FSS Imposes Fine on KakaoPay for 'Network Separation Obligation Violation'

[Asia Economy Reporter Kiho Sung] The Financial Supervisory Service (FSS) has imposed a fine of 69.6 million KRW on Kakao Pay for violating the obligation of network separation. Along with this, it issued a management caution due to inadequate risk management.

On the 13th, the FSS announced that it had imposed such sanctions on Kakao Pay on the 3rd of this month and communicated three management caution points and 13 improvement items.

According to the FSS, Kakao Pay operated the business terminals of headquarters employees connected to the internal communication network and internal business systems connected to the internet without completing network separation during a certain period.

Additionally, some information processing systems located in the company’s data center were not physically separated from external communication networks such as the internet.

According to the Electronic Financial Supervisory Regulations, electronic financial operators must physically separate the information processing systems located in the company’s data center and the terminals connected to them from external communication networks such as the internet.

Furthermore, Kakao Pay was pointed out for violations such as ▲breach of procedures for using cloud computing services ▲failure to report electronic financial transaction terms and conditions.

The total fine imposed by the FSS on Kakao Pay amounts to 69.6 million KRW. Two executives and one employee were decided to receive sanctions at the level of 'caution.'

The risk management system was also criticized. Simple payment service providers are guided to maintain a capital adequacy ratio of 20% or more against outstanding balances. According to the disclosed management caution details, Kakao Pay had previously failed to meet the management guidance standards and at certain times reported compliance with the standards.

A Kakao Pay official stated, “We are diligently improving the issues pointed out in the IT sector inspection. To this end, we are reorganizing the compliance organization and aggressively hiring specialized personnel with extensive experience in security and IT audits to expand the team.” He added, “We are gradually enhancing the internal control system, including setting up internal control systems and continuous inspections based on risk assessments, and we will make every effort to achieve the highest industry standards.”