From Next Year, Financial Companies Must Report Cloud Usage Afterwards... Easing Network Separation for R&D Purposes

[Asia Economy Reporter Song Hwajeong] Financial authorities are revising the Electronic Financial Supervision Regulations to ease cloud and network separation regulations. This is a follow-up measure to the "Cloud and Network Separation Regulation Improvement Plan" announced on the 14th of last month. Additionally, before implementing the relaxed cloud network separation regulations next year, an interpretation team will also be operated.

On the 1st, the Financial Services Commission announced a preliminary notice of amendments to the Electronic Financial Supervision Regulations to improve cloud and network separation regulations. Accordingly, for cloud usage, procedures will be simplified such as switching to post-reporting, and network separation regulations will be gradually eased starting from the development and testing fields.

When using the cloud, the obligation for financial companies to report in advance will be changed to post-reporting. Currently, if financial companies intend to use the cloud for important tasks, they must report to the Financial Supervisory Service Director at least 7 business days in advance, but going forward, if financial companies newly enter into a cloud usage contract, they can report within 3 months.

Network separation regulations will be eased for research and development purposes. Currently, physical network separation regulations are uniformly applied even to R&D fields with low importance in electronic financial transactions and that do not hold personal credit information. However, according to the improvement plan, network separation regulations will be relaxed for R&D purposes that do not process users' unique identification information or personal credit information.

The amendment to the Electronic Financial Supervision Regulations will be implemented from January next year after review by the Regulatory Reform Committee and approval by the Financial Services Commission. To ensure smooth adoption of the system improvements in the financial field, the Financial Services Commission will operate an interpretation team composed of the FSC, Financial Supervisory Service, Financial Security Institute, and financial associations from July 9 to July 31. Applications will be accepted for three weeks from May 9 to 27, and responses will be provided sequentially by the end of July. The inquiries will cover opinions on the amendment to the Electronic Financial Supervision Regulations for system improvement and specific interpretations or explanations needed for improvement items. Financial companies can apply to the financial associations for interpretations and suggestions regarding cloud and network separation regulation improvements. Simple and repetitive inquiries will be handled internally by the financial associations, while inquiries requiring in-depth review will be forwarded to the Financial Supervisory Service and Financial Security Institute. The Financial Security Institute and Financial Supervisory Service will conduct the first review, and the Financial Services Commission will prepare the final response. A Financial Services Commission official stated, "For important or complex matters, final decisions will be made after discussions at regular meetings involving the FSC, Financial Supervisory Service, Financial Security Institute, and external experts," adding, "The review results will be communicated to financial companies, and common or important matters among the responses will be posted on the cloud-dedicated bulletin board on the Financial Security Institute’s website."

The Financial Services Commission plans to revise the "Cloud Guidelines for the Financial Sector" reflecting the matters reviewed by the interpretation team from August to October, and from November to December, it will check the adequacy of internal control systems such as the operation status of information protection review committees of financial companies and induce proactive improvements through consulting if necessary.