JIPYONG LLC

Jipyong News|KOREA LEGAL INSIGHT

Network Separation Rules to be Eased in the Financial Sector to Strengthen AI-Based Cybersecurity

2026.06.15

Introduction
<div> 
On May 22, 2025, the Financial Services Commission (FSC) held a meeting with chief information security officers (CISOs) from major financial companies, along with AI and cybersecurity experts, to discuss emerging cybersecurity risks posed by advanced AI models and explore response strategies for the financial sector. 
 
At the meeting, the FSC announced a package of measures aimed at strengthening cybersecurity capabilities in the financial sector while supporting AI transformation.  Key initiatives include easing network separation rules for AI-based cybersecurity applications, considering a complete lifting of network separation requirements for qualified financial institutions, establishing new AI cybersecurity support and research functions, and developing detailed AI cybersecurity guidelines. 
 
This announcement reflects the FSC’s recognition that advanced AI models present both potential cybersecurity risks and valuable opportunities—serving as powerful tools for detecting vulnerabilities, strengthening cyber defenses, and responding to increasingly sophisticated cyber threats. </div>
 
 
Overview of the Changes 
 
The FSC’s measures are intended to promote the use of AI by financial institutions, enabling more effective responses to emerging cybersecurity threats associated with advanced AI models.  According to the FSC, the initiative seeks to support AI transformation within the financial industry while enhancing cybersecurity capabilities. 
 
The measures focus on three key areas:(1) easing network separation rules to allow the use of AI and Software-as-a-Service (SaaS) technologies for cybersecurity purposes; (2) strengthening organizational and operational capacity through new advisory bodies, research functions, and support centers focused on AI cybersecurity; and (3) establishing detailed guidelines to assist financial institutions in responding to cybersecurity threats associated with advanced AI models. 
 
 
1. Easing Network Separation Rules for AI-Based Cybersecurity 
 
The FSC announced that network separation rules will be eased for the use of AI technologies in cybersecurity functions.  Examples include the use of advanced AI models for vulnerability assessments and utilizing SaaS-based security solutions to establish cybersecurity defense systems. 
 
The exemption framework will initially apply to 49 financial companies meeting specified eligibility requirements.  Eligible entities are financial companies subject to the Electronic Financial Transactions Act that: (i) possess at least KRW 10 trillion in assets; (ii) employ 1,000 or more regular employees; and (iii) are required to appoint a CISO. 
 
Financial companies seeking to utilize the exemption will undergo an expert review process assessing their cybersecurity management systems and AI capabilities.  Following the review, qualified institutions may receive a one-year no-action letter permitting the temporary easing of network separation requirements.  The exemption is limited to the use of AI and SaaS programs for cybersecurity defense purposes, including vulnerability testing and security tools.  Participating institutions must also comply with additional cybersecurity requirements designed to compensate for the relaxation of network separation controls. 
 
The review process will be conducted in phases.  The FSC expects to review approximately ten financial companies during the first phase in June and July 2025, followed by additional reviews during the second half of the year. 
 
 
2. Considering Broader Exemptions for Qualified Financial Institutions 
 
Beyond these immediate measures, the FSC also announced plans to consider a complete lifting of network separation rules for financial companies equipped with advanced cybersecurity and AI capabilities, using the financial regulatory sandbox framework. 
 
According to the FSC, the pace of AI transformation within the financial industry may be constrained if existing network separation requirements continue to limit the use of advanced technologies.  At the same time, the FSC acknowledged that financial institutions possess varying levels of cybersecurity preparedness and AI capabilities.  As such, the FSC intends to first extend regulatory flexibility to institutions that demonstrate sufficient cybersecurity and AI capabilities.  A rigorous screening process will identify qualified institutions, which may then be permitted to utilize AI technologies across a broader range of areas, including AI-driven cyber defense systems and AI-enabled business operations. 
 
 
3. Strengthening AI Cybersecurity Support and Governance 
 
The FSC also announced several measures to strengthen institutional support for AI cybersecurity across the financial sector.  
 
A new technology advisory group, consisting of AI, cybersecurity, and information protection experts, will be established to assess financial companies' preparedness and provide policy recommendations regarding cybersecurity threats posed by advanced AI models. 
 
In addition, a financial-sector taskforce on advanced AI cyber threats, established in April 2025 and comprised of representatives from the FSC, the Financial Supervisory Service (FSS), the Financial Security Institute (FSI), and CISOs in the financial sector, will continue to serve as a channel for communication between regulators and industry participants. 
 
The FSC also plans to strengthen the AI-related functions of the FSI.  Drawing on its cybersecurity expertise, the FSI will establish a new research institution dedicated to AI-related cybersecurity in the financial sector.  An AI cybersecurity support center will also be created to provide assistance to financial institutions, including information on emerging AI-related threats, security vulnerability assessments, and cybersecurity response measures. 
 
 
Implications for Foreign Companies 
 
For foreign financial institutions, fintech companies, cloud service providers, and cybersecurity vendors operating in Korea, the FSC’s announcement signals a regulatory effort to facilitate the use of AI technologies for cybersecurity purposes while maintaining supervisory oversight. 
 
The most immediate impact is likely to be the easing of network separation requirements for certain AI- and SaaS-based cybersecurity applications.  Notably, the FSC has indicated that broader exemptions, including a potential complete lifting of network separation rules, may be considered for institutions that demonstrate advanced cybersecurity and AI capabilities.  The announcement further highlights the increasing emphasis Korean regulators are placing on cybersecurity in the context of AI transformation.  In addition to regulatory flexibility, the FSC has announced plans to establish new advisory bodies, research institutions, support centers, and detailed AI cybersecurity guidelines to strengthen cybersecurity capabilities across the financial sector. 
 
Companies operating in Korea’s financial industry should monitor future developments regarding eligibility requirements, cybersecurity obligations, and implementation of the exemption framework.  Stakeholders should consult with legal professionals as the FSC proceeds with its phased review process and broader AI cybersecurity initiatives.

</div>

GLOBAL LEGAL INSIGHT Overview of the requirements for establishing Asset Management Institution in Cambodia 2026.06.18

KOREA LEGAL INSIGHT Court Grants Injunction Against Union Strike — A Landmark Ruling on the Boundaries of Industrial Action in Korea’s Semiconductor Industry 2026.06.02

Back to List

JIPYONG LLC

Related Practices

Professionals

Related Practices

Professionals

SHARE

Disclaimer

Limited Liabilities