Issues including banks’ loan-rate calculations, hacking incidents, IT system management and financial holding companies’ governance were raised repeatedly at a National Assembly audit. Questions ranged from allegations that banks reduced preferential rates after tighter rules on add-on loan rates, to differences in security systems by financial company and cases in which IT errors went unnoticed for long periods. The banking sector’s overall management and internal control practices came under scrutiny.

At a National Assembly Political Affairs Committee audit of the Financial Supervisory Service, the Korea Deposit Insurance Corporation and the Korea Inclusive Finance Agency on the morning of Oct. 19, lawmakers questioned Financial Supervisory Service Governor Chan-jin Lee (이찬진) about interest-rate calculation practices, information security systems and the governance of financial holding firms. With witness questioning of the heads of the five major banks scheduled later in the day, lawmakers called for submission of related data and fact-finding checks by supervisors.

Add-on rate rules take effect, but allegations banks cut preferential rates

Min Byeong-deok (민병덕), a lawmaker from the Democratic Party, raised the possibility that banks reduced existing preferential rates instead of excluding unfair costs when calculating add-on rates, in relation to an amended Banking Act that took effect on the 1st.

The revised Banking Act includes provisions to prevent banks from unfairly reflecting statutory costs they must bear, such as deposit insurance premiums, in add-on loan rates. The aim is to improve the practice of including costs that banks should bear themselves in lending rates and passing them on to financial consumers.

Min said it was necessary to check whether improvements were emerging in actual loan-rate calculations after the law took effect. He asked the Financial Supervisory Service for data on detailed add-on rate items at the five major banks.

He also raised suspicions that banks maintained or expanded profits by lowering add-on rates while also reducing preferential-rate benefits. He said the impact of the law in reducing consumers’ burdens could be offset by adjustments to other rate items.

Min said, "If, after passage of this law, they used tricks such as shifting the burden to other parts like a balloon effect, that is a clear act of deception against the public."

He also asked the Financial Supervisory Service to have related data submitted ahead of the witness questioning of the five major bank chiefs scheduled for the afternoon.

Hack damage differed by bank; FSS says it will check defences

Differences in security systems among banks have also emerged as a key issue over hacking and personal data leaks in the financial sector.

Han Min-su (한민수), a Democratic Party lawmaker, cited a Financial Services Commission announcement on the 14th, saying intrusion incidents occurred at 16 financial companies and about 100,000 cases of personal information were leaked.

He asked about the cause, saying hacking damage occurred at Shinhan Bank, KB Kookmin Bank and Hana Bank, while no information leak due to attacks had been confirmed at Woori Bank and NH Nonghyup Bank as of the time the data were checked.

Lee mentioned Woori Bank’s multi-factor authentication system and differences related to Nonghyup Bank’s externally exposed systems. He said Woori uses authentication using designated tablets or smartphones, and Nonghyup Bank did not have a separate external system for loan brokers. He added it has not yet been verified whether these differences actually prevented hacking damage, and said he would check the banks’ explanations directly.

Han proposed that if the two banks’ responses are confirmed to have produced real defensive effects, common security standards should be created so they can be applied to other financial companies.

He also pointed to problems in managing security vulnerabilities across the financial sector. Data he presented showed that in an inspection of 554 financial companies, 130 companies, or 23.4 percent, had inadequate management.

Han stressed additional verification was needed even for financial companies where no vulnerabilities were found. He also proposed expanding the number of times and the scale of participation, as well as the reward level, in a bug bounty system that provides rewards for reporting security vulnerabilities.

Lee responded that the watchdog is pushing ahead with a full re-inspection of externally exposed systems, and is preparing measures to strengthen bug bounty operations to the level of the Korea Internet and Security Agency.

Toss Bank took 670 days to find IT error; delays in recognising incidents repeated

Lawmakers also said systems to prevent and detect internal IT errors early must be improved, not only defences against external hacking.

Kim Hyeong-yeon (김형연), a lawmaker from the Rebuilding Korea Party, cited cases of errors in Toss Bank’s foreign exchange and remittance systems, raising questions about financial companies’ capabilities in managing internal systems.

According to Kim, Toss Bank in March cancelled foreign exchange transactions worth 27.6 billion won in a batch due to an error in its Japanese yen exchange rate posting system. On the 7th, another error occurred in which a transaction processed as a remittance failure at another bank was recorded as having been deposited into a Toss Bank account.

Some financial companies were also shown to have taken long periods to discover IT errors. In data presented by Kim, the time taken to discover program errors was 902 days at Lotte Insurance, 670 days at Toss Bank and 620 days at A Life Insurance.

Cases in which recognition of incidents was delayed by more than 30 days also recurred. The data cited showed 9 such cases at Toss Bank and 7 each at Suhyup Bank and KB Kookmin Bank.

Kim said the financial authorities’ measures announced on the 14th to strengthen financial security management systems focused on external intrusion incidents and managing security vulnerabilities. He demanded supplements including advance verification and early detection measures for internal IT errors.

He also pointed to problems in the basis for sanctions for violations of reporting obligations. Unlike external intrusion incidents, reporting obligations for general electronic financial incidents are stipulated in the electronic financial supervision rules, leaving an insufficient basis for imposing fines for breaches of reporting duties, he said.

Kim asked the authorities to check the causes at financial companies where recognition of incidents is repeatedly delayed and whether improvements are being made, and to consult with the Financial Services Commission on measures to improve related systems.

Lee responded in the sense that he would look at control systems related to internal system failures and review improvement measures.

BNK Financial chair succession procedure controversy; FSS inspection results not disclosed

Controversy over the governance of financial holding firms also continued.

Park Hong-bae (박홍배), a Democratic Party lawmaker, said there were problems with the fairness of the recruitment period and screening procedures in BNK Financial Group’s chair succession process.

According to Park, BNK Financial began its chair succession procedure on Oct. 1 last year and closed applications on Oct. 16. The period included the Chuseok holiday, and the point at which the succession procedure became known through the media was Oct. 13.

He also raised an issue with the fact that all 7 external figures included in the candidate pool were eliminated.

The Financial Supervisory Service conducted an on-site inspection related to governance at BNK Financial from Dec. 22 last year to late January this year, but the results were not disclosed. BNK Financial’s chair succeeded in winning a second term after a shareholders’ meeting in March.

Park said, "Ahead of the parliamentary audit, I requested data on the inspection results, but the Financial Supervisory Service is not submitting the data on the grounds that procedures are not complete," and added, "At a minimum, the progress of the inspection and items requiring improvement must be reported to the National Assembly."

Lee said the on-site inspection had been completed and the watchdog was conducting legal reviews of the results. He said the watchdog had to be cautious about disclosure because releasing related content before sanctions procedures are finalised could affect the parties’ rights of defence.

Park also raised suspicions that political influence was involved in the incumbent BNK Financial chair’s initial appointment process, and demanded confirmation of the circumstances of hiring and the work details of a specific person at an affiliate.

Outside interference allegations in appointment of outside directors at Woori and KB Financial affiliates

Allegations were also raised that external figures intervened in the appointment of outside directors at Woori Financial Group and KB Financial Group affiliates.

Choi Eun-seok (최은석), a lawmaker from the People Power Party, cited the fact that individuals from a specific tax accounting firm were consecutively appointed as outside directors at Woori Financial Capital and KB Capital. He said an investigation was needed into personnel procedures at financial holding company affiliates.

Choi said individuals from the tax accounting firm Taxtop, where the spouse of Kim Hyeon-ji, the presidential office secretary for attached affairs, holds a 20 percent stake and works, were appointed this year as outside directors at financial holding company affiliates and as tax tribunal judges.

He said tax accountant Jong-seok Jeong was appointed as an outside director at Woori Financial Capital early this year, tax accountant Jung-seok Kang was appointed as an outside director at KB Capital in March, and tax accountant Gwan-taek Go from the same firm was appointed as a tax tribunal judge in April.

Choi raised the possibility that the influence of external figures may have been at play in the process and demanded an inspection to determine whether the outside director appointment procedures at financial holding company affiliates operated normally. Lee replied, "I will look into it first."

At the audit on the morning of Oct. 19, a wide range of issues were raised, from banks’ loan-rate calculations to external hacking and internal IT errors, the governance of financial holding firms and single-stock leveraged ETFs. Lawmakers repeatedly said further checks and data verification by the Financial Supervisory Service were needed, particularly on the real effectiveness of banks’ security systems, interest-rate calculation practices and the appropriateness of outside director appointment processes.