[2026 Parliamentary Audit] 203 Financial Incidents Since Responsibility Maps Introduced... Executive Accountability and Sanctions: 'Zero'

Losses total KRW 623.7 billion; banks account for 80.3%
Rep. Min Byungdeok: "In the era of AI and hacking, overhaul the framework for holding executives accountable"

More than 200 financial incidents occurred after the introduction of responsibility maps, a system designed to clarify where accountability lies for financial company executives’ internal control duties. Yet not a single case resulted in sanctions.

A bank ATM installed inside a building in Seoul on the 5th, amid recent hacking incidents in the financial sector. Yonhap News Agency

According to data submitted by the Financial Supervisory Service to Min Byung-deok, a Democratic Party of Korea lawmaker on the National Assembly’s Political Affairs Committee, a total of 203 financial incidents were reported by financial companies from the introduction of responsibility maps in January last year through the end of July this year. The total amount involved was 623.7 billion won.

By sector, banks accounted for 177 incidents totaling 500.9 billion won, or 87.2% of all incidents and 80.3% of the total amount involved. They were followed by life insurers, with 10 incidents totaling 5.3 billion won; securities firms, with 10 totaling 10.1 billion won; savings banks, with four totaling 105.6 billion won; non-life insurers, with one totaling 1.6 billion won; and specialized credit finance companies, with one totaling 164 million won.

A responsibility map is a system that specifies each financial company executive’s duties and the scope of their internal control responsibilities, making it clear where accountability lies when an incident occurs. According to the Financial Supervisory Service’s operating guidelines, an accountability review may be initiated if an incident causes substantial harm to customers or has a significant impact on a company’s financial soundness; if an executive directed, condoned or neglected the conduct; or if an unlawful act was committed systematically or repeatedly over an extended period.

However, no cases have been handled under these procedures since the system was introduced. Nor has any executive been sanctioned for violating their duty to oversee internal controls.

Based on the date each incident began, 34 incidents totaling 146.8 billion won occurred after the system was introduced, accounting for about 17% of all reported incidents. These included 31 cases at banks, two at securities firms and one at a life insurer. No sanctions related to the responsibility maps were imposed in these cases either.

The number and scale of financial incidents are increasing. From 2023 through July this year, 430 incidents occurred, involving a total of 1.2683 trillion won. The annual number of incidents rose from 62 in 2023 to 111 in 2024 and 184 last year. The amount involved in incidents last year was 447.6 billion won, about 3.1 times the 142.3 billion won recorded in 2023.

In the first seven months of this year, there were also 73 financial incidents involving 311.1 billion won. Notably, the amount involved in incidents at savings banks reached 127.4 billion won, about 27 times the 4.7 billion won recorded for all of last year.

Recent cases of personal information leaks following hacking attacks believed to have used artificial intelligence (AI) have emerged in the financial sector, raising a new challenge around internal control accountability.

Personal information leaks involving customers and loan solicitors, among others, have been confirmed at Shinhan Bank, KB Kookmin Bank, Hana Bank, Yegarum Savings Bank and Hyundai Capital. These incidents were not included in statistics as of the end of July this year.

In June, financial authorities drew up AI guidelines for the financial sector, but they currently remain at the level of voluntary self-regulation.

A task force is expected to review a specific regulatory framework governing AI responsibilities and authority in the second half of the year. However, calls are growing for the responsibilities of executives to manage and oversee related risks to be defined more clearly without delay.

“More than 200 incidents have occurred since the responsibility map system was introduced, yet not a single case has resulted in anyone being held accountable. It is difficult to say the system is working properly,” Min said. “As AI is being used both in financial decision-making and in cyberattacks, we need to move quickly to improve the system and clearly define executives’ responsibilities.”

This content was produced with the assistance of AI translation services.