取得主管税务机关发放的完税(或免税)证明的,土地管理机关不予办理土地使用权的登记及过户手续,也不发放《国有土地使用证》。
第二十条 纳税人凭完税(或免税)证明到房地产管理部门办理转让房地产的权属变更事宜,凡未取得主管地税机关发放的完税或免税证明的,房地产管理机关不予办理房地产权属变更手续。
第二十一条 土地房地产评估机构有向税务机关提供土地评估资料的义务,凡不向税务机关提供与应纳税土地有关的真实土地评估资料或有意提供虚假评估结果,造成纳税人不缴或少缴土地增值税的,一经发现要取消其对应纳税土地的评估资格,对由于上述行为造成国家税收严重流失的,还要提请司法机关追究其应承担的经济责任和有关当事人的刑事责任。
第二十二条 各级地税机关要主动与计划、房产、土地等部门进行沟通,建立联系制度及时反馈信息,在每月终了10日内到同级计划部门登记批准的房地产项目投资计划;到房地产管理部门登记房地产权属变更情况;到土地管理部门登记土地使用权、过户手续及更换《国有土地使用证》的情况;到土地房地产评估机构登记土地评估资料情况,以便及时核准土地增值税的征缴情况。
六、罚则
第二十三条 纳税人不如实申报房地产交易额及规定扣除项目金额造成少缴或未缴税款的, 按照《中华人民共和国税收征收管理法》的有关规定予以处罚。
七、附则
第二十四条 本办法未尽事宜, 按照《中华人民共和国土地增值税暂行条例》、《中华人民共和国土地增值税暂行条例实施细则》及有关规定办理。
第二十五条 本办法由黑河市地方税务局负责解释。
第二十六条 本办法自2002年10月1日起执行。



黑河市地方税务局
销售不动产营业税管理办法


第一条 为加强我市销售不动产营业税征收管理,根据《中华人民共和国税收征收管理法》(以下简称征管法)、《中华人民共和国营业税暂行条例》(以下简称条例)、《中华人民共和国营业税暂行条例实施细则》(以下简称实施细则)等有关规定,结合我市实际,制定本办法。
第二条 本办法适用于全市一切有销售不动产行为的单位和个人,以及负有代扣代缴税款义务的单位和个人。
销售不动产的单位和个人包括房地产开发企业、建筑安装企业、集资建房单位、以房抵债单位以及其他销售不动产的单位和个人。
单位销售不动产是指房地产开发企业生产经营销售的房屋及建筑物;建筑安装企业自建销售的房屋及建筑物;集资建房单位将职工集资建房中的剩余住房及商服用房对外销售;以房抵债是指单位将房产抵顶货款或借款。
个人销售不动产是指个人销售商服用房和销售购买并居住不足一年的普通住宅。
第三条 纳税人销售不动产时从购买方取得的一切收入(包括各种基金、代收费用等)都要征税。
纳税人销售不动产价格明显偏低而无正当理由或纳税人销售不动产时从对方取得实物、经济利益,主管税务机关应按下例顺序核定、计算营业额:
一、纳税人当月提供的同类销售不动产的平均价格核定。
二、按纳税人最近期提供的同类销售不动产平均价格核定。
三、按下例公式核定计税价格:
计税价格=营业成本或工程成本×(1+成本利润率)÷(1-营业税税率)。(成本利润率按10%)。
第四条 纳税人转让销售不动产采用预收款方式的,其纳税义务发生时间为收到预收款的当天。
纳税人自建建筑物后销售的,纳税义务发生时间,为其销售自建建筑物并收讫营业额或取得索取营业额的凭据的当天。
纳税人将不动产无偿赠与他人的,其纳税义务发生时间,为不动产所有权转移的当天。
第五条 纳税人销售不动产,应向不动产所在地税务机关申报、纳税。黑河市区的中、省、市直单位销售不动产,向黑河分局申报纳税。
第六条 企、事业单位,以一个月为一期的纳税人,于次月10日内申报纳税;个人销售不动产的在买方办理产权证前次月10日内申报纳税。
第七条 各有关部门和单位应当支持、协助税务机关依法执行公务。
计划部门要向税务部门提供建设工程项目审批情况及有关资料。
房产、土地部门对交易的房产,凭税务机关完税或免税证明,办理产权证照。对集资建房单位要严格审查,非集资单位的职工必须凭完税证明办理产权证照。
第八条 各级地税机关要对销售不动产营业税规范管理。对工程项目要利用微机建立登记台账,要与户籍管理相结合,落实责任,定期检查。
第九条 对于扣押的不动产,一律实行拍卖缴税。特殊情况需要变卖的,要有中介机构对其不动产的评估证明,并报市局备案。
第十条 纳税人未按规定申报、纳税的及发生其他违章行为的按《征管法》的有关规定处罚。
第十一条 本办法由黑河市地方税务局负责解释。
第十二条 本办法自2002年7月1日执行。


Guidelines on the Risk Management of Commercial Banks’ Information Technology ——附加英文版

China Banking Regulatory Commission


Guidelines on the Risk Management of Commercial Banks’ Information Technology





Chapter I General Provisions

Article 1. Pursuant to the Law of the People’s Republic of China on Banking Regulation and Supervision, the Law of the People's Republic of China on Commercial Banks, the Regulations of the People’s Republic of China on Administration of Foreign-funded Banks, and other applicable laws and regulations, the Guidelines on the Risk Management of Commercial Banks’ Information Technology (hereinafter referred to as the Guidelines) is formulated.

Article 2. The Guidelines apply to all the commercial banks legally incorporated within the territory of the People’s Republic of China.

The Guidelines may apply to other banking institutions including policy banks, rural cooperative banks, urban credit cooperatives, rural credit cooperatives, village banks, loan companies, financial asset management companies, trust and investment companies, finance firms, financial leasing companies, automobile financial companies and money brokers.


Article 3. The term “information technology” stated in the Guidelines shall refer to the system built with computer, communication and software technologies, and employed by commercial banks to handle business transactions, operation management, and internal communication, collaborative work and controls. The term also include IT governance, IT organization structure and IT policies and procedures.

Article 4. The risk of information technology refers to the operational risk, legal risk and reputation risk that are caused by natural factor, human factor, technological loopholes or management deficiencies when using information technology.

Article 5. The objective of information system risk management is to establish an effective mechanism that can identify, measure, monitor, and control the risks of commercial banks’ information system, ensure data integrity, availability, confidentiality and consistency, provide the relevant early warning, and thereby enable commercial banks’ business innovations, uplift their capability in utilizing information technology, improve their core competitiveness and capacity for sustainable development.



Chapter II IT governance

Article 6. The legal representative of commercial bank should be responsible to ensure compliance of this guideline.

Article 7. The board of directors of commercial banks should have the following responsibilities with respect to the management of information systems:
(1) Implementing and complying with the national laws, regulations and technical standards pertaining to the management of information systems, as well as the regulatory requirements set by the China Banking Regulatory Commission (hereinafter referred to as the “CBRC”);
(2) Periodically reviewing the alignment of IT strategy with the overall business strategies and significant policies of the bank, assessing the overall effectiveness and efficiency of the IT organization.
(3) Approving IT risk management strategies and policies, understanding the major IT risks involved, setting acceptable levels for these risks, and ensuring the implementation of the measures necessary to identify, measure, monitor and control these risks.
(4) Setting high ethical and integrity standards, and establishing a culture within the bank that emphasizes and demonstrates to all levels of personnel the importance of IT risk management.
(5) Establishing an IT steering committee which consists of representatives from senior management, the IT organization, and major business units, to oversee these responsibilities and report the effectiveness of strategic IT planning, the IT budget and actual expenditure, and the overall IT performance to the board of directors and senior management periodically.
(6) Establishing IT governance structure, proper segregation of duty, clear role and responsibility, maintaining check and balances and clear reporting relationship. Strengthening IT professional staff by developing incentive program.
(7) Ensuring that there is an effective internal audit of the IT risk management carried out by operationally independent, well-trained and qualified staff. The internal audit report should be submitted directly to the IT audit committee;
(8) Submitting an annual report to the CBRC and its local offices on information system risk management that has been reviewed and approved by the board of directors ;
(9) Ensuring the appropriating funding necessary for IT risk management works;
(10) Ensuring that all employees of the bank fully understand and adhere to the IT risk management policies and procedures approved by the board of directors and the senior management, and are provided with pertinent training.
(11) Ensuring customer information, financial information, product information and core banking system of the legal entity are held independently within the territory, and complying with the regulatory on-site examination requirements of CBRC and guarding against cross-border risk.
(12) Reporting in a timely manner to the CBRC and its local offices any serious incident of information systems or unexpected event, and quickly respond to it in accordance with the contingency plan;
(13) Cooperating with the CBRC and its local offices in the supervisory inspection of the risk management of information systems, and ensure that supervisory opinions are followed up; and
(14) Performing other related IT risk management tasks.

Article 8. The head of the IT organization, commonly known as the Chief Information Officer (CIO) should report directly to the president. Roles and responsibilities of the CIO should include the following:
(1) Playing a direct role in key decisions for the business development involving the use of IT in the bank;
(2) The CIO should ensure that information systems meet the needs of the bank, and IT strategies, in particular information system development strategies, comply with the overall business strategies and IT risk management policies of the bank;
(3) The CIO should also be responsible for the establishment of an effective and efficient IT organization to carry out the IT functions of the bank. These include the IT budget and expenditure, IT risk management, IT policies, standards and procedures, IT internal controls, professional development, IT project initiatives, IT project management, information system maintenance and upgrade, IT operations, IT infrastructure, Information security, disaster recovery plan (DRP), IT outsourcing, and information system retirement;
(4) Ensuring the effectiveness of IT risk management throughout the organization including all branches.
(5) Organizing professional trainings to improve technical proficiency of staff.
(6) Performing other related IT risk management tasks.

Article 9. Commercial banks should ensure that a clear definition of the IT organization structure and documentation of all job descriptions of important positions are always in place and updated in a timely manner. Staff in each position should meet relevant requirements on professional skills and knowledge. The following risk mitigation measures should be incorporated in the management program of related staff:
(1) Verification of personal information including confirmation of personal identification issued by government, academic credentials, prior work experience, professional qualifications;
(2) Ensuring that IT staff can meet the required professional ethics by checking character reference;
(3) Signing of agreements with employees about understanding of IT policies and guidelines, non-disclosure of confidential information, authorized use of information systems, and adherence to IT policies and procedures; and
(4) Evaluation of the risk of losing key IT personnel, especially during major IT development stage or in a period of unstable IT operations, and the relevant risk mitigation measures such as staff backup arrangement and staff succession plan.

Article 10. Commercial banks should establish or designate a particular department for IT risk management. It should report directly to the CIO and the Chief Risk Officer (or risk management committee), serve as a member of the IT incident response team, and be responsible for coordinating the establishment of policies regarding IT risk management, especially the areas of information security, BCP, and compliance with the CBRC regulations, advising the business departments and IT department in implementing these policies, providing relevant compliance information, conducting on-going assessment of IT risks, and ensuring the follow-up of remediation advice, monitoring and escalating management of IT threats and non-compliance events.

Article 11. Commercial banks should establish a special IT audit role and responsibility within internal audit function, which should put in place IT audit policies and procedures, develop and execute IT audit plan.

Article 12. Commercial banks should put in place policies and procedures to protect intellectual property rights according to laws regarding intellectual properties, ensure purchase of legitimate software and hardware, prevention of the use of pirated software, and the protection of the proprietary rights of IT products developed by the bank, and ensure that these are fully understood and complied by all employees.

Article 13. Commercial banks should, in accordance with relevant laws and regulations, disclose the risk profile of their IT normatively and timely.


Chapter III IT Risk Management

Article 14. Commercial banks should formulate an IT strategy that aligns with the overall business plan of the bank, IT risk assessment plan and an IT operational plan that can ensure adequate financial resources and human resources to maintain a stable and secure IT environment.

Article 15. Commercial banks should put in place a comprehensive set of IT risk management policies that include the following areas:
(1) Information security classification policy
(2) System development, testing and maintenance policy
(3) IT operation and maintenance policy
(4) Access control policy
(5) Physical security policy
(6) Personnel security policy
(7) Business Continuity Planning and Crisis and Emergency Management procedure

Article 16. Commercial banks should maintain an ongoing risk identification and assessment process that allows the bank to pinpoint the areas of concern in its information systems, assess the potential impact of the risks on its business, rank the risks, and prioritize mitigation actions and the necessary resources (including outsourcing vendors, product vendors and service vendors).

Article 17. Commercial banks should implement a comprehensive set of risk mitigation measures complying with the IT risk management policies and commensurate with the risk assessment of the bank. These mitigation measures should include:
(1) A set of clearly documented IT risk policies, technical standards, and operational procedures, which should be communicated to the staff frequently and kept up to date in a timely manner;
(2) Areas of potential conflicts of interest should be identified, minimized, and subject to careful, independent monitoring. Also it requires that an appropriate control structure is set up to facilitate checks and balances, with control activities defined at every business level, which should include:
- Top level reviews;
- Controls over physical and logical access to data and system;
- Access granted on “need to know” and “minimum authorization” basis;
- A system of approvals and authorizations; and
- A system of verification and reconciliation.

Article 18. Commercial banks should put in place a set of ongoing risk measurement and monitoring mechanisms, which should include
(1) Pre and post-implementation review of IT projects;
(2) Benchmarks for periodic review of system performance;
(3) Reports of incidents and complaints about IT services;
(4) Reports of internal audit, external audit, and issues identified by CBRC; and
(5) Arrangement with vendors and business units for periodic review of service level agreements (SLAs).
(6) The possible impact of new development of technology and new threats to software deployed.
(7) Timely review of operational risk and management controls in operation area.
(8) Assess the risk profile on IT outsourcing projects periodically.

Article 19. Chinese commercial banks operating offshore and the foreign commercial banks in China should comply with the relevant regulatory requirements on information systems in and outside the People’s Republic of China.


Chapter IV Information Security

Article 20. Information technology department of commercial banks should oversee the establishment of an information classification and protection scheme. All employees of the bank should be made aware of the importance of ensuring information confidentiality and provided with the necessary training to fully understand the information protection procedures within their responsibilities.

Article 21. Commercial banks should put in place an information security management function to develop and maintain an ongoing information security management program, promote information security awareness, advise other IT functions on security issues, serve as the leader of IT incident response team, and report the evaluation of the information security of the bank to the IT steering committee periodically. The Information security management program should include Information security standards, strategy, an implementation plan, and an ongoing maintenance plan.
Information security policy should include the following areas:
(1) IT security policy management
(2) Organization information security
(3) Asset management
(4) Personnel security
(5) Physical and environment security
(6) Communication and operation security
(7) Access control and authentication
(8) Acquirement, development and maintenance of information system
(9) Information security event management
(10) Business continuity management
(11) Compliance

Article 22. Commercial banks should have an effective process to manage user authentication and access control. Access to data and system should be strictly limited to authorized individuals whose identity is clearly established, and their activities in the information systems should be limited to the minimum required for their legitimate business use. Appropriate user authentication mechanism commensurate with the classification of information to be accessed should be selected. Timely review and removal of user identity from the system should be implemented when user transfers to a new job or leave the commercial bank.

Article 23. Commercial banks should ensure all physical security zones, such as computer centers or data centers, network closets, areas containing confidential information or critical IT equipment, and respective accountabilities are clearly defined, and appropriate preventive, detective, and recuperative controls are put in place.

Article 24. Commercial banks should divide their networks into logical security domains (hereinafter referred to as the “domain”) with different levels of security. The following security factors have to be assessed in order to define and implement effective security controls, such as physical or logical segregation of network, network filtering, logical access control, traffic encryption, network monitoring, activity log, etc., for each domain and the whole network.
(1) criticality of the applications and user groups within the domain;
(2) Access points to the domain through various communication channels;
(3) Network protocols and ports used by the applications and network equipment deployed within the domain;
(4) Performance requirement or benchmark;
(5) Nature of the domain, i.e. production or testing, internal or external;
(6) Connectivity between various domains; and
(7) Trustworthiness of the domain.

Article 25. Commercial banks should secure the operating system and system software of all computer systems by
(1) Developing baseline security requirement for each operating system and ensuring all systems meet the baseline security requirement;
(2) Clearly defining a set of access privileges for different groups of users, namely, end-users, system development staff, computer operators, and system administrators and user administrators;
(3) Setting up a system of approval, verification, and monitoring procedures for using the highest privileged system accounts;
(4) Requiring technical staff to review available security patches, and report the patch status periodically; and
(5) Requiring technical staff to include important items such as unsuccessful logins, access to critical system files, changes made to user accounts, etc. in system logs, monitors the systems for any abnormal event manually or automatically, and report the monitoring periodically.

Article 26. Commercial banks should ensure the security of all the application systems by
(1) Clearly defining the roles and responsibilities of end-users and IT staff regarding the application security;
(2) Implementing a robust authentication method commensurate with the criticality and sensibility of the application system;
(3) Enforcing segregation of duties and dual control over critical or sensitive functions;
(4) Requiring verification of input or reconciliation of output at critical junctures;
(5) Requiring the input and output of confidential information are handled in a secure manner to prevent theft, tampering, intentional leakage, or inadvertent leakage;
(6) Ensuring system can handle exceptions in a predefined way and provide meaningful message to users when the system is forced to terminate; and
(7) Maintaining audit trail in either paper or electronic format.
(8) Requiring user administrator to monitor and review unsuccessful logins and changes to users accounts.

Article 27. Commercial banks should have a set of policies and procedures controlling the logging of activities in all production systems to support effective auditing, security forensic analysis, and fraud prevention. Logging can be implemented in different layers of software and on different computer and networking equipment, which falls into two broad categories:
(1) Transaction journals. They are generated by application software and database management system, and contain authentication attempts, modification to data, error messages, etc. Transaction journals should be kept according to the national accounting policy.
(2) System logs. They are generated by operating systems, database management system, firewalls, intrusion detection systems, and routers, etc., and contain authentication attempts, system events, network events, error messages, etc. System logs should be kept for a period scaled to the risk classification, but no less than one year.
Banks should ensure that sufficient items be included in the logs to facilitate effective internal controls, system troubleshooting, and auditing while taking appropriate measures to ensure time synchronization on all logs. Sufficient disk space should be allocated to prevent logs from being overwritten. System logs should be reviewed for any exception. The review frequency and retention period for transaction logs or database logs should be determined jointly by IT organization and pertinent business lines, and approved by the IT steering committee.

Article 28. Commercial banks should have the capacity to employ encryption technologies to mitigate the risk of losing confidential information in the information systems or during its transmission. Appropriate management processes of the encryption facilities should be put in place to ensure that
(1) Encryption facilities in use should meet national security standards or requirements;
(2) Staff in charge of encryption facilities are well trained and screened;
(3) Encryption strength is adequate to protect the confidentiality of the information; and
(4) Effective and efficient key management procedures, especially key lifecycle management and certificate lifecycle management, are in place.

Article 29. Commercial banks should put in place an effective and efficient system of securing all end-user computing equipment which include desktop personal computers (PCs), portable PCs, teller terminals, automatic teller machines (ATMs), passbook printers, debit or credit card readers, point of sale (POS) terminals, personal digital assistant (PDAs), etc and conduct periodic security checks on all equipments.

Article 30. Commercial banks should put in place a set of policies and procedures to govern the collection, processing, storage, transmission, dissemination, and disposal of customer information.

Article 31. All employees, including contract staff, should be provided with the necessary trainings to fully understand these policies procedures and the consequences of their violation. Commercial banks should adopt a zero tolerance policy against security violation.


Chapter V Application System Development, Testing and Maintenance

Article 32. Commercial banks should have the capability to identify, plan, acquire, develop, test, deploy, maintain, upgrade, and retire information systems. Policies and procedures should be in place to govern the initiation, prioritization, approval, and control of IT projects. Progress reports of major IT projects should be submitted to and reviewed by the IT steering committee periodically. Decisions involving significant change of schedule, change of key personnel, change of vendors, and major expenditures should be included in the progress report.

Article 33. Commercial banks should recognize the risks associated with IT projects, which include the possibilities of incurring various kinds of operational risk, financial losses, and opportunity costs stemming from ineffective project planning or inadequate project management controls of the bank. Therefore, appropriate project management methodologies should be adopted and implemented to control the risks associated with IT projects.

Article 34. Commercial banks should adopt and implement a system development methodology to control the life cycle of Information systems. The typical phases of system life cycle include system analysis, design, development or acquisition, testing, trial run, deployment, maintenance, and retirement. The system development methodology to be used should be commensurate with the size, nature, and complexity of the IT project, and, generally speaking, should facilitate the management of the following risks.

Article 35. Commercial banks should ensure system reliability, integrity, and maintainability by controlling system changes with a set of policies and procedures, which should include the following elements.
(1) Ensure that production systems are separated from development or testing systems;
(2) Separating the duties of managing production systems and managing development or testing systems;
(3) Prohibiting application development and maintenance staff from accessing production system under normal circumstances unless management approval is granted to perform emergency repair, and all emergency repair activities should be recorded and reviewed promptly;
(4) Promoting changes of program or system configuration from development and testing systems to production systems should be jointly approved by IT organization and business departments, properly documented, and reviewed periodically.

Article 36. Commercial banks should have in place a set of policies, standards, and procedures to ensure data integrity, confidentiality, and availability. These policies should be in accordance with data integrity amid IT development procedure.

Article 37. Commercial banks should ensure that Information system problems could be tracked, analyzed, and resolved systematically through an effective problem management process. Problems should be documented, categorized, and indexed. Support services or technical assistance from vendors, if necessary, should also be documented. Contacts and relevant contract information should be made readily available to the employees concerned. Accountability and line of command should be delineated clearly and communicated to all employees concerned, which is of utmost importance to performing emergency repair.

Article 38. Commercial banks should have a set of policies and procedures controlling the process of system upgrade. System upgrade is needed when the hardware reaches its lifespan or runs out of capacity, the underpinning software, namely, operating system, database management system, middleware, has to be upgraded, or the application software has to be upgraded. The system upgrade should be treated as a project and managed by all pertinent project management controls including user acceptance testing.


Chapter VI IT Operations

Article 39. Commercial banks should consider fully the environmental threats (e.g. proximity to natural disaster zones, dangerous or hazardous facilities or busy/major roads) when selecting the locations of their data centers. Physical and environmental controls should be implemented to monitor environmental conditions could affect adversely the operation of information processing facilities. Equipment facilities should be protected from power failures and electrical supply interference.

Article 40. In controlling access by third-party personnel (e.g. service providers) to secured areas, proper approval of access should be enforced and their activities should be closely monitored. It is important that proper screening procedures including verification and background checks, especially for sensitive technology-related jobs, are developed for permanent and temporary technical staff and contractors.

Article 41. Commercial banks should separate IT operations or computer center operations from system development and maintenance to ensure segregation of duties within the IT organization. The commercial banks should document the roles and responsibilities of data center functions.

Article 42. Commercial banks are required to retain transactional records in compliance with the national accounting policy. Procedures and technology are needed to be put in place to ensure the integrity, safekeeping and retrieval requirements of the archived data.



Article 43. Commercial banks should detail operational instructions such as computer operator tasks, job scheduling and execution in the IT operations manual. The IT operations manual should also cover the procedures and requirements for on-site and off-site backup of data and software in both the production and development environments (i.e. frequency, scope and retention periods of back-up).

Article 44. Commercial banks should have in place a problem management and processing system to respond promptly to IT operations incidents, to escalate reported incidents to relevant IT management staff and to record, analyze and keep tracks of all these incidents until rectification of the incidents with root cause analysis completed. A helpdesk function should be set up to provide front-line support to users on all technology-related problems and to direct the problems to relevant IT functions for investigation and resolution.

Article 45. Commercial banks should establish service level agreement and assess the IT service level standard attained.

Article 46. Commercial banks should implement a process to ensure that the performance of application systems is continuously monitored and exceptions are reported in a timely and comprehensive manner. The performance monitoring process should include forecasting capability to enable exceptions to be identified and corrected before they affect system performance.

Article 47. Commercial banks should carry out capacity plan to cater for business growth and transaction increases due to changes of economic conditions. Capacity plan should be extended to cover back-up systems and related facilities in addition to the production environment.

Article 48. Commercial banks should ensure the continued availability of technology related services with timely maintenance and appropriate system upgrades. Proper record keeping (including suspected and actual faults and preventive and corrective maintenance records) is necessary for effective facility and equipment maintenance.

Article 49. Commercial banks should have an effective change management process in place to ensure integrity and reliability of the production environment. Commercial banks should develop a formal change management process.


Chapter VII Business Continuity Management

Article 50. Commercial banks should have in place appropriate arrangements, having regard to the nature, scale and complexity of its business, to ensure that it can continue to function and meet its regulatory obligations in the event of an unforeseen interruption. These arrangements should be regularly updated and tested to ensure their effectiveness.

Article 51. Commercial banks should consider the likelihood and impact of a disruption to the continuity of its operation from unexpected events. This should include assessing the disruptions to which it is particularly susceptible including but not limited to:
(1) Loss of failure of internal and external resources (such as people, systems and other assets);
(2) The loss or corruption of its information; and
(3) External events (such as war, earthquake, typhoon, etc).

Article 52. Commercial bank should act to reduce both the likelihood of disruptions (including system resilience and dual processing); and the impact of disruptions (including by contingency arrangements and insurance).

Article 53. Commercial bank should document its strategy for maintaining continuity of its operations, and its plans for communicating and regularly testing the adequacy and effectiveness of this strategy. Commercial bank should establish:
(1) Formal business continuity plans that outline arrangements to reduce the impact of a short, medium and long-term disruption, including:
a) Resource requirements such as people, systems and other assets, and arrangements for obtaining these resources;
b) The recovery priorities for the commercial bank’s operations; and
c) Communication arrangements for internal and external concerned parties (including CBRC, clients and the press);
(2) Escalation and invocation plans that outline the processes for implementing the business continuity plans, together with relevant contact information;
(3) Processes to validate the integrity of information affected by the disruption;
(4) Processes to review and update (1) to (3) following changes to the commercial bank’s operations or risk profile.

Article 54. A final BCP plan and an annual drill result must be signed off by the IT Risk management, or internal auditor and IT Steering Committee.


Chapter VIII Outsourcing

Article 55. Commercial banks cannot contract out its regulatory obligations and should take reasonable care to supervise the discharge of outsourcing functions.

Article 56. Commercial banks should take particular care to manage material outsourcing arrangement (such as outsourcing of data center, IT infrastructure, etc.), and should notify CBRC when it intends to enter into material outsourcing arrangement.

Article 57. Before entering into, or significantly changing, an outsourcing arrangement, the commercial bank should:
(1) Analyze how the arrangement will fit with its organization and reporting structure; business strategy; overall risk profile; and ability to meet its regulatory obligations;
(2) Consider whether the arrangements will allow it to monitor and control its operational risk exposure relating to the outsourcing;
(3) Conduct appropriate due diligence of the service provider’s financial stability, expertise and risk assessment of the service provider, facilities and ability to cover the potential liabilities;
(4) Consider how it will ensure a smooth transition of its operations from its current arrangements to a new or changed outsourcing arrangement (including what will happen on the termination of the contract); and
(5) Consider any concentration risk implications such as the business continuity implications that may arise if a single service provider is used by several firms.

Article 58. In negotiating its contract with a service provider, the commercial bank should have regard to ( but not limited to ):
(1) Reporting and negotiation requirements it may wish to impose on the service provider;
(2) Whether sufficient access will be available to its internal auditors, external auditors and banking regulators;
(3) Information ownership rights, confidentiality agreements and Firewalls to protect client and other information (including arrangements at the termination of contract);
(4) The adequacy of any guarantees and indemnities;
(5) The extent to which the service provider must comply with the commercial bank’s polices and procedures covering IT Risk;
(6) The extent to which the service provider will provide business continuity for outsourced operations, and whether exclusive access to its resources is agreed;
(7) The need for continued availability of software following difficulty at a third party supplier;
(8) The processes for making changes to the outsourcing arrangement and the conditions under which the commercial bank or service provider can choose to change or terminate the outsourcing arrangement, such as where there is:
a) A change of ownership or control of the service provider or commercial bank; or
b) Significant change in the business operations of the service provider or commercial bank; or
c) Inadequate provision of services that may lead to the commercial bank being unable to meet its regulatory obligations.

Article 59. In implementing a relationship management framework, and drafting the service level agreement with the service provider, the commercial bank should have regarded to (but not limited to):
(1) The identification of qualitative and quantitative performance targets to assess the adequacy of service provision, to both the commercial bank and its clients, where appropriate;
(2) The evaluation of performance through service delivery reports and periodic self assessment and independent review by internal or external auditors; and
(3) Remediation action and escalation process for dealing with inadequate performance.

Article 60. The commercial bank should enhance IT related outsourcing management, in place following (not limited to ) measures to ensure data security of sensitive information such as customer information:
(1) Effectively separated from other customer information of the service provider;
(2) The related staff of service provider should be authorized on “need to know” and “minimum authorization” basis;
(3) Ensure service provider guarantee its staff for meeting the confidential requests;
(4) All outsourcing arrangements related to customer information should be identified as material outsourcing arrangements and the customers should be notified;
(5) Strictly monitor re-outsourcing actions of the service provider, and implement adequate control measures to ensure information security of the bank;
(6) Ensure all related sensitive information be refunded or deleted from the service provider’s storage when terminating the outsourcing arrangement.


Article 61. The commercial bank should ensure that it has appropriate contingency in the event of a significant loss of services from the service provider. Particular issues to consider include a significant loss of resources, turnover of key staff, or financial failure of, the service provider, and unexpected termination of the outsourcing agreement.

Article 62. All outsourcing contracts must be reviewed or signed off by IT Risk management, internal IT auditors, legal department and IT Steering Committee. There should be a process to periodically review and refine the service level agreements.


Chapter IX Internal Audit

Article 63. Depending on the nature, scale and complexity of its business, it may be appropriate for the commercial banks to delegate much of the task of monitoring the appropriateness and effectiveness of its systems and controls to an internal audit function. An internal audit function should be adequately resourced and staffed by competent individuals, be independent of the day-to-day activities of the commercial bank and have appropriate access to the bank’s records.

Article 64. The responsibilities of the internal IT audit function are:
(1) To establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the bank’s systems and internal control mechanisms and arrangements;
(2) To issue recommendations based on the result of work carried out in accordance with 1;
(3) To verify compliance with those recommendations;
(4) To carry out special audit on information technology. The term “special audit” of information technology refers to the investigation, analysis and assessment on the security incidents of the information system, or the audit performed on a special subject based on IT risk assessment result as deemed necessary by the audit department.

Article 65. Based on the nature, scale and complexity of its business, deployment of information technology and IT risk assessment, commercial banks could determine the scope and frequency of IT internal audit. However, a comprehensive IT internal audit shall be performed at a minimum once every 3 years.

Article 66. Commercial banks should engage its internal audit department and IT Risk management department when implementing system development of significant size and scale to ensure it meets the IT Risk standards of the Commercial banks.


Chapter X External Audit

Article 67. The external information technology audit of commercial banks can be carried out by certified service providers in accordance with laws, rules and regulations.

Article 68. The commercial bank should ensure IT audit service provider to review and examine bank’s hardware, software, documentation and data to identify IT risk when they are commissioned to perform the audit. Vital commercial and technical information which is protected by national laws and regulations should not be reviewed.

Article 69. Commercial bank should communicate with the service provider in depth before the audit to determine audit scope, and should not withhold the truth or do not corporate with the service provider intentionally.

Article 70. CBRC and its local offices could designate certified service providers to carry out IT audit or related review on commercial banks when needed. When carrying out audit on commercial banks, as commissioned or authorized by CBRC or its local offices, the service providers shall present the letter of authority, and carry out the audit in accordance to the scope prescribed in the letter of authority.

Article 71. Once the IT audit report produced by the service providers is reviewed and approved by CBRC or its local offices, the report will have the same legal status as if it is produced by the CBRC itself. Commercial banks should come up with a correction action plan prescribed in the report and implement the corrective actions according to the timeframe.

Article 72. Commercial banks should ensure the service providers to strictly comply with laws and regulations to keep confidential and data security of any commercial secrets and private information learnt and IT risk information when conducting the audit. The service provider should not modify copy or take away any documents provided by the commercial banks.


Chapter XI Supplementary Provisions

Article 73. Commercial banks with no board of directors should have their operating decision-making bodies perform the responsibilities of the board with regard to IT risk management specified herein.

Article 74. The China Banking Regulatory Commission supervises and regulates the IT risk management of commercial banks under its authority by law.

Article 75. The power of interpretation and modification of the Guidelines shall rest with the China Banking Regulatory Commission.

Article 76. The Guidelines shall become effective as of the date of its issuance and the former Guidelines on the Risk Management of Banking Institutions’ Information Systems shall be revoked at the same time.


东营市工伤保险暂行办法

山东省东营市人民政府


东营市人民政府令第113号

  《东营市工伤保险暂行办法》业经市政府批准,现予发布施行。

         市长刘国信 二OO四年八月十三日

东营市工伤保险暂行办法

  第一条为了保障因工作遭受事故伤害或者患职业病的职工获得救治和经济补偿,促进工伤预防和职业康复,分散用人单位的工伤风险,根据国务院《工伤保险条例》(以下简称《条例》)和《山东省贯彻〈工伤保险条例〉试行办法》(以下简称《试行办法》)及有关规定,结合本市实际,制定本办法。
  第二条本市行政区域内的各类企业、有雇工的个体工商户(以下简称用人单位)应当依法参加工伤保险,为本单位全部职工或者雇工(以下简称职工)缴纳工伤保险费。
  有雇工的个体工商户参加工伤保险的具体实施办法另行制定。
  第三条市劳动保障行政部门负责本市的工伤保险工作。县(区)劳动保障行政部门负责本行政区域内的工伤保险工作。
  劳动保障行政部门按规定设立的社会保险经办机构(以下简称经办机构)具体承办工伤保险事务。
  第四条工伤保险基金实行全市统筹。
  第五条工伤保险费的征缴数额为用人单位全部职工上年度平均工资总额乘以单位缴费费率。其中,职工平均工资高于统筹范围内参保企业职工平均工资300%的,按照统筹范围内参保企业职工平均工资的300%计算;职工平均工资低于统筹范围内参保企业职工平均工资60%的,按照统筹范围内参保企业职工平均工资的60%计算。
  用人单位应当于每年5月15日前缴纳本单位当年全年的工伤保险费。
  用人单位进行工伤保险登记、申报和缴纳工伤保险费用,应当根据纳税登记情况到市或者县(区)相应的经办机构办理。
  第六条工伤保险实行基准费率:一类行业为用人单位职工工资总额的0.5%;二类行业为用人单位职工工资总额的1%;三类行业为用人单位职工工资总额的2%。
  用人单位属一类行业的,按行业基准费率缴费。
  用人单位属二、三类行业的,费率实行浮动。用人单位的初次缴费费率,按行业基准费率确定,以后由经办机构根据用人单位工伤保险费使用、工伤发生率、职业病危害程度等因素,一至三年浮动一次。浮动费率的确定及调整办法由市劳动保障行政部门会同市财政、卫生、安监部门制定。
  用人单位的初次缴费费率,由经办机构根据用人单位《企业法人营业执照》或者《营业执照》登记的经营范围,对照工伤保险行业费率标准确定。经营范围跨行业的,按照经营的最高风险行业的差别费率档次确定。
  第七条工伤保险基金按照以支定收、收支平衡的原则筹集,存入社会保障基金财政专户,专款专用。工伤保险基金应当用于下列支出:
  (一)工伤医疗费;
  (二)一至四级工伤人员伤残津贴;
  (三)一次性伤残补助金;
  (四)生活护理费;
  (五)丧葬补助金;
  (六)供养亲属抚恤金;
  (七)一次性工亡补助金;
  (八)工伤职工劳动能力鉴定费;
  (九)职业康复费;
  (十)辅助器具费;
  (十一)疾病与工伤因果关系鉴定费;
  (十二)法律、法规规定的用于工伤保险的其他费用。
  第八条工伤保险基金应当留有一定比例的储备金,用于重大事故的工伤保险待遇支付。工伤保险储备金按统筹地区当年工伤保险基金征缴额10%的比例提取,储备金累计结余额不得超过当年工伤保险基金征缴额的30%。
  工伤保险储备金的使用由市劳动保障行政部门提出意见,报经市人民政府批准。储备金一经使用,应当及时补足差额。储备金不足支付的,由市人民政府垫付。
  第九条设立市劳动能力鉴定委员会,由市劳动保障部门、人事部门、卫生部门、工会组织、经办机构代表以及用人单位代表组成,承担以下鉴定或者确认工作:
  (一)工伤职工劳动能力鉴定;
  (二)停工留薪期限的确认;
  (三)疾病与工伤因果关系的鉴定;
  (四)供养亲属完全丧失劳动能力鉴定;
  (五)职工因病或者非因工伤残丧失劳动能力程度鉴定;
  (六)法律、法规规定的其他劳动能力鉴定事项。
  市劳动能力鉴定委员会在市劳动保障行政部门设立劳动能力鉴定委员会办公室,由专人负责劳动能力鉴定委员会日常工作和劳动能力鉴定组织管理工作。
  第十条市劳动能力鉴定委员会建立医疗卫生专家库。列入专家库的医疗卫生专业技术人员,由市劳动能力鉴定委员会选聘。医疗卫生专家库每年调整一次。
  第十一条职工治疗工伤,应当在签订服务协议的医疗机构就医。情况紧急时可以先到就近的医疗机构抢救,并于5日内向经办机构备案;伤情稳定后尚需继续治疗的,应当及时转入协议医疗机构治疗。
  除前款规定情形外,工伤职工未经批准在非协议医疗机构就医,发生的医药费用工伤保险基金不予支付。
  工伤保险诊疗项目目录、药品目录、住院服务标准参照医疗保险有关规定执行。国家、省有专门规定时,从其规定。
  第十二条职工发生工伤后,按照《条例》和《试行办法》的有关规定享受工伤保险待遇。
  一次性伤残补助金、伤残津贴、供养亲属抚恤金以本人工资为基数计算,本人工资高于统筹范围内参保企业职工平均工资300%的,按照统筹范围内参保企业职工平均工资的300%计算;本人工资低于统筹范围内参保企业职工平均工资60%的,按照统筹范围内参保企业职工平均工资的60%计算。
  生活护理费、丧葬补助金以统筹范围内参保企业上年度职工平均工资为基数计算。
  职工因工死亡的,以统筹范围内参保企业上年度职工月平均工资为基数,发给48-60个月的一次性工亡补助金。其中,无供养亲属的48个月;有供养亲属,供养一人的52个月,供养两人的56个月,供养三人以上的60个月。
  第十三条用人单位欠缴工伤保险费期间,职工因工作遭受事故伤害或者患职业病,工伤保险待遇由用人单位支付。
  第十四条职工在用人单位工作不满1年因工作遭受事故伤害或者患职业病,按实际工作月份的本人月平均工资为基数计算工伤保险待遇。
  第十五条有下列情形之一的,有关单位和个人可以依法申请行政复议;对复议决定不服的,可以依法提起行政诉讼:
  (一)申请工伤认定的职工或者其直系亲属、该职工所在单位对工伤认定结论不服的;
  (二)用人单位对经办机构确定的单位缴费费率不服的;
  (三)签订服务协议的医疗机构、辅助器具配置机构认为经办机构未履行有关协议或者规定的;
  (四)工伤职工或者其直系亲属对经办机构核定的工伤保险待遇有异议的。
  第十六条本办法自颁布之日起施行。