information to the general manager, the board of directors or the auditing committee thereof through the reporting channels as determined by the board of directors; and

(4) Other rights as determined by the board of directors.

Article 16 An insurance company shall equip the compliance department or the compliance posts with sufficient compliance personnel. The compliance personnel shall possess qualifications and experience corresponding to their posts and duties, with professional knowledge in law, insurance, accounting and finance, and, especially, shall be capable of correctly understanding laws, regulations, self-discipline rules of the industry and the internal management system of the company. In order to constantly improve their special skills, the insurance company shall provide systematic education and training on a regular basis.

The board of directors and senior managers shall support the compliance department, compliance posts and compliance personnel in performance of their working duties, and take measures to effectively protect them from being unfairly treated when performing duties.

Article 17 An insurance company shall equip the compliance department in its head office with full-time compliance personnel. An insurance company shall do the same for the compliance department or the compliance posts of its branch offices when conditions permit.

Article 18 Compliance is the responsibility of not only the compliance department, compliance posts and the professional compliance personnel, but also each employee and each marketing staff member. The departments and branch offices of an insurance company shall, within their respective scope of functions and duties, assume direct and primary responsibility for compliance management.

All departments and branch offices shall voluntarily carry out self-inspections on compliance as a routine task, report compliance risk information or potential risks to the compliance department or the compliance posts, and support and cooperate with the compliance department or the compliance posts in risk monitoring and evaluation.

The compliance department or compliance posts shall provide compliance support to the business activities done by any other department, branch office or any employee and marketing staff, and assist and direct each department or branch office to set down the post compliance manual for compliance management.

Article 19 A cooperation mechanism between the compliance department and other risk management departments shall be established by an insurance company.

Other risk management departments shall take charge of identifying and evaluating various kinds of risks, including their own compliance risks, and reporting related compliance risk information to the compliance department, and shall support the compliance department to monitor and evaluate compliance risk.

Article 20 The compliance department of an insurance company shall be managed separately from the internal auditing department and be under independent audit conducted by the latter on a regular basis.

A definite mechanism for cooperation and information communication between the compliance department and the internal auditing department shall be established by an insurance company. The internal auditing department shall inform the compliance department of the auditing situation and conclusion upon completion of the internal auditing, while the latter may, in light of the compliance risk monitoring situation, take the initiative to propose auditing suggestions to the former.

Chapter IV Compliance Management

Article 21 An insurance company shall set down compliance policies and shall report them to the CIRC for archival purpose after they are deliberated and approved by the board of directors.

A compliance policy, as a programmatic document for the compliance management of an insurance company, shall at least contain the contents as follows:

(1) The company's objective and basic principles of compliance management;

(2) The compliance culture advocated by the company;

(3) The compliance duties assumed by the board of directors and senior managers;

(4) The framework of compliance management and routes for reporting information;

(5) The status and duties of the compliance department; and

(6) The major procedures for identifying and managing compliance risk.

An insurance company shall, on an annual basis, evaluate its compliance policies and shall, in light of the actual needs, revise them.

Article 22 An insurance company shall set down conduct norms for its employees and marketing staff, the post compliance manual and other documents, bring the compliance policies into force, and guide its employees and marketing staff to exercise such policies.

The conduct norms for employees and marketing staff shall stipulate the basic norms that must be observed by all employees and marketing staff, and may put forward special requirements for directors, supervisors and senior managers. The post compliance manual shall prescribe the business operation procedure and norms of each post.

Article 23 An insurance company shall definitely prescribe the compliance risk reporting routes that must include: the routes for the marketing staff, other departments and employees to make report to the compliance department or the compliance posts, the routes for the compliance department or compliance posts at each level to make report to the higher level, and the routes for the compliance department or compliance posts and the compliance chief to make report to the general manager, the board of directors and the auditing committee thereof.

The insurance company shall also prescribe the duties of each person or institution related to a reporting route, the contents, way and frequency of such report and the requirements for report receivers to either directly deal with them or further report them to the higher level.

Article 24 An insurance company shall identify, evaluate and monitor compliance risks in the aspects as follows:

(1) Such insurance business behavior as advertisement, product development, sale, insurance acceptance, claim settlement, preservation, anti-money-laundering, customer service and handling of customer complaints;

(2) Such insurance fund operation behavior as guarantee, financing and investment;

(3) Such behavior as establishment, alteration, merger, cancellation and strategic cooperation of insurance institutions;

(4) Internal management decision-making behavior and behavior for implementing rules and systems of the company; and

(5) Other behavior that may result in compliance risks.

Article 25 Before important internal management systems or business procedures are issued for implementation, they shall be