South Korea Orders Security Checks at About 580 Financial Firms, Including Crypto Exchanges, After Wave of Breaches

South Korea's Financial Services Commission (FSC) said on 5 November 2026 that about 580 financial companies, electronic financial business operators and virtual asset service providers must undergo a full inspection of every externally reachable IT system and of their security internal controls, after 40 breach incidents at 37 firms were reported between 30 September and 3 November. Three of those firms were virtual asset businesses. The FSC also said it will draw up, during November, a guideline requiring crypto exchanges to report breaches immediately to the Financial Supervisory Service (FSS) and the Financial Security Institute, and that it plans to bring virtual asset service providers under security rules at the level of the Electronic Financial Transactions Act.

The measures were announced at a meeting chaired by FSC Chairman Lee Eog-weon with the FSS, the Financial Security Institute and the heads of industry associations, including the Digital Asset eXchange Alliance (DAXA), the self-regulatory body of Korea's won-based crypto exchanges.

What the Breaches Showed

According to the FSC, the 40 incidents reported since 30 September affected banks, securities firms, insurers, savings banks, a mutual finance institution, credit-finance companies, online investment-linked lenders, electronic financial business operators and three virtual asset businesses. About 473,000 records were leaked, mostly employee data, customer names, resident registration numbers and account numbers; the FSC said no leak of data such as account passwords that could enable fraudulent payments had been confirmed. After an all-sector checklist review was completed on 14 October, most new reports came from small and mid-sized securities and insurance firms, electronic financial businesses, online lenders and virtual asset exchanges.

In some small virtual asset exchanges, electronic financial businesses and online lenders, company-managed funds were also taken. The FSC put the amount reported so far at about KRW 1 billion, mainly transferred out of crypto hot wallets, consumable points, online lenders' deposits and other accounts in which firms pool customer funds. It said individual users had not yet suffered realised losses. The regulator pointed to the Virtual Asset User Protection Act, which requires crypto businesses to hold insurance or set aside reserves, and said the FSC, the FSS and the Financial Security Institute held an emergency meeting with DAXA and major virtual asset service providers on 2 November and ordered the sector to tighten controls to prevent further thefts.

What Crypto Exchanges Must Do and By When

The full inspection explicitly includes the virtual asset sector, even though crypto exchanges are not covered by the Electronic Financial Transactions Act. It covers every area that can be reached from outside: customer-facing websites, staff management, internal work and partner services, including authentication and access-control systems, business and administrative APIs, and development, test and temporary systems, which the FSC said is where recent breaches mostly occurred. Firms will also be checked on the roles and responsibilities of the CEO, the chief information security officer and the chief information officer, on how decisions are made to create, run and close external access points, and on whether they keep an IT asset register.

Firms first carry out a self-inspection and must record in detail what they checked, how and why they reached their conclusions, even when they find no problems. If a self-inspection looks inadequate or a serious weakness is found, the FSS and the Financial Security Institute will inspect on site. A firm that finds a vulnerability that could cause financial loss or a personal data leak must suspend the service and block outside access at once; it may resume only where the service is essential and immediate repair is not possible, under alternative controls and with the CEO's approval. Findings will be handled flexibly if fixed promptly, but firms breached after the inspection will be held strictly accountable.

Inspection of external access points on systems listed in firms' asset registers is to be finished by 30 November 2026. Inspection of unlisted systems and the review of internal control structures, including the CEO and CISO, is to be finished by 31 December 2026. Today, crypto exchanges report breaches to the Korea Internet and Security Agency (KISA) under the Information and Communications Network Act; the new reporting guideline, due in November, will require them to notify the FSS and the Financial Security Institute as well.

What Comes Next

The FSC plans a security internal control guideline for the whole financial sector in the first quarter of 2027, based on the inspection results. A planned Digital Financial Safety Act would apply security rules at the level of the current Electronic Financial Transactions Act to sectors that hold large volumes of customer data or where a breach could cause direct asset losses, naming virtual asset service providers and insurance agencies, and would look at rules for third parties such as cloud providers and platforms. The FSC aims to prepare the bill in the first quarter of 2027.

Other steps apply mainly to firms already covered by the Electronic Financial Transactions Act: vulnerability assessments twice a year instead of once, starting with large firms, with all external access points in scope, through an amendment to the Electronic Financial Supervision Regulation to be pre-announced in November, and support for a pending bill that would let regulators impose repeated enforcement fines when serious weaknesses are left unfixed. An upgraded threat-sharing system is due for a pilot in December and full use in the first quarter of 2027. Chairman Lee told CEOs across the sector to set up company-wide emergency response teams immediately.