15. Commercial banks shall employ for their business practices in the PFTZ qualified senior managers, risk managers, compliance managers, internal auditors and traders with specialized skills, work experiences and a sound knowledge of laws and regulations, trading rules and risk profiles in overseas markets.

16. Commercial banks shall have in place a management information system in support of their business operations and risk management activities in the PFTZ. The system shall be at least capable of:

(1) Supporting the internal control throughout all business operations in the PFTZ;

(2) Measuring risks and evaluating financial instruments;

(3) Calculating accurately at a specified frequency the regulatory indicators and risk monitoring indicators to meet the requirements for internal and regulatory reporting, and adjusting as necessary the frequency of calculation and reporting;

(4) According to the regulatory and internal management requirements, monitoring limits management at opportune times and establishing a precautionary mechanism to prevent any limits breach and meet the requirements for limits management;

(5) Ensuring that their head offices and supervisory institutions for the PFTZ-related business have timely and complete access to the accurate information of risk management and take control measures as appropriate before certain transactions are called off;

(6) Assisting in identifying inappropriate clients or transactions and providing real-time monitoring and control over abnormal cross-border fund flows;

(7) Supporting stress testing under different scenarios.

17. Commercial banks shall properly set performance evaluation methods and indicators for their activities in the PFTZ. The design of performance evaluation shall take into full account the requirements of transforming development modes and shall avoid the practice of focusing on speed only without emphasis on quality or risks.

18. Commercial banks shall conduct at least once a year internal auditing for their business practices in the PFTZ to review and assess the appropriateness of their risk management policies and the effectiveness of their internal control, and deliver the auditing results to CBRC Shanghai Bureau.