W623.7b in financial incidents, zero sanctions under accountability regime

More than 200 financial incidents have been reported at financial institutions since South Korea introduced its accountability mapping regime, yet not a single case has triggered a formal liability procedure under Financial Supervisory Service guidelines or resulted in sanctions based on the regime.

According to data that Democratic Party of Korea lawmaker Min Byeong-deok obtained from the Financial Supervisory Service, a total of 203 financial incidents worth 623.7 billion won ($466 million) were reported at financial institutions from the introduction of the accountability mapping regime in January last year through the end of July this year.

Banks accounted for 177 of those incidents, worth 500.9 billion won — 87.2 percent of all cases and 80.3 percent of the total amount. Savings banks logged only four incidents, but the losses totaled 105.6 billion won, the second-highest figure after commercial banks.

FSS operational guidelines require a formal liability procedure when incidents involve large-scale customer harm, serious damage to financial soundness, failure to fulfill supervisory duties, executive instruction, acquiescence or neglect, or systematic, prolonged or repeated violations. Not a single case has been processed under that procedure or resulted in sanctions for violating internal-control management obligations since the regime took effect.

Of the 203 reported incidents, 34 cases worth 146.8 billion won were recorded when measured by the actual date the incident began rather than the date it was reported. Banks accounted for 31 of those cases, with securities firms responsible for two and life insurers for one. None of those incidents led to sanctions under the accountability mapping regime either.

Observers say that accurately assessing the regime's effectiveness requires tracking statistics based on when incidents actually occurred, not just when they were reported.

The scale of financial incidents has been growing rapidly. From 2023 through July this year, financial sector incidents totaled 430 cases worth 1.27 trillion won. The annual case count rose from 62 in 2023 to 111 in 2024 and 184 last year. This year, 73 cases worth 311.1 billion won were recorded through July alone.

Hacking attacks and personal data breaches targeting the financial sector have also been mounting. Since late last month, data leaks have been confirmed at Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegaram Savings Bank and Hyundai Capital Services.

The FSS on Tuesday shared 28 internet protocol addresses identified as having been used in the hacking attacks with roughly 500 financial institutions. Traces of a Chinese AI penetration-testing platform called ARTEX were found on some of those IP addresses. Whether AI was actively used, and the precise scale and route of the data leaks, remain under investigation.

Those incidents were not included in the financial incident statistics as of the end of July. Financial authorities issued AI guidelines for the financial sector in June, but the framework remains voluntary. A task force is scheduled to review a more detailed regulatory structure governing AI accountability and authority in the second half of this year.

"The accountability mapping regime was designed to designate in advance who is responsible for preventing financial incidents," Min said. "If more than 200 incidents have occurred since the regime was introduced and not a single person has been held accountable, it is hard to say the system is working." He added that, with AI being used both in financial decision-making and in cyberattacks, "we need to move quickly to build a regulatory framework that clearly defines executive responsibility for the AI era."

Meanwhile, police who had been conducting a preliminary inquiry into the financial sector hacking cases formally opened an investigation on Monday. The Korean National Police Agency's Cyber Terror Investigation Unit is investigating seven financial firms, and the government has activated a round-the-clock response system in preparation for possible additional attacks.