 |
Photo courtesy of Yonhap News |
[Alpha Biz= Paul Lee] South Korea’s Financial Supervisory Service has launched a comprehensive inspection of commercial banks to assess their management of personal credit information, in line with its strengthened consumer protection agenda, according to an exclusive report by The Asia Business Daily
According to financial industry sources on May 6, the regulator conducted ad hoc inspections for about a month starting early April, led by its Inspection Bureau 2, targeting major lenders including Shinhan Bank, Industrial Bank of Korea, Woori Bank, Toss Bank, and iM Bank. Each inspection reportedly took three to five business days per institution.
The review focused on whether banks properly comply with relevant regulations, including the Credit Information Act, particularly in the handling and management of personal data.
Starting this month, Inspection Bureau 1 will carry out similar on-site inspections at KB Kookmin Bank, Hana Bank, and NH NongHyup Bank. For KB Kookmin Bank, authorities are also considering integrating the review into its scheduled regular inspection for the first half of the year.
Under the Credit Information Act, financial institutions are required to grant access to customer data only to the minimum extent necessary for business operations and must delete customer information within five years after the termination of a business relationship. Additionally, promotional messages may only be sent to customers who have provided prior consent.
Authorities are closely examining whether these procedures are properly followed in practice. Key areas of focus include whether customer data usage remains within the scope of disclosed purposes, and whether proper consent was obtained before sending advertising messages via text or mobile app push notifications. The inspections also aim to verify whether any promotional content was sent to customers who had not agreed to marketing use of their data.
The move reflects the regulator’s proactive effort to ensure appropriate data usage and strengthen consumer protection across the financial sector.
An industry official noted, “With growing public attention on financial consumer protection and personal data usage, this inspection appears to be aimed at reviewing overall consent and data management procedures. Banks must enhance internal controls to build consumer trust.”
Given that such inspections typically take at least six to seven months before results are finalized, findings from this review are expected no earlier than the second half of the year.
The Credit Information Act is one of the most strictly enforced regulatory areas in the financial sector. Violations—such as using personal data without consent or beyond its intended purpose—can result in heavy sanctions, including fines, penalties, institutional warnings, disciplinary action against employees, and in severe cases, business suspension.
A former financial regulator official said that while financial institutions often argue that broad customer consent justifies data usage, authorities do not consider such blanket consent sufficient to permit use beyond specified purposes.
Penalties for violations have also been increasing. Last year, the Financial Supervisory Service imposed a record fine of approximately KRW 150 billion on Tongyang Life Insurance for breaching the law, sending a strong warning to the industry. However, the Financial Services Commission has yet to finalize its decision on the case.
In addition, Toss was fined approximately KRW 6 billion following the 2024 revision of the law, while Woori Bank was also penalized KRW 878 million in the same year.
Alphabiz Reporter Paul Lee(hoondork1977@alphabiz.co.kr)
