[Exclusive] KB Kookmin Bank Again Denied 'Network Separation Exemption' After Hacking Incident; NH NongHyup Bank, Kakao Pay and Toss Pay Selected

KB Kookmin Bank Solely Excluded Among the Five Major Banks
First-Ever Exemptions for Electronic Financial Service Providers Including Kakao Pay and Toss Pay
FSC to Pursue Full Removal of Network Separation Rules

KB Kookmin Bank has once again been excluded from the Financial Services Commission's plan to ease network separation regulations, which is intended to help financial institutions respond to AI-based hacking threats. A series of recent hacking incidents across the financial sector has proved a stumbling block, leaving it as the only one of the five major banks to suffer back-to-back rejections. By contrast, NH NongHyup Bank and Industrial Bank of Korea were included in the list of institutions eligible for regulatory exemptions after reapplying, while the door to eased regulations was opened for the first time to electronic financial business operators such as Kakao Pay and Toss Pay.

According to financial authorities on November 6, the Financial Services Commission recently selected and notified 13 financial companies as the second group eligible for emergency relief from network separation regulations, allowing the use of AI and software as a service (SaaS) for security purposes. The selections had originally been due to be completed on October 7, but the schedule was delayed by about a month as authorities responded to hacking incidents in the financial sector and other issues.

In the banking sector, NH NongHyup Bank and Industrial Bank of Korea made the list of institutions exempt from network separation regulations after reapplying. Shinhan Bank, Hana Bank, Woori Bank, and internet-only bank KakaoBank were included in the first round of selections in June. With the two banks now joining them, Kookmin Bank is the only one of the five major banks not to receive an exemption.

The recent hacking incident is said to have been a decisive factor in Kookmin Bank's repeated exclusion. In late September, hackers breached the bank's mobile work-support system for employees, exposing the information of 2,091 customers. As KB Financial Group works to strengthen its AI and digital competitiveness, its affiliates KB Securities and KB Kookmin Card were selected for regulatory relief in the first and second rounds, respectively. Yet Kookmin Bank, the group's flagship bank, was left off both lists.

A financial industry official said, "Given that Kookmin Bank suffered a data breach, it would have been difficult for the financial authorities to ease network separation regulations for the bank. Shinhan Bank and Hana Bank also experienced incidents, but they had already received regulatory exemptions in the first round. The fact that NH NongHyup Bank and Industrial Bank of Korea, which were selected this time, had not experienced any incidents appears to have been a factor."

However, some have pointed out that the authorities' cautious approach to granting an exemption to Kookmin Bank is somewhat at odds with the policy's purpose. The bank suffered less data loss than the banks selected in the first round during the recent series of hacking incidents, even as the authorities are easing network separation regulations to counter AI-based hacking threats.

The second round also expanded eligibility for regulatory relief from traditional financial companies to electronic financial business operators. In the first round, exemptions from network separation rules were limited to traditional financial companies such as banks, insurers, and securities firms. For the first time, they were also extended to electronic financial business operators such as Kakao Pay and Toss Pay.

In the insurance sector, Samsung Life Insurance, Kyobo Life Insurance, and Shinhan Life were selected. Toss Securities was selected in the securities sector, while Samsung Securities was excluded again after being left out of the first round. In the credit card sector, KB Kookmin Card was included among the institutions eligible for an exemption from network separation rules.

Network separation is a regulation that separates a financial company's internal network from external networks to prevent outside intrusion, including hacking. It was introduced following a large-scale cyberattack in 2013. However, as AI-powered hacking techniques have become more sophisticated, concerns have grown that existing network separation rules alone are not enough to counter such threats. In response, the Financial Services Commission lifted restrictions on the use of AI for security purposes in June 2026. This marked a shift from a traditional closed defensive system to an active defense system using AI.

Cyberattacks targeting the financial sector have continued. According to the Financial Services Commission, 37 financial companies reported a total of 40 security incidents in the roughly one-month period after September 30, with approximately 473,000 pieces of information exposed. The amount of money stolen was estimated at approximately KRW 1 billion.

In response to the repeated hacking incidents, financial authorities are accelerating efforts to overhaul security systems under the principle that "AI attacks should be stopped with AI." They plan to fully lift network separation regulations across the financial sector while also making permanent the temporary exemptions that allow AI to be used for security purposes. The Financial Services Commission plans to launch a task force this month to fully lift network separation regulations and draw up detailed plans for regulatory changes, as well as plans to build a new AI-based security system, by the first quarter of 2027.

This content was produced with the assistance of AI translation services.