S. Korea to complete security audit of 580 financial firms by year-end, push to lift network-separation rules

The government is launching a comprehensive security audit of more than 580 financial firms as a follow-up to an unprecedented AI-driven hacking incident. The review will cover not only so-called "side-door" vulnerabilities in back-office support systems — a primary target in the recent attack — but also internal controls, including CEO reporting procedures in the event of a breach. Vulnerability assessments will be conducted twice a year instead of once, and firms that fail to act on findings will face financial penalties.

As a more fundamental response to AI hacking risks, the government is also pushing to fully lift the financial sector's network-separation rules. Under the principle of "fighting AI attacks with AI," authorities plan to build an AI-based security framework through a dedicated task force.

The Financial Services Commission announced the "Financial Sector Security System Innovation Plan" on Wednesday, setting a year-end deadline to complete a full security audit of all financial firms. The review covers traditional institutions such as banks as well as fintech companies — roughly 580 firms in total.

Auditors will examine intangible IT assets including application programming interfaces, external access points and internal controls. The scope extends beyond customer-facing services to all externally accessible business areas, including the back-office support systems that were the primary target of the recent hacking. Financial authorities plan to conduct rigorous checks on internal controls such as CEO reporting procedures following a hacking incident and the role of chief information security officers.

Financial firms will first conduct self-assessments; if those are found to be inadequate, the Financial Supervisory Service and the Korea Financial Security Institute will carry out on-site inspections.

The government will also build a system for financial firms to share hacking-related intelligence. Rapid information sharing is essential for countering AI-driven attacks, yet information gathered by individual firms is currently not subject to sharing requirements. Going forward, such information will be shared across the entire financial sector through the FSS's integrated monitoring system known as "FIRST." The requirement will also apply to virtual asset exchanges and insurance solicitors that fall outside the scope of the Electronic Financial Transactions Act.

Separately from the comprehensive audit, the government will overhaul the self-assessment framework that financial firms use to evaluate their own vulnerabilities. Under current electronic financial supervision rules, firms are required to conduct their own vulnerability analyses and assessments as a safeguard against hacking and similar threats.

The government will double the frequency of those assessments from once to twice a year. The change will apply first to large firms with total assets of 2 trillion won ($1.49 billion) or more and at least 300 employees, with smaller firms brought in from 2028.

All external access points related to electronic financial transactions will be subject to vulnerability assessments. The move reflects the authorities' determination to scrutinize side-door security rigorously, given that weak protections at those entry points were a primary cause of the recent hacking damage. If a firm leaves a major identified vulnerability unaddressed for an extended period, the government may issue a corrective order and impose a compulsory fine for non-compliance. To that end, the government is in discussions with the National Assembly on amendments to the Electronic Financial Transactions Act.

A survey of banks' certification status under the Korea Internet & Security Agency's Information Security Management System — the basic information-security certification regime — found that not a single bank had obtained the relevant certification for back-office support systems, the very "side doors" targeted in the attack. Financial authorities made improving the financial sector's inadequate awareness of side-door security a central focus in developing the new measures.

For smaller financial firms with relatively limited resources, the Korea Financial Security Institute will offer a one-stop AI defense service, sharing tailored vulnerability information using AI. The institute will also categorize and present recommended security measures according to each firm's capabilities and guide firms to implement the highest-priority actions first.

The government is seizing on the hacking incident to push for a full lifting of the financial sector's network-separation rules. Authorities had previously said they would ease those rules only for security-related purposes, but the policy response process has now put a full repeal on the table.

"Given that AI-powered hacking threats have become a reality, there is a need to discuss concrete steps toward establishing a security framework in which AI attacks are countered with AI defenses," a Financial Services Commission official said.

To that end, the FSC will launch a task force bringing together government agencies, related institutions, private-sector experts and the financial industry to work toward a full lifting of the network-separation rules. The TF will develop procedures for lifting the rules and related evaluation criteria, and will discuss the specifics of building a new AI-based security framework. The new framework will cover data management, internal security controls and incident-response systems. The FSC plans to announce the full network-separation repeal plan and the new security framework within the first quarter of next year.

The FSC is also pushing to enact a "Digital Financial Safety Act" to address the growing reality of AI hacking threats, the expansion of new sectors such as virtual assets, and the widespread adoption of digital finance and cloud environments.

The core of the proposed legislation is to apply security requirements comparable to those under the Electronic Financial Transactions Act to sectors — such as virtual asset operators, insurance general agencies and loan companies — that do not directly conduct electronic financial transactions but hold large volumes of financial and customer data and could expose customers to direct asset losses in the event of a breach.

Cloud service providers, platforms and other entities that are not financial firms themselves but are linked to multiple financial institutions, handle large volumes of data through various outsourcing arrangements and could cause widespread damage in the event of a breach would also be subject to a range of requirements covering breach prevention and rapid recovery. Rules on security governance and internal controls — including CEO accountability, board composition and the role of business units — would be incorporated to ensure ongoing security management. The government plans to gather input from relevant agencies and finalize the measures by year-end.

To prevent secondary voice-phishing damage stemming from data leaks, the government will introduce a "suspicious transaction risk index" — a phishing score — into the AI-based Voice Phishing Information Sharing Platform, known as ASAP. When a financial firm queries ASAP about a transaction it suspects may be criminal, the AI will assess the risk level and respond. The government will also continue to pursue legislation establishing no-fault liability, under which financial firms would compensate customers for a portion of losses suffered in secondary voice-phishing crimes resulting from data breaches.