Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 185

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 185
---
 the scope of GDS Beijing’s IDC license and enable GDS Suzhou’s IDC license to cover internet resources collaboration services, fixed network domestic data transmission services and domestic internet virtual private networks service which, among other things, enable us to provide connectivity services over our own network to cloud and enterprise customers colocated in all of our data centers.

Regulations Related to Information Technology Outsourcing Services Provided to Banking Financial Institutions

On June 4, 2010, the CBIRC issued the Guidelines on the Management of Outsourcing Risks of Banking Financial Institutions, or the Guidelines, which requires that the banking financial institutions should manage risks in relation to outsourcing services, and thus, outsourcing services providers should meet the relevant standards and requirements with respect to their technical strength, service capacity, emergency response capacity, familiarity to the banking industry and etc., to pass the due diligence investigations conducted by the banking financial institutions pursuant to the Guidelines, and should also make commitments as to fulfilling reporting, cooperating, or other obligations as may be required by the banking financial institutions under the Guidelines.

Table of Contents

On December 30, 2021, the CBIRC issued Notice of the General Office of the China Banking and Insurance Regulatory Commission on Issuing the Measures for the Regulation of Risks in the Information Technology Outsourcing by Banking and Insurance Institutions, or Circular 141. Circular 141 puts forward comprehensive requirements for IT outsourcing of banking and insurance institutions, including the requirements on IT outsourcing governance, access, monitoring and evaluation, risk management. According to such measures, IT outsourcing refers to the activities that banking and insurance institutions entrust the information technology activities originally handled by themselves to service providers for processing. According to Circular 141, the CBIRC is responsible for supervising banking and insurance institutions in their access management of information technology outsourcing service providers conducting risk assessment and rating of such service providers and establishing a risk monitoring and verification mechanism. For the outsourcing services providers, including those that are engaged in providing outsourcing services of operation and maintenance, such as outsourcing of operation and maintenance of the physical environment data centers (machine room), and etc., a banking and insurance institution shall submit a report to the CBIRC or the local CBIRC office 20 business days before entering into an outsourcing contract, and the CBIRC or the local CBIRC office may take measures, such as risk alert, interview, regulatory inquiry or requiring the banking and insurance institution to suspend or stop relevant outsourcing activities, for outsourcing risks of the banking and insurance institution if the outsourcing services are with high risks. Outsourcing service providers may not