South Korea’s Financial Services Commission approves more granular credit information penalties and stronger sanctions for serious breaches

South Korea’s Financial Services Commission approved dedicated penalty calculation standards under the Act on Use and Protection of Credit Information, replacing fixed rates with ranges tied to the severity of violations. The amendments to the Credit Information Business Supervisory Regulations implement the reform direction discussed with the Financial Supervisory Service and financial industry associations in September. They take effect Oct. 23, 2026, and apply to penalties imposed from that date, subject to transitional provisions for earlier violations. Basic penalties will continue to be calculated by multiplying the statutory ceiling, generally 3% of total revenue, by a severity rate. The existing fixed rates of 50%, 75% and 100% will be replaced by ranges of 1% to below 30% for less serious violations, 30% to below 65% for serious violations, and 65% to 100% for very serious violations. Severity assessments will replace the size of improper gains with the type and nature of personal credit information involved, while clarifying the harm criterion to cover the scale of harm to data subjects and its impact. Improper gains will instead be considered when adjusting the basic penalty. Repeated violations and serious breaches with substantial social impact, including large credit information leaks, may attract increases of up to 100% of the basic penalty, within the statutory ceiling. Expanded grounds for reductions recognize preventive protection measures and prompt action to protect consumers and remedy harm. Earlier violations remain subject to the rules applicable when they occurred, but the new calculation standards may be used if they are more favorable to the violator.