CEO Accountability for Neglecting Serious Security Vulnerabilities... Financial Authorities Push to Strengthen Internal Controls at Financial Firms

Survey of financial firms' security controls to be followed by improvement measures
Clarifying roles, responsibilities, and decision-making procedures for CEOs, CIOs, and CISOs
"Strict accountability for delaying action despite knowing of vulnerabil

In response to a series of hacking incidents in the financial sector, financial authorities are pushing to formally set out in financial companies’ internal regulations the security responsibilities of executives, including chief executive officers (CEOs), as well as reporting and decision-making procedures. The aim is to review the entire internal control framework, from accident prevention to the response after a hack, and ultimately hold CEOs accountable if necessary security measures were neglected.

According to financial authorities on October 15, the Financial Supervisory Service plans to examine how financial companies design and operate their security-related internal controls, including through a comprehensive survey of their external-facing systems, and draw up measures for improvement.

While an emergency checklist review of 555 financial companies focused on preventing further breaches, this review will look into whether procedures functioned properly from the recognition of vulnerabilities through reporting, follow-up measures, and final decision-making. The previous day, October 14, financial authorities announced that they had confirmed a breach involving the leakage of approximately 100,000 records of personal information at 16 companies around the time of the Shinhan Bank incident and unveiled follow-up measures.

A key part of the measures to strengthen internal controls is defining the division of roles and responsibilities among the CEO, chief information officer (CIO), and chief information security officer (CISO). At financial companies, the CISO is currently responsible for information security, while the CIO oversees the operation and stability of IT systems. Even if a CISO identifies a security vulnerability and calls for it to be fixed, the actual system improvements are handled by an organization under the CIO, meaning delays in taking action could lead to an incident. In particular, financial authorities believe that procedures need to be clearly established for the CEO to mediate and make the final decision if the CISO’s calls for stronger security measures, such as security patches or system outages, conflict with the CIO’s assessment of how to ensure service continuity. The authorities also recognize that CIOs involved in building and operating external-facing systems, which have been the subject of controversy in this case, cannot be exempt from responsibility for hacking incidents.

A financial authority official said, "To respond swiftly to breaches, the roles and responsibilities of not only the CISO but also the CIO and, ultimately, the CEO must be clear." The official added, "In that it makes executives’ decision-making and accountability more specific, this can be seen as helping to make the existing accountability map more effective."

The Financial Supervisory Service plans to assess how each financial company identifies, reviews, and addresses external vulnerabilities before drawing up measures for improvement. It is considering preparing guidelines and requiring financial companies to incorporate them into their internal regulations. The authorities also intend to consider measures to address areas where the responsibilities set out in existing accountability maps are not functioning in practice. In November 2025, Assemblyman Yoo Dong-soo of the Democratic Party of Korea introduced a bill to amend the Electronic Financial Transactions Act, which included provisions to clarify CEO responsibility for information security and strengthen the authority of CISOs.

If future regulatory improvements specify the security responsibilities of financial company executives, whether they properly fulfilled their related obligations when a hacking incident occurs is also expected to become a key factor for financial authorities when deciding on sanctions. Depending on the circumstances of an incident and the extent of any breach of responsibilities, sanctions could extend to executives, including the CEO. However, rather than imposing responsibility uniformly based solely on the occurrence of an incident, financial authorities intend to take a comprehensive view of efforts to prevent incidents in advance, whether security measures were implemented, and how the company responded afterward.

A financial authority official emphasized, "Security is a key task that CEOs must personally recognize as important and oversee responsibly, from prevention through incident response, so internal controls need to be strengthened further." The official added, "If the necessary measures to prevent breaches were diligently implemented, that should be taken into consideration. But if an incident occurred because executives knew of a serious vulnerability and neglected to respond, they should be held strictly accountable."

Meanwhile, according to financial authorities, breaches were confirmed at a total of 16 financial companies across all sectors, including banks, savings banks, mutual finance institutions, specialized credit finance companies, electronic financial businesses, online investment-linked finance businesses, and virtual asset service providers, around the time of the hack of Shinhan Bank’s system for loan agents. The scale of the information leak confirmed so far is approximately 100,000 records, including names, contact information, and resident registration numbers. No leakage has been confirmed of information that could directly enable fraudulent transactions, such as account passwords or card numbers.

This content was produced with the assistance of AI translation services.