South Korea's Financial Services Commission (FSC) has detailed a cybersecurity overhaul combining checks of external IT connections and internal controls at about 580 firms with stronger fraud protection and artificial intelligence (AI) defenses. The package specifies the scope and timetable of reviews proposed in October, including virtual asset businesses outside the Electronic Financial Transactions Act. As of Nov. 3, 40 cyber incidents had been reported at 37 firms since Sept. 30, exposing about 473,000 information records. Reviews of external connections listed in asset registers are to finish by Nov. 30, with unregistered systems and internal controls covered by Dec. 31. Firms must suspend services and block external access when serious vulnerabilities threaten funds or personal data. Essential services may resume only where immediate remediation is difficult, alternative controls are in place and the chief executive approves. Proposed rule amendments in November would increase external vulnerability assessments from at least once to at least twice annually, initially for firms with at least KRW 2 trillion in assets and 300 employees. Assessments would cover all external connections related directly or indirectly to electronic financial transactions. The package also seeks powers to require urgent assessments and recurring penalties for failure to comply with corrective orders. Sharing threats detected by individual firms is scheduled for a December pilot and broader use in the first quarter of 2027. Consumer protection measures combine dark web monitoring with a November pilot of an AI phishing risk score ranging from 0 to 100 on the existing shared fraud analysis platform. Pending legislation would require financial firms to compensate part of voice phishing losses regardless of fault. A task force will develop plans to phase out network separation requirements under alternative safeguards, including continuous access verification and protection based on data sensitivity. Temporary exemptions allowing AI and software as a service for security purposes would become permanent, subject to alternative controls. A Digital Financial Safety Act bill is planned for the first quarter of 2027 to extend security rules comparable to those under the Electronic Financial Transactions Act to sectors such as virtual asset businesses and insurance agencies. Regulation of cloud providers and other connected third parties is also under consideration.
South Korea's Financial Services Commission details cybersecurity checks at about 580 firms and plans stronger AI defenses
South Korea's Financial Services Commission has detailed security checks at about 580 firms and plans for at least two vulnerability assessments annually, starting with large firms. Fraud safeguards include an artificial intelligence phishing risk score and proposed partial compensation for voice phishing losses regardless of fault. Further plans would replace network separation requirements with alternative safeguards and extend security regulation through a Digital Financial Safety Act.