[Financial Microscope] AI and Hacking Threats Put Financial Sector Internal Controls on Alert... Growing Calls to Strengthen "Executive Accountability"

Financial Sector Lags in Spending Security Budgets... Senior Executives Need to Change Their Mindset
Zero Executive Sanctions Despite Introduction of Responsibility Maps... Effectiveness in Question
Regulators Should Specify Accountability and Exemp

As cyberattacks, including hacking using artificial intelligence (AI), become increasingly sophisticated, calls are growing for financial companies to fundamentally improve their internal control systems. The view is that security incidents should be treated not as problems for individual departments but as enterprise-wide risks for which senior management is accountable. To encourage financial company CEOs to invest in security and expand their workforces, experts say financial authorities should establish precise standards that clearly define the scope of senior management's responsibility when an incident occurs while allowing preventive efforts to be taken into account when determining accountability.

Financial Sector Falls Short on Security Budget Spending; Some Cut Budgets

According to data titled "IT and Information Security Budgets and Spending by Financial Sector and Company" submitted by financial authorities to Rep. Park Sung-hoon of the People Power Party, a member of the National Assembly's Political Affairs Committee, the 20 financial companies with the most system outages spent just 69.6% of their total information security budgets last year. In other words, about 30% of their allocated security budgets went unspent.

Spending performance on security budgets was particularly weak at major banks. Among the 10 banks included in the survey of 20 companies, Woori Bank had the lowest spending rate at 53.8%. KB Kookmin Bank (58.1%) and Shinhan Bank (69.9%) also failed to spend a substantial portion of their allocated budgets.

A considerable number of financial companies also cut their information security budgets this year. Among the 20 companies surveyed, seven had lower budget allocations in the first half of this year than last year. Of the major banks, Woori Bank recorded the largest budget cut, at 21.7%, followed by Citibank Korea (-18.0%) and Shinhan Bank (-10.4%).

Information security budgets also had lower spending rates than overall IT budgets. According to data titled "Information Security Budgets and Workforce in the Financial Sector Over the Past Five Years (2022 to the First Half of 2026)" submitted by the Financial Supervisory Service to Rep. Kim Jae-seop of the People Power Party, a member of the National Assembly's Political Affairs Committee, the IT budget spending rates at major banks last year were 83.0% at Shinhan Bank, 78.8% at KB Kookmin Bank and 76.2% at Woori Bank, in that order. The gaps between the banks' IT budget spending rates and their information security budget spending rates ranged from 13.1 to 22.4 percentage points.

One reason cited in the financial sector for this gap is that senior management views security investment as a cost rather than a necessary investment. Overall IT budgets include not only security spending but also investment in new digital businesses and efforts to strengthen competitiveness in sales. While budget spending rates alone cannot determine the security level of an individual financial company, experts say security investment should be given a commensurate priority as financial services become increasingly reliant on digital technology.

Even When Incidents Occur, Accountability for Senior Management Remains Elusive

However, increasing security budgets and specialist staffing alone cannot prevent all financial incidents. Hacking attacks using AI are rapidly becoming more sophisticated, and their timing and form are difficult to predict, limiting the ability to prevent them entirely.

For this reason, financial industry and academic experts say that what matters is not the occurrence of an incident itself, but whether senior management fulfilled its duties of oversight and supervision to prevent and respond to it. They argue that financial companies need to move beyond leaving information security to individual departments and have the CEO lead comprehensive management of security investment, organizational operations and incident response systems.

The problem is that even though systems have been introduced to strengthen senior management's responsibility for internal controls, few cases have led to actual accountability. One prominent example is the accountability structure, which began to take effect in stages last year.

According to data submitted by the Financial Supervisory Service to Rep. Min Byung-deok of the Democratic Party of Korea, a member of the National Assembly's Political Affairs Committee, a total of 203 financial incidents, involving KRW 623.7 billion, were reported at financial companies subject to the accountability structure between January last year and the end of July this year. Of these, 34 incidents, involving KRW 146.8 billion, occurred after the system was introduced. However, not a single executive has been sanctioned under the accountability structure.

Of course, these statistics include financial incidents other than hacking, making it difficult to link them directly to cybersecurity incidents. The absence of sanctions does not, by itself, prove that the system is ineffective. However, experts say that as the misuse of AI is likely to make cyberattacks even more sophisticated, it is necessary to specify the duties of oversight and supervision and the standards for determining accountability for executives by type of incident.

"Authorities Should Set Out Principle-Based Standards for Accountability and Exemption"

There are growing calls in the financial sector for financial authorities to establish more precise standards for senior management's accountability and exemption from liability in order to reduce security incidents. The goal, experts say, should not simply be to strengthen accountability when an incident occurs, but to encourage senior management to take an active role in security investment and internal controls in their day-to-day operations.

In June, the Financial Services Commission announced and began implementing amendments to its "Guidelines on Artificial Intelligence in the Financial Sector." The guidelines set out seven principles, including the roles and division of responsibilities of senior management, including the CEO, and the establishment of security standards for the use of AI. Financial authorities have also developed an AI risk management framework and a security guide.

However, these guidelines focus mainly on managing risks in the process of financial companies developing and using AI themselves. Experts say that hacking incidents caused by external attackers misusing AI are different in nature, and that standards should be specified for determining senior management's oversight and supervision responsibilities under existing information security regulations and the accountability structure.

The key is not to hold CEOs automatically responsible whenever an incident occurs, but to assess how faithfully they fulfilled their management duties to prevent one. Experts say the scope of responsibility for the CEO and executives in charge, such as the chief information security officer (CISO), should be clearly defined, while preventive efforts - including spending security budgets, expanding specialist staffing, conducting regular inspections and establishing incident response systems - should also be taken into account when determining accountability.

A senior executive at a financial company said, "To reduce AI security incidents in the financial sector, it is essential to foster a company-wide culture of information security management and investment, led by the CEO." The executive added, "To encourage CEO-led information security management, the authorities should specify which executives are accountable for each type of incident, while refining the system so that CEOs at financial companies whose measurable efforts to increase security budgets and staffing are evident are eligible for exemption from liability."

Conversely, some argue that mechanisms are needed to impose meaningful accountability when senior management is found to have breached its oversight and supervision duties. The argument is that senior executives who have made sufficient efforts to prevent incidents should be protected, while those who have neglected their duties should be held accountable accordingly. A clawback system, under which senior management's performance bonuses are recouped when an incident occurs, has been proposed as an alternative. Chae Sang-mi, a professor in the Department of Business Administration at Ewha Womans University, stressed, "When necessary, a clawback system should be introduced to recoup the performance bonuses of the CEO or the executive responsible under the accountability structure, rather than those of working-level staff, after an incident occurs."

This content was produced with the assistance of AI translation services.