35.240.40 信息技术在银行中的应用 标准查询与下载

T/BFIA 021.3-2023 移动支付 应用基础 第3部分：支付应用标识符

本文件规定了移动支付应用标识符的编码规则。 本文件适用于移动支付领域中的支付系统、收单系统、可信服务管理系统、公共服务平台、转接清算系统、账户管理系统等的开发和维护方进行移动支付报文的设计、开发及数据交换，用于标识移动支付及相关应用。

Mobile payment—Application basis— Part 3: Payment application identifier

T/BFIA 022-2023 移动支付　非接触式接口规范

本文件规定了移动支付应用中非接触式接口的电源管理、物理特性、射频功率和信号接口。 本文件适用于与金融安全单元（SE）非接触式接口相关的设计、制造、管理以及应用系统的研制、开发、集成和维护等组织。本文件也适用于检测认证机构对相关产品、应用系统进行安全性和标准符合性测试和认证。

Mobile payment—Contactless interface specification

23/30471938 DC BS ISO 20038 银行及相关金融服务 使用 AES 的密钥包装

BS ISO 20038. Banking and related financial services. Key wrap using AES

YD/T 4234-2023 基于可信执行环境的安全计算系统技术框架

本文件定义了基于可信执行环境的安全计算系统的技术框架，对基于可信执行环境的安全计算系统的概述、技术架构、技术特性、安全要求等进行规范。 本文件适用于基于可信执行环境的安全计算系统的设计、开发、测试、运维等。

Technical Framework of Secure Computing System Based on Trusted Execution Environment

BS ISO 11568:2023 金融服务 密钥管理（零售）

1   Scope 1.1   General This document describes the management of symmetric and asymmetric cryptographic keys that can be used to protect sensitive information in financial services related to retail payments. The document covers all aspects of retail financial services, including connections between a card-accepting device and an Acquirer , between an Acquirer and a card Issuer , and between an ICC and a card-accepting device. It covers all phases of the key life cycle, including the generation, distribution, utilization, archiving, replacement and destruction of the keying material . This document covers manual and automated management of keying material , and any combination thereof, used for retail financial services. It includes guidance and requirements related to key separation, substitution prevention, identification, synchronization, integrity, confidentiality and compromise , as well as logging and auditing of key management events. Requirements associated with hardware used to manage keys have also been included in this document.

Financial services. Key management (retail)

ISO 11568:2023 金融服务-密钥管理（零售）

1.1 General This document describes the management of symmetric and asymmetric cryptographic keys that can be used to protect sensitive information in financial services related to retail payments. The document covers all aspects of retail financial services, including connections between a card-accepting device and an Acquirer, between an Acquirer and a card Issuer, and between an ICC and a card-accepting device. It covers all phases of the key life cycle, including the generation, distribution, utilization, archiving, replacement and destruction of the keying material. This document covers manual and automated management of keying material, and any combination thereof, used for retail financial services. It includes guidance and requirements related to key separation, substitution prevention, identification, synchronization, integrity, confidentiality and compromise, as well as logging and auditing of key management events. Requirements associated with hardware used to manage keys have also been included in this document. 1.2 Scope exclusions This document does not specifically address internet banking services offered by an Issuer to their own customers through that financial institution's website or applications. This document does not address using asymmetric keys to encrypt the Personal Identification Number (PIN) or any other data and does not address asymmetric keys managed with asymmetric keys. This document is not intended to apply to the management of the keys installed in an ICC during manufacturing or the initial key established in an ICC during card personalization. This document is not intended to address post-quantum encryption considerations. Key management using quantum technologies is out of scope of this document.

Financial services — Key management (retail)

BS ISO 13491-2:2023 金融服务 安全加密设备（零售） 金融交易中使用的设备的安全合规性清单

1   Scope This document specifies checklists to be used to evaluate secure cryptographic devices (SCDs) incorporating cryptographic processes as specified in ISO 9564‑1, ISO 9564‑2, ISO 16609, and ISO 11568 in the financial services environment. Integrated circuit (IC) payment cards are subject to the requirements identified in this document up until the time of issue, after which they are to be regarded as a “personal” device and outside of the scope of this document.

Financial services. Secure cryptographic devices (retail). Security compliance checklists for devices used in financial transactions

T/IQA 19-2023 政企产品用户界面设计指南

本标准适用于面向政企行业提供的可视化软件产品的用户体验设计框架及用户界面设计指南。覆盖的包括桌面端（pc端、web端）、移动端在内的常见交互终端。主要实际内容是1）设计原则：根据政企行业场景特点，形成体验设计原则，指导用户界面设计；2）界面要素：包括色彩、文字、布局、图标等通用界面设计要素的设计指南；3）组件：针对桌面端、移动端的设计组件提出设计标准和要求。4）典型模式：针对政企场景中的典型场景提出体验设计的注意事项和设计要点，为典型的业务场景提供通用的体验设计解决方案。

User Interface Design guideline for Government and Enterprise Products

ISO 13491-2:2023 银行业务 安全加密设备(零售) 第2部分:磁片系统用装置安全一致性检查

This document specifies checklists to be used to evaluate secure cryptographic devices (SCDs) incorporating cryptographic processes as specified in ISO 9564-1, ISO 9564-2, ISO 16609, and to the requirements identified in this document up until the time of issue, after which they are to be regarded as a “personal” device and outside of the scope of this document.

Financial services — Secure cryptographic devices (retail) — Part 2: Security compliance checklists for devices used in financial transactions

JR/T 0263-2022 机器学习金融应用技术指南

Machine Learning Financial Application Technical Guide

T/ZSA 122-2022 物联网 智慧银行网点管控系统技术要求

本文件规定了基于物联网的智慧银行网点管控系统的总体架构，系统功能与技术要求，系统安全要求，系统扩展性要求及其它要求等。 本文件适用于银行网点的智能化建设、升级与管理以及智能化营销等。

Internet of things-Technical requirements of management and control system for smart bank branch

T/CCUA 018-2022 不良资产管理领域知识图谱 技术要求

本文件确立了不良资产管理领域知识图谱技术架构框架由源数据、数据处理、知识抽取及知识融合、图谱中心、知识推理、应用技术及业务场景等六个层次组成，并规定了相应的技术要求，包括知识图谱系统运维和安全管理的相关要求。

Knowledge graph for non-performing assets management——Technical requirement

BS ISO 16609:2022 金融服务 使用对称技术的消息认证的要求

1   ​Scope This document specifies procedures, independent of the transmission process, for protecting the integrity of transmitted financial-service-related messages and for verifying that a message has originated from an authorized source, or that stored data has retained integrity. A list of block ciphers approved for the calculation of a message authentication code  ( MAC ) is also provided. The authentication methods defined in this document are applicable to stored data and to messages formatted and transmitted both as coded character sets or as binary data. This document is designed for use with symmetric algorithms where both sender and receiver use the same key. It does not specify methods for establishing the shared key. Its application will not protect the user against internal fraud perpetrated by the sender or the receiver , nor against forgery of a MAC by the receiver .

Financial services. Requirements for message authentication using symmetric techniques

T/BFIA 013-2022 面向新型金融应用的全IP数据中心网络技术要求

本文件规定了面向新型金融应用的全IP数据中心网络部署架构和关键技术要求。 本文件适用于银行业机构金融数据中心网络建设，可供保险、证券等其他金融机构参考。

Technical requirements for all-IP data center network for new financial applications

T/BFIA 015-2022 金融科技智能服务终端（FIST）技术要求

本文件规定了具有金融数字化资产查询、交易、支付等应用功能的金融科技智能终端（智能POS、ATM、智能支付终端、智能自助终端）的硬件、软件、技术应用和安全要求。 本文件适用于金融科技智能服务终端的设计、生产及应用。

Financial Technology Intelligent Service Terminal (FIST) Technical Requirements

T/BFIA 016-2022 商业银行应用程序接口共享平台技术要求

本文件规定了商业银行应用程序接口共享平台逻辑结构、功能架构、技术要求和安全要求。 本文件适用于商业银行应用程序接口共享平台的建设及应用。

Technical Requirements for Application Programming Interface Sharing Platform of Commercial Banks

T/BFIA 014-2022 金融技术产品开源项目管理指南

本文件给出了金融机构将自研技术产品进行对外开源时，在体系建设、流程管理、资源配置、运营等方面的指导。 本文件适用于银行业机构对技术产品实施自主开源，可供保险、证券等其他金融机构参考。

A Guide to Open Source Project Management for Financial Technology Products

T/ISC 0015-2022 金融场景隐私保护计算平台 技术要求与测试方法

本文件规定了隐私保护计算平台应用于金融领域的安全性、性能和功能等技术要求内容，并给出了技术要求对应的测试方法。 本文件适用于银行、证券、保险等金融机构及相关合作机构隐私保护计算平台的设计、开发、测试和评估，也适用于第三方机构对金融场景隐私保护计算平台开展的检查、测试和评估工作。

Technical requirements and test methods for privacy protection computing platform in financial scenarios

ISO 16609:2022 金融服务.使用对称技术的消息认证要求

Financial services — Requirements for message authentication using symmetric techniques

T/ZJQYXXH 001-2022 金融风控实时计算系统技术要求与测试方法

本标准适用于金融风控实时计算系统的设计、研发、测试、评估和验收等。金融风控实时计算系统的主要功能是为交易反欺诈、反洗钱、授信风险管控等金融风控业务提供指标实时计算能力，支持多种数据在线分析和挖掘的手段，对实时数据进行全生命周期的管理。

Technical requirements and test method on real time computing system of financial risk control