[Shaking Financial Leadership]④ Neutralized Internal Control... Rubber-Stamp Outside Directors

[Asia Economy Reporters Jehoon Yoo, Changhwan Lee] # ‘○○○ (domestic region name) Sangwang (上王).’ This is a term used within Financial Group A to refer to Outside Director B. Outside Director B has served as an outside director of Company A for nearly four years, having had their two-year term extended twice by one year each since 2019. Although the essence of the outside director system is to have external experts check major shareholders or management, insiders at Company A say there are many whispers about this outside director’s considerable ‘real power’ exercised through personnel requests and other means, according to financial sector sources. The background enabling Outside Director B to exert influence is Financial Group A’s CEO, Chairman C. Forming a relationship with Outside Director B, who effectively leads the board, was important for Chairman C’s reappointment.

# “Woori Bank established internal control standards including all statutory matters, and as long as the effectiveness of these internal control standards cannot be denied, despite various circumstances pointed out by the defendant (Financial Supervisory Service), the plaintiffs (Chairman Sohn Tae-seung of Woori Financial Group, etc.) cannot be sanctioned on the grounds of failing to establish internal control standards themselves; therefore, the defendant’s reasons for this disposition cannot be fully accepted.” (Supreme Court ruling 2022Du54047, Dec. 15, 2022)

The ironic reason Chairman Sohn ultimately won the lawsuit against the Financial Supervisory Service (FSS) seeking cancellation of disciplinary warnings related to the overseas interest rate-linked derivative-linked securities (DLF) incident was the nullified internal control system. Under current law, establishing internal control standards is mandatory, but compliance with them is not obligatory, so the FSS’s disciplinary warning reasons cannot be accepted. Riding on this victory, Chairman Sohn is also considering litigation related to the Lime incident.

The reason why CEOs of domestic financial holding companies have challenged reappointment and even third-term reappointment despite various financial accidents is the nullification of checks and balances. Although the outside director system has been strengthened to check major shareholders or management from an independent position, CEOs have begun to form collusive relationships with them and coexist. Outside directors have become a kind of ‘rubber stamp.’

The internal control systems of financial companies are similarly nullified. As revealed in the DLF and Lime incidents, CEOs of financial companies have skillfully evaded responsibility by exploiting ambiguous regulations. While practitioners bear responsibility and face dismissal or disciplinary action, the CEO, who is the overall person responsible for internal control, is not only exempt from punishment but also attempts reappointment and third-term reappointment.

Photo by Getty Images Bank

Outside Directors as Rubber Stamps

Asia Economy analyzed the semi-annual reports of the four major domestic financial holding companies (KB Kookmin, Shinhan, Hana, Woori) from last year and found that out of 94 resolutions (excluding subsidiary committee matters), 93 were passed unanimously. Even the remaining one had only one dissenting opinion but passed smoothly. Although dissenting opinions and rejections may not be the sole indicators of board independence, the fact that there was only one ‘objection’ in half a year reflects the reality of financial holding company boards.

The outside director who expressed dissent was Byeon Yang-ho, former outside director of Shinhan Financial (former Director of Financial Policy Bureau, Ministry of Strategy and Finance). In March last year, regarding Shinhan Financial’s acquisition and cancellation of treasury stock, he opposed not the acquisition itself but stated, “More active board discussion is needed on the approach and communication methods regarding the treasury stock acquisition policy.” He recently resigned early from his outside director position, saying he “felt the limits of an independent outside director.”

In the financial sector, the cause of the board’s loss of checking ability is pointed out as the ‘circular structure’ between the CEO and the board. Outside directors appointed by the CEO decide on CEO candidates, and these directors are reappointed as outside directors by the CEO, resulting in a circular structure that undermines their independence. The auditor, who can be considered the company’s second-in-command, is similarly nullified by this structure.

A financial sector insider familiar with the situation said, “Although outside directors of banks are appointed through outside director nomination committees, they are basically composed of personnel appointed by the Presidential Office (or Blue House), former Ministry of Strategy and Finance or Financial Services Commission officials, close associates of financial company CEOs, and former prosecutors. Those recommended in this way cannot help but be mindful of the CEO or government during the chairman candidate recommendation and appointment process, and they are reappointed, resulting in a structure where they inevitably become rubber stamps.”

The aforementioned ‘○○○ Sangwang’ of Financial Group A is a typical example of the symbiotic relationship between the CEO and outside directors. The CEO seeking reappointment provides various conveniences and benefits to outside directors, who in turn turn a blind eye to various financial accidents that occurred during the CEO’s tenure and vote in favor of reappointment proposals repeatedly.

For this reason, there are many opinions inside and outside the financial sector that the financial company board system needs reform. In October, Financial Supervisory Service Governor Lee Bok-hyun expressed his willingness to improve, saying at a National Assembly audit, “I deeply agree with the basic principle that the board should effectively have the authority to check and control the CEO,” and “We will deeply study amendments to the Governance Act and participate in the National Assembly’s discussion process.” In addition, KB Financial, IBK Industrial Bank, and others are steadily attempting to introduce a union-recommended director system.

Nullified Internal Control System

The internal control system is similarly nullified. Internal control refers to a series of control processes devised by financial companies for soundness, consumer protection, and compliance management, which all employees must comply with. Currently, financial companies such as banks, securities, and insurance companies operate their own internal control systems under the ‘Act on the Governance of Financial Companies (Governance Act).’

However, domestic financial companies are evaluated as having weak internal control commitment. According to the report ‘Status of Internal Control Systems in Major Countries and Directions for Improvement in Korea’ published by the Korea Capital Market Institute, many Korean financial companies understand internal control merely as a ‘compliance’ obligation. Accordingly, they respond passively, making little investment in establishing internal control standards or systems.

It is pointed out that the more CEOs aiming for reappointment or third-term reappointment obsess over short-term performance, the more internal control becomes formalistic, increasing the likelihood of financial accidents. Large-scale fund mis-selling incidents such as Lime and Optimus Asset Management, which shook the entire financial sector, and the DLF incident are cited as representative internal control failures caused by performance-driven financial companies.

Sanctions are also relatively mild. In Korea, violating the obligation to establish internal control standards can result in a fine of up to 100 million KRW on the financial company, and although CEOs can be held ultimately responsible, the legal provisions are abstract and ambiguous, making actual punishment difficult. Financial companies have also won various lawsuits related to the Lime and DLF incidents against supervisory authorities, reflecting this context.

This contrasts with overseas cases where internal control system establishment and operation are taken seriously. Financial companies in advanced countries such as the U.S. and U.K. understand internal control from an enterprise-wide operational risk perspective, actively addressing not only compliance but also consumer protection, internal accounting, information security, risk management, and anti-money laundering. They invest heavily in human and material resources and incorporate innovative technologies such as artificial intelligence (AI) and big data to build internal control systems.

Senior Research Fellow Lee Hyoseop of the Korea Capital Market Institute emphasized, “Currently, the obligation to establish internal control standards under Korea’s Governance Act is a principle-based regulation and lacks effectiveness,” adding, “It is necessary to specifically stipulate the obligation to establish internal control standards in the Governance Act to strengthen financial companies’ internal control capabilities.”

Lee also added, “Through amendment of Article 24, Paragraph 1 of the Governance Act, financial company boards should be granted the authority to establish and amend internal control standards and request amendments,” and “It is necessary to clearly assign legal responsibility for establishing and operating internal control standards to CEOs, compliance officers, CCOs (Chief Consumer Protection Officers), and CROs (Chief Risk Officers).”

"Transparent Governance of Financial Companies is Essential" Government Moves Toward Advancement

As financial company CEOs began wielding unchecked power, the government also raised the need to advance financial company governance. They aim to strengthen transparency in the executive candidate recommendation process. Financial Services Commission Chairman Kim Joo-hyun said at a pre-briefing on the 27th, “Even with the same government, Mao Zedong’s China and Deng Xiaoping’s China were different. The CEO’s role in financial companies is important,” adding, “Especially for financial holding companies without owners, the appointment procedures for executives and CEOs must be more transparent as a basic idea.”

President Yoon Suk-yeol also took active steps. On the 30th, at the Financial Services Commission’s work report held at the Blue House’s main hall in Seoul, he emphasized ‘advancement of governance’ in financial companies. He said, “Banks are a public system more important than national defense, so they operate under licensing rather than free establishment, and during past crises, massive public funds were injected for restructuring,” emphasizing, “Therefore, fair and transparent governance is important.”

Regarding public concerns about a return to government control over recent CEO replacements at BNK, Shinhan, NH Nonghyup, and Woori Financial Group, President Yoon stressed, “Because banks are public goods, the government’s interest in forming fair and transparent governance is not a matter of government control.”

Government Takes Steps to Strengthen Internal Control... Will It Work?

The government has also rolled up its sleeves to improve internal control systems. The Financial Services Commission and Financial Supervisory Service launched an ‘Internal Control System Improvement Task Force (TF)’ composed of experts in August last year and are discussing strengthening measures with the goal of legislative notice in the first quarter of this year.

The core of the government’s internal control improvement plan is to more clearly regulate the responsibilities and roles of CEOs and boards. For example, it is necessary to clearly define in laws and regulations what authority an executive holds in their position, the scope and area of their responsibilities, and what activities they perform to prevent financial accidents.

Currently, Article 24 of the Financial Company Governance Act only stipulates that “financial companies must establish standards and procedures (internal control standards) that employees must comply with when performing duties to comply with laws, conduct sound management, and protect shareholders and stakeholders,” leaving much ambiguity.

In fact, the Supreme Court distinguished between the obligation to establish and the obligation to comply with internal control in last year’s final ruling on Chairman Sohn’s lawsuit against the FSS regarding the DLF incident. The court reasoned that while establishing internal control is mandatory under current law, compliance is not obligatory.

Accordingly, authorities have identified future internal control improvement directions including: distinguishing responsibility for preventing financial accidents by executive; imposing management obligations to prevent financial accidents; sanctioning responsible executives and granting exemptions if necessary; and clarifying the board’s internal control monitoring duties over management. For example, major financial accidents would be the CEO’s responsibility, general financial accidents would be other executives’ responsibility, and financial companies would predefine and submit executives’ responsibility areas to regulators while being obligated to take appropriate measures to prevent financial accidents.

Authorities also explained the need to introduce board supervisory responsibility provisions from the Commercial Act into the Governance Act to specify the board’s monitoring duties. The current Commercial Act stipulates that “if a director intentionally or negligently violates the articles of incorporation or neglects duties, the director is jointly liable to compensate the company for damages.”

However, there is considerable pessimism about this. A financial sector insider said, “Although somewhat belated, it is positive that the responsibilities and roles of CEOs and executives have been specified, but given the culture of domestic financial holding companies, it is questionable whether it will be effective,” adding, “There are already discussions about exemption clauses, so loopholes may widen during the detailed legislative process.”

Attorney Kim Simok of Law Firm Yulchon said, “If compliance with internal control is mandated by law and sanctions are imposed for violations, it could become ‘external control’ rather than internal control,” adding, “To effectively operate internal control, companies should strengthen management and supervision of compliance centered on the CEO internally, and if the CEO’s role does not function properly, supervisory authorities could consider sanctioning measures.”