Overhaul follows AI hacking incidents in financial sector
Security checks to extend to internal support systems
Fines eyed for firms that ignore remediation orders
Annual assessment cycle to be accelerated
South Korea's financial regulators plan to overhaul the security assessment framework for financial institutions in the wake of a series of AI-assisted hacking incidents targeting the sector. The centerpiece of the reform is expanding mandatory security checks beyond customer-facing services to include internal support systems used by bank employees and loan agents. The move follows criticism that AI exploited relatively vulnerable back-office infrastructure, and regulators are also considering introducing compulsory fines for firms that fail to act on remediation orders.
According to financial industry sources Tuesday, the Financial Services Commission is revising the vulnerability analysis and assessment criteria under the Electronic Financial Supervision Regulations as a follow-up to the AI hacking incidents. Under current rules, financial companies, electronic financial service providers and mutual finance institutions that meet certain requirements must conduct vulnerability assessments of their electronic financial infrastructure at least once a year — the most basic security check mandated by law.
The FSC plans to add new assessment items covering internal support systems and other infrastructure that assists customer-facing services. The aim is to ensure that systems used by bank staff and loan agents are subject to rigorous security checks — bringing peripheral systems up to the same security standard as so-called core banking platforms that directly interface with customers.
The current vulnerability assessment framework is organized around three broad categories: administrative security, physical security and technical security. The physical security section addresses only the protection of computing equipment and data centers, and auxiliary infrastructure such as internal support systems is not explicitly covered in any part of the existing framework.
The recent AI hacking attacks targeted internal support services rather than customer-facing platforms, drawing considerable criticism from academics who argued that financial institutions had focused too heavily on securing the front door. Regulators are now moving quickly to address that gap.
The FSC sees the overhaul as an opportunity to fundamentally shift the security paradigm across the financial sector. With AI-powered hacking now a reality, officials believe the traditional approach of tiering security levels by system importance is no longer sufficient. The revision also reflects concern that systems previously considered low-priority could become entry points for AI-driven attacks, potentially exposing sensitive data such as credit information.
"A peripheral system is not unimportant just because it is peripheral," an FSC official said. "With AI, places that were not worth attacking before — because the cost outweighed the benefit — are now targets. Financial companies have no choice but to cover every last security detail."
A review of the Information Security Management System certification status of 20 banks found that none had obtained ISMS certification for their internal support systems.
Kwon Tae-kyung, a professor at Yonsei University's Graduate School of Information, said the inclusion of internal support systems was welcome news. "This hacking incident was fundamentally a coverage problem, so bringing support systems into scope is a positive step," he said. "This is an opportunity for the financial sector to examine all the areas that have gone unchecked and evaluate them together under a single standard."
The FSC also plans to incorporate AI-specific security check items into the assessment framework. Shortly after the hacking incidents, regulators distributed an IT security self-checklist to financial institutions; that checklist will now be folded into the formal assessment criteria. Items include whether controls are in place to prevent abnormal bulk API calls and automated bot attacks.
Regulators are also reviewing the introduction of compulsory fines — a form of sanction — for institutions that fail to implement required fixes after a vulnerability assessment. A bill currently pending in the National Assembly, sponsored by Financial Affairs Committee Chairman Yoo Dong-su, would amend the Electronic Financial Transactions Act to impose fines of up to 50 million won ($37,400) on companies that do not comply with government corrective orders. Separately, the current annual assessment cycle is set to be accelerated to at least twice a year.
While tightening the assessment process, the FSC also plans to ease network-separation regulations for security purposes. The thinking is that as AI-powered hacking techniques grow more sophisticated, defenses must themselves be AI-based. FSC Chairman Lee Eok-won signaled his intention to relax the network-separation rules at the FSC's national audit Thursday, saying, "To stop AI, you ultimately have no choice but to use AI."
hyuk@heraldcorp.com
rim@heraldcorp.com
