Financial Supervisory Service "Establishes Guidelines to Prevent Accidents in Financial Companies' Outsourced Operations"

On the 10th, the Financial Supervisory Service (FSS) announced that it is promoting the establishment of guidelines to comply with risk management when financial institutions outsource tasks to third parties.

The risks arising from third-party outsourcing by financial institutions, as identified by the FSS, include the risk of consumer personal credit information leakage due to the trustee's IT system failures, risks of incomplete sales, and online payment risks.

The guidelines are being promoted to induce financial institutions to manage risks independently according to the level, complexity, scale, and characteristics of third-party relationships. They will be implemented as association model regulations (self-regulation) so that each industry sector can operate them reflecting the unique characteristics of third-party risks.

According to the guidelines, financial institutions must establish an integrated third-party risk management system aligned with enterprise-wide risk management processes, considering factors such as scale, industry-specific risk factors, and the characteristics of outsourcing contracts.

The board of directors should carefully review and resolve key matters related to the establishment and supervision of third-party risk management policies, paying attention to the financial institution's dependence and subordination on third parties. Based on the policies established by the board, management must build a third-party risk management system, implement effective management measures, and report these to the board.

Financial institutions must measure third-party risks for each outsourcing contract, select high-risk contracts as priority management targets, and carry out enhanced risk management activities accordingly.

The FSS explained that by May, it will finalize standards for financial institutions subject to priority application in consultation with each industry association and plans to implement the guidelines as association model regulations (self-regulation) in the third quarter.