[Exclusive] FSS Confirms Lotte Card Violated All Three Acts: Electronic Financial Transactions, Specialized Credit Finance, and Credit Information... Highest Level Sanctions Possible

Lee Chanjin Acknowledges Legal Violations During National Assembly Audit
Scenario of Six-Month Business Suspension and 5 Billion Won Fine Becomes Reality
Sanctions to Be Imposed Regardless of Lotte Card’s Personnel Overhaul
Personal Information P

The Financial Supervisory Service (FSS) has confirmed violations of the Electronic Financial Transactions Act, the Specialized Credit Finance Business Act, and the Credit Information Act during its on-site inspection of the Lotte Card cyber incident. As a result, the scenario of imposing a 'six-month business suspension and a 5 billion won penalty' is becoming increasingly likely. The FSS plans to accelerate the process, moving quickly from the on-site inspection to the deliberation by the Sanctions Review Committee and submission to the Financial Services Commission.

Lee Chan-jin, Governor of the Financial Supervisory Service, listens to questions from lawmakers during the comprehensive audit of the Financial Services Commission and the Financial Supervisory Service at the National Assembly in Yeouido, Seoul, on October 27, 2025. Photo by Kim Hyun-min

According to the financial sector on October 29, the FSS confirmed violations of the Electronic Financial Transactions Act, the Specialized Credit Finance Business Act, and the Credit Information Act during its on-site inspection of Lotte Card, which began on September 2. At the National Assembly's Political Affairs Committee audit on October 27, Lee Chanjin, Chairman of the FSS, stated, "It was later confirmed that two WebLogic servers used for online payments lacked security measures," adding, "Since legal violations have been identified, we are proceeding with the sanctions process."

According to reporting by The Asia Business Daily, the FSS, together with the Financial Security Institute, has confirmed violations of all three laws mentioned by Chairman Lee during the two-month joint on-site inspection of Lotte Card. The FSS and the Financial Security Institute launched the inspection related to the Lotte Card cyber incident on September 2, and the investigation is now reportedly in its final stages.

Once the inspection is complete, the FSS will notify Lotte Card of the results and conduct a hearing process after the preliminary notice. The final sanctions will be determined after deliberation by the FSS Sanctions Review Committee and a resolution by the Financial Services Commission. Most observers believe it will be difficult for the Financial Services Commission to reach a decision within this year, but financial authorities are expediting the process with the goal of announcing the results by the first half of next year at the latest.

If the case is submitted to the Sanctions Review Committee and the Financial Services Commission based on violations of all three laws, Lotte Card could face the highest level of sanctions, including a six-month business suspension under the Specialized Credit Finance Business Act and a 5 billion won penalty under the Credit Information Act. In fact, at the end of last month, there were reports in political circles that the Financial Services Commission was considering the highest level of sanctions. Chairman Lee's remarks during the audit and the FSS's confirmation of the violations are seen as providing the financial authorities with justification for imposing strong sanctions on Lotte Card.

Depending on the results of the inspection by the Personal Information Protection Commission, it is also possible that an even higher penalty could be imposed than that of the FSS. In fact, the Personal Information Protection Commission imposed a penalty of 13.451 billion won on Woori Card in March this year and 5.968 billion won on Kakao Pay in January, both of which exceed the FSS's maximum penalty of 5 billion won. However, it is reported that the level of sanctions against CEO Cho Joajin and other members of Lotte Card's management has not yet been determined.

Separately from the sanctions, Lotte Card has announced plans for a major management reshuffle, including the resignation of CEO Cho. The company has refrained from commenting on its specific position and personnel reform measures until after the financial authorities' sanctions decision. In addition, Lotte Card emphasized that the safety of 280,000 customers potentially at risk of unauthorized use due to key-in transactions has been secured. A Lotte Card representative said, "We have continued to reissue the affected cards, and any cards not reissued have been blocked from online transactions," adding, "There is no risk of unauthorized use for the 280,000 customers."