2026.11.05. The Fair Economy — The Financial Services Commission and the financial industry discussed ways to overhaul the sector's security system for the artificial intelligence (AI) era. Key agenda items included a full inspection of external access points and internal controls at about 580 companies, a requirement that large financial firms conduct vulnerability analysis and assessments at least twice a year, and the launch of a task force to fully lift network separation regulations.
The Financial Services Commission held a meeting titled "Financial Industry Conference on Overhauling the Security System for the AI Era" on Nov. 5 at the Financial Security Institute's Yeouido branch, presided over by FSC Chairman Lee Eok-won.
Attendees included the Senior Deputy Commissioner and the Deputy Commissioner of Digital and IT at the Financial Supervisory Service (FSS), the head of the Financial Security Institute (FSI) and the head of its Cyber Response Headquarters, and the director of the Financial AI Security Research Institute. Heads of industry associations for banks, life insurance, non-life insurance, financial investment, and specialized credit finance also attended, along with the central heads of the Korea Federation Of Saving Banks, the National Credit Union Federation of Korea, NH, the National Federation of Fisheries Cooperatives, and the Korean Federation of Community Credit Cooperatives. Heads of associations for virtual assets, electronic finance, and online lending were present as well. For cross-governmental coordination, representatives from the Office for Government Policy Coordination Prime Minister's Secretariat, the Ministry of Science and ICT, the Ministry of the Interior and Safety, the PIPC, the Korea Communications Commission, the Korea National Police Agency, Kisa, and a private technical advisory panel also took part.
From Sept. 30, when a breach in the financial sector was first confirmed, through Nov. 3, 40 incidents were reported at 37 companies. By sector, these included 10 electronic finance firms, five financial investment firms, five savings banks, four banks, four online investment-linked finance firms, three insurers, three virtual asset firms, two credit-specialized finance firms, and one mutual finance company. After a checklist inspection of the entire financial sector was completed on Oct. 14, reports came mostly from small and midsize securities firms, insurers, electronic finance businesses, online investment-linked finance businesses, and virtual asset exchanges.
About 473,000 cases of information leakage were identified. These mostly involved employee information and customers' names, resident registration numbers, and account numbers, while no leakage was confirmed of information such as account passwords that could enable fraudulent payments.
Some small virtual asset exchanges, electronic finance businesses, and online investment-linked finance businesses reported the theft of about 1 billion won (about $680,000) in funds. Transfers occurred from accounts where companies pool customer funds together, such as virtual asset hot wallets, consumption points, and online investment-linked finance deposits, and losses did not materialize for individual users' funds. On Nov. 2, the Financial Services Commission and the Financial Supervisory Service held an emergency inspection meeting with the Digital Asset eXchange Alliance (DAXA) and major virtual asset operators, and called for thorough management measures in the virtual asset industry. The government issued a consumer alert and action guidelines on Oct. 6, and has also strengthened monitoring of suspicious transactions.
The full inspection covers about 580 companies, including all financial firms and electronic finance businesses as well as virtual asset operators. It also includes the virtual asset industry, which is not subject to the Electronic Financial Transactions Act. Recent hacking attacks have focused not on core systems with tight security but on external access points in internal employee web and mobile services used for sales and consultation, which are poorly managed due to staffing limits. "Weak links" such as inadequate authority management, bypassed two-factor authentication, and poor management of application programming interfaces (APIs) accounted for much of the damage.
Accordingly, authorities will inspect every area of operation that can be accessed from outside, including customer-facing services such as websites as well as employee management, internal operations, and partnership work. Specific targets include authentication and access control systems overall, APIs used for sales and management purposes, software including open-source software, and development, testing, and temporary operation systems.
The internal control inspection will examine whether companies have internal regulations in place, whether internal controls such as approval, authorization, and reporting procedures function properly, whether they maintain registers of IT assets and services, and whether they conduct vulnerability analysis and assessment and security monitoring. The roles of the chief executive officer (CEO), chief information security officer (CISO), and chief information officer (CIO) are also inspection items. Financial firms must first conduct self-inspections, and even if no problems are found, they must detail their inspection methods and the reasoning behind their findings. Registers will be reviewed again, with any omitted services added before inspection. If the findings are inadequate or significant vulnerabilities emerge, the Financial Supervisory Service and the Financial Security Institute will conduct on-site inspections.
Unnecessary external connections must be immediately blocked, and vulnerabilities that could lead to financial damage or personal information leakage, such as viewing other users' information, must be addressed by suspending the service until remediation. Important services that cannot be immediately remediated may be resumed under CEO approval and responsibility with compensating controls, along with CISO reporting and approval by the board of directors. Registration of systems in the management log must be completed by November 30, and full inspections of unregistered systems and internal controls by December 31. The FSS will provide detailed items and inspection methods separately.
Under the current vulnerability analysis and assessment system, financial firms receive an inspection from an outside institution at least once a year and submit the results to financial authorities. Because the inspection cycle is long and the scope of external checks is not clearly defined, it has been difficult to examine peripheral systems, and there have been few means to enforce follow-up corrections. The Financial Services Commission plans to shorten the cycle from once to twice a year, starting with large financial firms, and to expand the scope to cover all external access points directly or indirectly related to electronic financial transactions.
The government will also establish grounds for financial regulators to request evaluations at any time when emergency checks are needed. An amendment to the Electronic Financial Supervision Regulations including this will be announced as a regulatory change in November. An amendment to the Electronic Financial Transactions Act, which allows corrective orders for long-neglected significant vulnerabilities and imposes enforcement fines for non-compliance, has already been submitted to the National Assembly, with plans to support its passage within the year.
For small and midsize financial firms, in addition to support through the Financial AI Security Research Institute and support centers, the Financial Security Institute will roll out its "one-stop AI defense service" starting in December. The service uses AI to continuously scan for external access points and vulnerabilities, and provides risk priorities along with response measures. It also offers "customized security guides" that tailor response measures to a firm's security capacity, as well as a tiered alert system. To prevent secondary damage, authorities will continuously monitor the dark web and Telegram for the distribution of stolen information, signs of planned intrusion attacks, and the emergence of new malware.
An AI-based phishing index will rate the likelihood that a transaction is linked to voice phishing on a scale of 0 to 100. It will be piloted starting in November on the financial sector's voice phishing information-sharing and analysis platform, ASAP (AI-based Anti-phishing Sharing & Analysis Platform). The index is also expected to boost detection capabilities at small and midsize firms such as mutual finance companies and savings banks.
The task force on fully lifting network separation regulations is to include government officials, related institutions, private-sector experts, and executives in charge from across the financial industry. It will discuss alternative security measures such as managing and protecting data according to its level of importance and "Zero Trust," which continuously verifies all access. It will also cover the roles and responsibilities of CEOs, boards, and CISOs, as well as ways to ensure business continuity to maintain core services in the event of a breach.
Financial authorities have allowed exceptions to network separation rules for the use of AI and software-as-a-service (SaaS) since September 2024, and made the SaaS-related exception permanent in April this year. They will also permanently institutionalize the relaxed rules for using AI for security purposes, which are currently being implemented on an emergency basis through no-action letters.
Based on the results of the full inspection, the Financial Services Commission plans to develop and implement "security internal control guidelines" in the first quarter of next year. Management shortcomings uncovered during the inspection will be handled as flexibly as possible, on the condition that they are immediately corrected. However, if a breach occurs after an inspection, authorities will strictly hold firms accountable, including examining whether the inspection itself was properly conducted. FSC Chairman Lee Eok-won asked CEOs across the financial industry to immediately form company-wide emergency response teams to address the full inspection and system improvement tasks.
Earlier, financial regulators announced that in a 12-item security checklist check of 555 financial firms on October 14, 130 firms (23.4%) were found inadequate. Issues cited included failure to apply the latest security patches, inadequate management of aging systems whose manufacturer technical support had ended, and lack of a 24-hour security monitoring system.
At the time, breaches had been confirmed at 16 companies with about 100,000 cases of information leakage, but the scale of damage has since grown significantly. Amid controversy over whether the inspection was effective, Financial Supervisory Service Governor Lee Chan-jin said on Oct. 19, during a National Assembly National Policy Committee audit, that a full re-inspection would be conducted.
The current Act on Protection of Virtual Asset Users requires operators to keep at least 80% of user assets in cold wallets and to take out insurance or mutual aid coverage, or set aside reserves. However, it does not directly stipulate separate liability for damages. A bill that would hold operators liable for damages in the event of hacking is pending at the National Assembly's National Policy Committee, and financial authorities are also reviewing a no-fault liability provision.
0 Comments
No comments yet.