Financial Services Commission to Ease Cloud and Network Separation Regulations for Financial Companies Starting Next Year

[Asia Economy Reporter Song Hwajeong] Regulations on cloud and network separation for financial companies will be eased starting next year.

On the 23rd, the Financial Services Commission held a regular meeting and announced that it had approved an amendment to the Electronic Financial Supervision Regulations to rationalize the cloud usage procedures and improve network separation regulations.

Until now, strict cloud and network separation regulations have been applied in the financial sector for security reasons. There have been ongoing opinions that these regulations hinder financial innovation through the introduction and utilization of digital new technologies. Accordingly, the government prepared the "Cloud and Network Separation Regulation Improvement Plan" last April to rationalize cloud usage procedures and improve network separation regulations. In this meeting, the Electronic Financial Supervision Regulations were partially amended to ensure that the institutional improvement plan can be smoothly established in the financial field.

The amendment includes establishing criteria for evaluating the importance of cloud usage tasks and differentiating usage procedures according to the importance of the tasks. For non-critical tasks, the evaluation of the soundness and safety of the Cloud Service Provider (CSP), business continuity plans, and safety assurance procedures have been relaxed to allow execution. The prior reporting for cloud usage will be changed to post-reporting, and the submission documents will also be simplified.

Network separation regulations in the research and development field will also be eased. On the premise that users' unique identification information or personal credit information is not processed, exceptions to network separation will be allowed for the research and development field.

The amended regulations will take effect from January 1 of next year.

The Financial Services Commission stated, "We have revised the 'Cloud Computing Service Usage Guide in the Financial Sector' by reflecting detailed procedures following the institutional improvements, specific cases, and inquiries from financial companies responded to by the authoritative interpretation team," and added, "Together with the Financial Supervisory Service and the Financial Security Institute, we plan to conduct written and on-site inspections and consulting for two months before the implementation of the system regarding the composition and operation status of information protection committees of financial companies and the internal control status of the information technology sector."