Preventing Recurrence of the 'Timef Incident'... Financial Supervisory Service Holds Internal Control Workshop for Electronic Financial Operators

Sharing Key Issues Identified During On-Site Inspections and Continuous Monitoring
Introducing Cases Involving Unhealthy Business Practices by Poor Franchisees
Guidance on New System Improvements Including Correction Orders, Business Suspension, and Registration Cancellation

The Financial Supervisory Service (FSS) shared key issues identified during on-site inspections and continuous monitoring to strengthen the internal control levels of electronic financial service providers. They also shared inspection tasks related to the 'Internal Audit Consultation System.' Additionally, they provided information on cases involving unhealthy business practices by poor-quality merchants due to inadequate merchant screening and management, as well as ongoing efforts to improve related systems.

On the 9th, the FSS held an 'Internal Control Workshop' at its headquarters in Yeouido, Seoul, to share and discuss these matters. Approximately 220 executives and employees responsible for compliance monitoring and internal control at electronic financial service providers attended the workshop. As of the end of November, there are 198 electronic financial service providers, including prepaid electronic payment instrument issuers, debit electronic payment instrument issuers, and electronic payment gateway operators.

An FSS official explained, "We recognized the issues that arose during the e-commerce unsettled payment incident and took this opportunity to enhance sound management and legal compliance awareness across the electronic financial industry. Given the intense market competition, many small and medium-sized electronic financial service providers face increased needs to strengthen internal controls due to exposure to illegal activities and other problems, which led to the holding of this workshop."

The FSS first introduced major issues identified during on-site inspections and continuous monitoring. These included violations of electronic financial transaction safety obligations that led to personal credit information being hacked and resulting in fraudulent payment incidents. They also disclosed cases where insufficient establishment and operation of emergency response organizations and inadequate compliance with response procedures caused prolonged system outages, leading to significant public inconvenience.

Inspection tasks related to the Internal Audit Consultation System were also shared with all electronic financial service providers. For minor issues that can be self-corrected, companies are selecting and inspecting internal audit tasks to improve themselves, with electronic financial service providers currently focusing on big tech companies. Furthermore, the FSS announced four detailed inspection items to prevent service delays caused by surges in simultaneous users: establishing and operating performance management procedures, distinguishing threshold stages and corresponding response plans, conducting availability tests during major events or new service launches, and establishing and operating an emergency IT support expansion system.

Regarding open-source software management systems, the FSS selected five detailed inspection items to establish risk management systems due to vulnerabilities to attacks exploiting security weaknesses and recurring license-related disputes. These include establishing and operating internal regulations and procedures for open-source management, appropriateness of managing open-source usage status and ledger lists, compliance with open-source licenses, and adequacy of open-source vulnerability inspections. For cases of delayed or omitted reporting of electronic financial accidents, three detailed inspection items were selected.

The FSS also shared cases involving unhealthy business practices by poor-quality merchants due to inadequate merchant screening and management, as well as recent system improvement efforts aimed at promoting sound management and protecting users. The FSS introduced cases where unregistered PG companies disguised themselves as general merchants and were involved in illegal activities such as tax evasion and concealment, as well as cases where poor-quality merchants linked to online gambling were not filtered out, resulting in electronic financial service providers' virtual accounts being used for illegal activities.

Additionally, the FSS conveyed that they have introduced phased measures such as corrective orders, business suspension, and registration cancellation for non-compliance with management guidance standards, imposed obligations to separately manage 100% of settlement target amounts, and established grounds for punishment in cases of misuse. An FSS official stated, "We expect this opportunity to contribute to strengthening the internal control levels across the electronic financial service provider industry. We plan to actively support the industry in strengthening their internal control systems through various channels such as workshops and meetings."