South Korea’s Financial Services Commission (FSC) is rapidly advancing plans to fully eliminate stringent network separation requirements for financial institutions demonstrating robust artificial intelligence (AI) and advanced cybersecurity capabilities. Chairman Lee Eok-won announced this strategic shift on Friday, signaling a significant regulatory update designed to bolster the financial sector’s defense against increasingly sophisticated cyber threats.
Speaking at an Information Security Day event organized by the Financial Security Institute, Chairman Lee addressed an assembly of top financial industry executives. The primary focus of the gathering was to formulate unified strategies and responses to the escalating threat of AI-powered cyberattacks, which are growing in complexity and frequency.
Chairman Lee emphasized the inadequacy of conventional cybersecurity measures. “The traditional approach of closing networks, restricting access, and relying on reactive measures can no longer effectively counter the rapidly evolving nature of AI-driven cyberattacks,” he stated. He advocated for a proactive paradigm, asserting, “We need to construct a robust system where artificial intelligence itself is deployed to defend against AI attacks,” urging financial firms to harness AI for rapid vulnerability identification and immediate incident response.
The FSC, under Lee’s guidance, will continue its critical AI security tests, initially launched as part of emergency regulatory relief measures in June. To further strengthen collective cybersecurity across the industry, the Commission aims to broaden participation by implementing more flexible eligibility criteria for these vital assessments.
Reiterating a key initiative, Lee affirmed, “We are committed to swiftly developing comprehensive plans to fully eliminate network separation requirements for financial companies that have demonstrated superior AI and advanced cybersecurity capabilities.” This move underscores the FSC’s confidence in leveraging cutting-edge technology for enhanced security.
Historically, South Korean financial institutions have operated under strict mandates requiring the physical separation of internet-connected business networks from internal systems that manage sensitive customer and transaction data. This traditional safeguard was designed to insulate critical financial infrastructure from external cyberattacks. However, this long-standing framework, while a cornerstone of financial cybersecurity, has increasingly been identified by financial firms as a significant impediment to integrating innovative generative AI and efficient cloud-based services. Simultaneously, regulators are recognizing the indispensable role of AI in modern cyber defense, especially as cyber threats grow more sophisticated, thereby accelerating the push for these regulatory easements.
Chairman Lee initially indicated in June that the government was exploring the complete removal of these network separation regulations for firms equipped with advanced AI security capabilities by the year-end. Currently, temporary regulatory relief permits 10 major financial institutions, encompassing leading banks, brokerages, and insurers, to utilize externally connected, high-performance AI systems specifically for critical cybersecurity tasks, including advanced vulnerability testing.
Furthermore, Lee strongly urged financial company CEOs and their respective boards to significantly boost security investments and prioritize recruiting specialized cybersecurity personnel. He emphasized the critical importance of assuming greater responsibility for continuous monitoring, conducting realistic cyberattack simulations, and other essential security operations.
The FSC Chairman also revealed plans to advocate for crucial revisions to the Electronic Financial Transactions Act. These amendments aim to impose punitive surcharges and enforcement fines for hacking incidents, thereby enhancing accountability. Additionally, they seek to strengthen the authority of Chief Information Security Officers (CISOs) and broaden consumer disclosure regarding security practices.
In a related development, the financial regulator is also actively working on drafting a comprehensive Digital Financial Safety Act. This pivotal legislation is designed to systematically address and close existing gaps in cybersecurity oversight across the digital financial landscape.
A recent report from the Korea Institute of Finance underscored the urgency of these changes, cautioning that AI-powered cyberattacks have the potential to transcend individual firm-level operational risks and evolve into broader systemic threats. The report strongly advocated for the widespread adoption of advanced AI security tools and robust zero-trust frameworks, moving beyond exclusive reliance on traditional network separation methods.
