South Korea Tightens Cyber Regulations and Reporting for Crypto Firms
South Korea's Financial Services Commission is tightening cybersecurity regulations for crypto companies and financial institutions, introducing mandatory reporting and comprehensive IT audits following recent hacking incidents.
South Korea is advancing tighter cybersecurity regulations for financial institutions, including virtual asset service providers. According to the Financial Services Commission (FSC), authorities plan to issue guidelines this month requiring crypto companies to immediately report cyberattacks to financial watchdogs. Currently, these providers report incidents to the Korea Internet & Security Agency (KISA) but are not obligated to immediately inform financial regulators. This initiative is still a proposed guideline rather than a newly enacted legal obligation.
The move follows a series of hacking incidents targeting financial institutions in the country. Between September 30 and November 3, authorities recorded 40 hacking incidents across 37 companies, including three virtual asset service providers. The FSC reported that approximately 473,000 records of personal information were exposed, primarily employee details alongside customer names, resident registration numbers, and account numbers. The commission noted that no customer account passwords have been reported stolen so far, while instructing relevant entities to heighten surveillance on anomalous activity and prevent secondary damages such as fraud.
Simultaneously, several smaller firms in crypto, online financial services, and peer-to-peer lending reported collective financial losses totaling about one billion South Korean won, mainly drawn from management accounts rather than private customers. By the end of November, authorities expect to inspect IT asset systems across roughly 580 financial entities, focusing on APIs, workforce management platforms, operational systems, and third-party software. Significant vulnerabilities could prompt requirements to suspend services and sever external access points. Furthermore, a joint threat intelligence-sharing pilot is scheduled for December, ahead of a broader sector rollout in the first quarter of 2027.
Looking ahead, the commission plans to draft a digital financial safety bill in the first quarter of 2027 to formally extend cybersecurity mandates currently applied to traditional financial firms over to virtual asset enterprises. While final obligations remain under review as policies roll out in stages, the regulatory direction underscores an official push for accelerated incident reporting, hardened access controls, and comprehensive system oversight across the entire domestic financial ecosystem.
