The Financial Services Commission held a meeting on November 5 with officials from related ministries, organizations, and financial industry groups to discuss measures to strengthen cyber defense framework in the financial sector to better respond to growing hacking threats driven by artificial intelligence (AI).
Background
Between September 30 and November 3 this year, there were 37 financial companies and 40 cases of hacking incidents reported throughout all financial sectors—four banks, five financial investment businesses, three insurance companies, five savings banks, one mutual finance business, two specialized credit finance businesses, four online peer-to-peer (P2P) loan service providers, ten electronic financial service providers, and three virtual asset service providers.
The extent of personal information breach currently stands at about 473,000 cases, mostly pertaining to the information about employees, and the names, resident registration numbers, and account numbers of customers. However, there have been no reported incidents of customers’ account passwords being stolen thus far.
In this regard, the government has instructed financial companies to ensure consumer protection and bolster the monitoring over suspicious transactions activities and take all necessary steps to prevent secondary damages.
Some smaller sized companies in the virtual asset, electronic financial services, and online P2P lending sectors reported loss of funds amounting to a total of about KRW1 billion so far. However, the stolen money was mostly from their management accounts and individual users were not found to have accrued any loss of funds as yet.
Based on the strict liability rule under the Electronic Financial Transactions Act and the insurance and reserve requirements under the Act on the Protection of Virtual Asset Users, the FSC and the Financial Supervisory Service (FSS) will make sure to thoroughly supervise and guide the affected companies for consumer protection.
Key Measures
At today’s meeting, officials discussed ways to (a) fix the inadequacies and vulnerabilities observed in financial companies’ cybersecurity management, (b) bolster management to prevent the occurrence of secondary damages, and (c) establish a new and more appropriate cyber defense framework suitable for the AI era.
I. Improving Inadequacies and Vulnerabilities
a) Performing rigorous inspections on external contacts and internal control systems
Authorities will quickly but thoroughly inspect the operation of financial companies’ external contact points (APIs, etc.) and internal control systems across all traditional and nontraditional financial sectors. About 580 business entities are subject to the inspection of their websites and the staff management, internal work, and affiliated work programs that are accessible from an external contact point. Authorities will look into the certification and access control systems, sales and management APIs, web development and test operation systems, and other peripheral systems to see whether there are inadequacies and vulnerabilities in their cyber defense systems.
Authorities will also look into financial companies’ internal control mechanisms regarding their cybersecurity management. The role and responsibility of each executive officer (CEO, CISO, CIO, etc.), internal process for making decisions, and the maintenance of a register for IT asset management will be closely scrutinized.
If there are vulnerabilities identified in the process of inspection, financial companies are instructed to immediately suspend their service operation and cut off external contact points.
The inspection on external contact points (for registered IT assets) will be completed by the end of November, while the examination of internal control mechanisms will be wrapped up by the end of this year. In addition, authorities will work to prepare a set of guidelines on the internal control of financial companies for cybersecurity in the first quarter of 2027.
b) Making improvements to financial sector’s joint anti-hacking control system
Authorities will work to establish a joint anti-hacking control system where individual financial companies can quickly disseminate and share across all financial sectors any information pertaining to potential data breaches or hacking attempts. Large-sized financial companies that are more capable of operating their own monitoring and detection systems will share potential hacking information with all financial sectors through the joint anti-hacking control system (“FIRST” operated by the FSS). This will go on a pilot operation in December and adopted by all financial sectors in the first quarter of next year.
Under the current regulatory framework, certain types of business entities such as virtual asset service providers are not obligated to immediately report data breaches or hacking attacks to the financial authorities but are only required to report to the Korea Internet & Security Agency (KISA). Since virtual asset service providers are closely linked to all financial sectors and their reporting is deemed to be crucial for effective investigation, quick dissemination of information, and consumer protection, authorities will seek to prepare guidelines in November to require virtual asset service providers to immediately report to the financial authorities if there are hacking attacks.
c) Upgrading financial companies’ vulnerability screening and evaluation system
Under the current Electronic Financial Transactions Act, financial companies are required to have a third-party evaluation on their IT systems to check vulnerabilities and report to the financial authorities once every year. This third-party evaluation requirement will be strengthened to twice every year for large-sized financial companies at first. The scope of evaluation will include all external contact points that are directly or indirectly linked to electronic financial transactions. Additionally, there will be a regulatory ground established to enable the financial authorities to more frequently look into the vulnerabilities of financial companies in critical situations.
Relevant rule changes to the supervisory regulations on electronic financial services will be sought within November this year.
d) Expanding support for small- and medium-sized financial companies
There will be multidimensional support provided to small- and medium-sized financial companies to help bolster their AI hacking response capabilities. The Financial Security Institute (FSI) will assist them with the one-stop AI cyber defense service program and provide them with individually tailored cyber defense guidelines. The FSI will also offer step-by-step alert scenarios and action plans in accordance with different threat levels. These cybersecurity assistance programs will be made available in stages starting from December this year.
II. Enhancing Cyber Defense Management to Prevent Secondary Damages
a) Monitoring and preventing circulation of stolen personal data
Authorities will strengthen the monitoring of dark web marketplaces to make sure to prevent the circulation of stolen personal information online for illicit activities, such as voice phishing and identity theft. Through a 24-hour monitoring of online spheres, authorities will seek to find any illicit circulation of stolen personal data in the financial sector, whether there are any attempted cyberattacks targeting financial companies, and whether there are any new malware or cyber defense vulnerabilities. In close cooperation with related ministries, if any illegal circulation of stolen personal information is detected, it will be effectively blocked by suspending access to relevant websites and quickly identifying offenders.
b) Expanding ASAP’s utility
The government’s concerted and collective voice phishing response framework made possible through the previously launched AI-based anti-phishing Sharing & Analysis Platform (ASAP) will be strengthened. There will be improvements made to the ASAP’s analysis functions to more quickly identify and freeze the accounts involved in criminal activities. More specifically, an AI-driven “potential phishing index” will be adopted from November this year to more effectively screen and examine voice phishing-related transactions. This will help financial companies to more accurately identify the threat of voice phishing scams and more quickly take steps to prevent crimes and protect consumers. Taking into account multiple types of potential phishing scenarios and including some of the newly emerging scam methods, authorities will seek to introduce additional guidelines to the previously adopted joint phishing detection guidelines. The guidelines will be applied to both the banking and nonbanking sectors and incorporated into the ASAP by December this year.
c) Incorporating strict liability into law
Authorities will seek to incorporate strict liability for compensating voice phishing victims into a law to make sure that victims are adequately protected and financial companies are encouraged to step up their own preventive efforts. To this end, the FSC will actively support the legislative process regarding a pending revision bill for the Special Act on the Prevention of Telecommunications-based Financial Fraud and Refund for Loss. In a similar vein, authorities also plan to consider measures to make telecommunications service providers responsible to a certain degree for voice phishing scams to ensure the provision of more thorough protections for consumers.
III. Establishing an AI Cyber Defense Framework
a) Complete lifting of network separation rule
Amid growing hacking threats from AI, authorities will work to establish a new and more appropriate cyber defense framework suitable for the AI era. In this regard, a taskforce will be set up consisting of officials from related ministries, organizations, private sector experts, and financial companies to pursue a complete lifting of the network separation rule that will help to facilitate the use of AI for cyber defense purposes. The taskforce will seek to prepare measures to establish a priority-driven data management and safeguard system, adopt a zero trust architecture, articulate specific roles and responsibilities for CEOs, boards of directors, and CISOs, and ensure a seamless continuity in business operation in cyberattacks.
b) Allowing the use of AI for cyber defense purposes
Authorities will seek to upgrade rules to allow financial companies to use AI at all times for the purpose of enhancing their cyber defense systems. The use of AI-SaaS allowed with the easing of the network separation rule through a no-action letter will be made available on a permanent basis. In the meantime, financial companies will need to prepare a rigorous set of alternative cybersecurity control mechanisms to make up for potential vulnerabilities arising from the lifting of the network separation requirement. Additionally, authorities will seek to allow exemptions from the network separation requirement for more types of innovative financial services, such as blockchain, alongside the currently included SaaS programs and generative AI agents.
c) Preparing a legislative bill on digital finance safety
Authorities will prepare a legislative bill on digital finance safety to make sure that all financial sectors and related industries are subject to a rigorous set of cybersecurity rules appropriate for the rapidly changing cyber defense environment amid growing AI hacking threats and digital transformation. Virtual asset service providers and insurance general agencies that tend to manage significant scales of customer information and are directly exposed to potential loss of customer funds in hacking attacks will be required to maintain a level of cybersecurity system currently mandated under the Electronic Financial Transactions Act. This legislative bill on digital finance safety will also seek to establish rules on the third party entities (non-financial companies) closely associated with multiple financial companies, handling and processing significant volumes of information in partnership with financial companies and are thus exposed to the risk of hacking attacks. After consulting with various groups, organizations, and stakeholders, the FSC plans to introduce a bill in the first quarter of 2027.
* Please refer to the attached PDF for details.