South Korea to scrap 2013 bank air-gap rules, stolen $690K triggers overhaul
What's the deal? South Korea's Financial Services Commission will phase out and ultimately scrap the "network separation" rules that have isolated banks' internal systems from the internet since 2013. The goal: let financial firms deploy AI tools to defend against AI-powered hacking. Chairman Lee Eog-weon unveiled the plan on November 5 at a meeting of industry associations and government agencies.
Why now? Between September 30 and November 3, 37 financial firms reported 40 breaches exposing about 473,000 customer records, including names, resident registration numbers, and account details. Roughly US$838.4K — about $690,000 — was stolen from some cryptocurrency exchanges, electronic finance operators, and online lending platforms.
What changes in practice? A task force — including the Ministry of Science and ICT, the National Intelligence Service, and private experts — will begin work on fully lifting the rules. Only firms with strong AI and security capabilities will qualify, and they must put alternative safeguards in place. Existing temporary exemptions for AI security tools will be made permanent.
What else? The commission will inspect roughly 580 financial firms by year-end, reviewing externally accessible systems such as websites and employee tools. Large firms must run vulnerability assessments at least twice a year, up from once. Security rules equivalent to the Electronic Financial Transactions Act will extend to virtual asset providers, corporate insurance agencies, and moneylenders.
Accountability: Lee signalled that executives will bear direct responsibility. "Security is not a technical issue for one department but a core management task for which the chief executive must take direct responsibility," he said. "For serious management failures or negligent responses, we will hold executives, including CEOs, strictly accountable under the relevant laws."
What could go wrong? The 2013 model was adopted after a major cyberattack on banks and broadcasters, and regulators now argue strict isolation blocks the cloud and AI tools needed for defence. But the breaches underscore the risk of loosening a control before replacement defences are proven.
The signal: South Korea is betting that fighting "AI with AI" beats air-gapping — a wager other regulators weighing cloud and AI adoption will watch closely. The task force is expected to set eligibility and security requirements by the first quarter of 2027, making this an overhaul rather than an immediate repeal.
Read more: fsc.go.kr
Image credit: Generated with Gemini
