Korea FSC orders cyber checks and plans VASP reporting requirements

South Korea’s Financial Services Commission held a meeting on November 5 with ministries, organisations and financial industry groups to strengthen cyber defence against growing AI-driven hacking threats.

Authorities will inspect about 580 business entities, examining externally accessible websites, staff management systems, internal work programmes and affiliated work programmes across traditional and nontraditional financial sectors.

The inspections will cover certification and access controls, sales and management APIs, development and test systems, alongside executive responsibilities, cybersecurity decision-making and IT asset registers.

Companies identifying vulnerabilities during inspections are instructed to immediately suspend service operations and cut external contact points, while authorities examine their cybersecurity controls and governance arrangements.

Checks of external contact points for registered IT assets will finish by the end of November, with internal control examinations completed by the end of the year.

Authorities plan November guidelines requiring virtual asset service providers to report hacking attacks immediately to financial authorities, rather than reporting only to the Korea Internet & Security Agency.

Authorities also plan November supervisory rule changes, initially increasing mandatory third-party vulnerability evaluations from once to twice annually for large financial companies and expanding their scope.

The immediate commercial risk is service interruption: instructions to suspend vulnerable operations make externally connected acquisition, onboarding and partner systems relevant to continuity planning, not just security reviews.