my timesThe Korea Times

Gov't to ease regulations on cloud-based software at financial firms

Listen
gettyimagesbank

gettyimagesbank

Financial authorities are moving to ease network separation rules that have long constrained the use of cloud-based software by financial services providers, in a major step toward modernizing a tightly regulated financial IT environment, market watchers said Monday.

The reform is expected to significantly lower compliance barriers for financial firms, accelerating digital transformation and elevating Korea’s regulatory framework closer to global standards.

The Financial Services Commission (FSC) and Financial Supervisory Service (FSS) said they will run a notice period before the revisions to the law governing electronic financial supervision.

The revisions will allow financial entities to use cloud-based software-as-a-service (SaaS) applications on internal business networks without going through the “innovative financial services designation” process, as long as they meet strict security requirements.

Central to the move is a partial easing of Korea’s network separation rules stipulating that financial entities’ internal systems should be isolated from external networks.

The rules seek to prevent hacking and data leaks, but has been criticized for stunting cloud-based financial innovation efforts.

SaaS platforms by nature require continuous data exchange between internal systems and cloud servers operated by a third party, violating existing regulations.

The FSC says the easing reflects a shift in regulatory priority.

So far, cloud-based tools have been treated as experimental technologies requiring government approval, but now they are recognized as essential infrastructure for everyday business operations.

Still, sensitive information such as personal credit data will be subject to the previous separation rules, to prevent the weakening of security practices in light of the recent rise of hacking incidents and data breaches.

Details of the revisions will be announced 20 days before being finalized and implemented.