South Korea weighs network-separation exemption to accelerate banks’ AI adoption

The Financial Supervisory Service is considering allowing financial firms with strong AI security controls to bypass long-standing network-separation rules, while keeping responsibility for breaches firmly with the institutions themselves.

South Korea’s financial regulator is preparing to loosen one of the sector’s most entrenched cyber rules, saying it wants banks and other financial firms to be able to use artificial intelligence more freely while still bearing clear responsibility for security failures. At a fintech event in Seoul, Lee Seok, head of digital finance at the Financial Supervisory Service, said the watchdog is considering a full exemption from network-separation requirements for institutions with strong AI security capabilities. The move would mark a significant shift for a rule that has long protected sensitive systems by keeping internal business networks apart from the public internet, but has also made it harder for firms to adopt external generative AI and cloud tools. According to the regulator, recent hacks have exposed how weak management of exceptions to the rule can create fresh vulnerabilities.

The policy change is being framed as part of a broader effort to modernise oversight rather than relax discipline. Since announcing a roadmap in August 2024, South Korean financial authorities have gradually opened the door to external generative AI and cloud-based software-as-a-service through regulatory sandboxes, later formalising some of those uses once they were tested. The Financial Supervisory Service said it had institutionalised SaaS use in April this year and was still assessing the performance of 237 designated innovative financial services involving generative AI. It has also begun security-focused trials on easing network separation, with more rounds planned after the first 10 firms were selected from 49 applicants earlier this year.

Lee also argued that the recent run of hacking incidents in the financial sector should not be blamed on advanced AI systems, but rather on more basic failures in cyber hygiene. In remarks reported by Etoday, he said the root cause was not the sophistication of the attacks but the absence of essential protective measures. That distinction matters because the regulator is signalling that looser rules will not mean lighter accountability. Instead, it wants institutions to invest more heavily in their own defences, build internal expertise and identify weaknesses before they are exploited.

The watchdog is also sharpening the framework for who carries the blame when AI is used in financial decision-making. Lee said that, even where AI supports or automates parts of a process, responsibility must remain with people, and ultimately with the financial company providing the service. That stance aligns with the integrated AI guidelines the regulator published in June, which call for top-level decision-making bodies, independent risk-management teams, controls over model performance and data quality, checks for fairness and bias, and consumer-protection safeguards.

Another area under review is the use of data for AI development, particularly where existing consent rules may slow innovation. According to the regulator, officials are weighing whether the current requirement for separate, advance consent for the collection, use and sharing of personal credit information is becoming a brake on AI development. The aim, it says, is to find a balance between information protection and wider data use, a question that is likely to grow more pressing as financial firms look to train and deploy AI systems at scale.

The debate comes against a broader backdrop of uneven AI adoption across South Korean industry. A report from the National Information Society Agency found that, as of 2023, manufacturing firms lagged the wider economy in AI uptake, with adoption at 25.4% versus an overall industry average of 30.3%. The study suggested that most manufacturing users were still confining AI to isolated teams or projects rather than rolling it out across the organisation, underscoring how regulatory friction, implementation costs and skills gaps continue to limit deployment in more traditional sectors. Against that backdrop, the financial regulator’s push to lower barriers while insisting on stronger security appears designed to make AI use more practical without weakening the standards firms are expected to meet.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

• Paragraph 1: ^[2]
• Paragraph 2: ^[2]
• Paragraph 3: ^[2]
• Paragraph 4: ^[2]
• Paragraph 5: ^[2]
• Paragraph 6: ^[3], ^[2]

Source: Fuse Wire Services