The heads of South Korea's five biggest banks faced strong criticism at a parliamentary audit over loan-rate calculations, personal data leaks and financial consumer protection. Lawmakers raised suspicions that banks increased interest income by cutting preferential rates even as they lowered add-on rates following a legal revision. They also pressed banks over slow responses to hacking incidents, a lack of security investment and compensation for victims. Some bank chiefs also came under criticism from the chair of the National Assembly Political Affairs Committee after failing to properly explain how rates were adjusted.

At an audit on Monday afternoon of the Financial Supervisory Service, the Korea Deposit Insurance Corp and the Korea Inclusive Finance Agency, Lee Hwan-ju (이환주), CEO of KB Kookmin Bank, Jeong Sang-hyeok (정상혁), CEO of Shinhan Bank, Lee Ho-seong (이호성), CEO of Hana Bank, Jeong Jin-wan (정진완), CEO of Woori Bank, and Kang Tae-young (강태영), CEO of NH NongHyup Bank, appeared as witnesses. It was the first time in 4 years since 2022 that the five bank chiefs had appeared together as witnesses at a parliamentary audit.

Questioning continued over bank chiefs' responsibility for security management in the wake of personal data leak incidents. As the scope widened to loan rates, credit screening and branch closures, criticism mounted that banks' management decisions were shifting unreasonable burdens onto financial consumers.

"A bank CEO who doesn't even know that"... chair personally rebukes banks over preferential rate cuts

The loudest line of questioning focused on how banks calculate loan interest rates.

Min Byung-deok of the Democratic Party said a revision to the Banking Act required banks to exclude certain statutory costs from add-on rates, but banks were also cutting preferential rates and offsetting any effective reduction in loan rates.

Min said the cut in loan rates from the Banking Act revision was expected to be 0.15 to 0.30 percentage points, but consumers were not feeling it.

He took particular issue with rate changes at KB Kookmin Bank and NH NongHyup Bank.

According to 자료 presented by Min, KB Kookmin Bank's add-on rate fell to 3.34 percent in August from 3.42 percent in June, but its adjustment rate, which corresponds to preferential rates, was also reduced over the same period.

NH NongHyup Bank's add-on rate also fell to 3.34 percent from 3.60 percent, but its preferential rate declined to 1.58 percent from 2.19 percent. While the add-on rate fell 0.26 percentage points, the preferential rate was reduced by 0.61 percentage points. Based only on the adjustments of those two items, the bank's share reflected in the actual loan rate effectively increased by 0.35 percentage points.

Min said, "By lowering the add-on rate while cutting preferential rates even more, the bank's share actually grew," and asked whether banks lowered preferential rates despite knowing the intent of the Banking Act revision in order to take more.

Lee Hwan-ju of KB Kookmin Bank and Kang Tae-young of NH NongHyup Bank could not immediately explain in detail how the adjustments were made. They answered that they would check with relevant departments and detailed 자료 and report separately.

Ryu Dong-su, chair of the Political Affairs Committee, then stepped in. Ryu raised his voice, saying, "Are you telling me you are a bank CEO without even knowing that?" and "Are you serving as a bank CEO with that level of ability?" He added, "Why does interest income surge every year? Do you mean to suck the blood of the public through interest?"

Ryu demanded that KB Kookmin Bank and NH NongHyup Bank submit internal standards related to preferential rate adjustments. He also told the Financial Supervisory Service to closely inspect each bank's rate calculation system.

Min said 자료 on add-on rates at the five biggest banks that he had requested in the morning were submitted, but detailed 내용 were missing. He said the banks submitted only totals without distinguishing the amounts of statutory costs excluded by each bank, making it difficult to verify whether the intent of the legal revision was reflected.

He also said detailed 자료 on preferential rates were not being submitted on the grounds of business secrecy, and demanded that banks submit detailed 자료 by Oct. 22, ahead of the comprehensive audit.

Focus on Kookmin Bank's hacking response... dispute over changed answers on "no order to cover up"

On the personal data leak incident, KB Kookmin Bank faced concentrated questioning over its initial response and the process of recognising the incident.

Kim Yong-man of the Democratic Party said Kookmin Bank was hit by a hacking attack earlier than other commercial banks but failed to respond actively, and did not prevent additional leaks.

According to 자료 presented by Kim, the first attack on Kookmin Bank occurred at 11:19 p.m. on Sept. 27. The bank judged it as routine abnormal traffic and only blocked the attacking IP address, he said.

A second attack via a Vietnam IP address occurred on Sept. 29, and critics said customer information for 81 people was additionally leaked in the process.

Kim criticised the bank, saying it took about 80 hours after the initial intrusion for Kookmin Bank to confirm indications of a leak, and that the timing of its report to the Financial Supervisory Service was also close to the statutory reporting deadline.

He also asked repeatedly whether the bank independently confirmed abnormalities before receiving attacker IP information from the Financial Security Institute on Sept. 30.

Lee said the bank identified abnormalities on the morning of Sept. 30 and took blocking measures before the Financial Security Institute's notification. He said there was, however, a gap between when the bank recognised abnormal signs and when it confirmed the actual customer information leak.

Kim again pressed him, saying, "Not whether you received 50,000 cases or 70,000 cases, but did you know that," and demanded a clear answer.

Allegations were also raised that Kookmin Bank deleted internal logs and ordered a cover-up.

Kim asked about the facts, saying there was a tip-off that an executive in charge of information security ordered log deletion during a meeting of relevant departments on the morning of Sept. 30.

Lee first replied, "There was not," but when asked again whether such an order had been given in the meeting, he said, "I have not heard," and "I was not reported."

When Kim pressed him on why his answers changed, Lee explained that he meant he had never personally given an order to cover up.

Kim rebuked his stance, saying the question was not whether the bank chief personally issued an order but whether there was such discussion or instruction internally.

Kim said Kookmin Bank's delayed response could not be seen as a simple practical mistake and called for a thorough investigation by financial authorities.

Lee Chan-jin, head of the Financial Supervisory Service, replied that the issue of responsibility of a chief executive officer could be addressed in connection with internal control over cyber security at financial companies.

Information security budget 42 percent unspent... criticism that compensation shifts burden of proof to customers

Lawmakers also pointed to banks' security investment and compensation systems as problems.

Kim Jae-seop of the People Power Party criticised banks, citing the scale of personal data leaks and the time taken to recognise incidents, saying banks failed to fulfil sufficient responsibility to protect customer information.

According to 자료 disclosed by Kim, Shinhan Bank took 15 hours and 26 minutes to recognise a hacking incident, and the number of people subject to personal data leaks reached 25,729. Hana Bank was also presented as having taken 41 hours and 44 minutes to recognise an incident.

In Shinhan Bank's case, Kim said only 5,682 customers, or about 22 percent, among those subject to the leak checked whether their information had been leaked.

Kim said it was problematic that victims must confirm whether their information was leaked and also prove damage in order to receive compensation.

He also criticised KB Kookmin Bank's compensation policy for including the phrase "proven" damage, and Hana Bank for not presenting a specific compensation policy.

The actual execution rate of security budgets also came under scrutiny. Kookmin Bank budgeted 67.6 billion won for information protection last year but did not spend 28.3 billion won of that amount. Its execution rate was about 58 percent.

NH NongHyup Bank's execution rate for its information protection budget was also only 53 percent. Hana Bank was presented as having spent 100 percent.

Lawmakers took issue not only with budget shortages but also with banks failing to properly spend budgets they had secured, and pressed bank management on responsibility for security investment.

The bank chiefs apologised in turn and pledged to prevent a recurrence.

Lee said, "As a financial institution that must be based on trust, I sincerely apologise to our customers and the public for causing concern over this incident."

He added that the bank would secure sufficient security-related budgets and staff and strengthen its security system so it can respond to AI-based attacks.

Lee Ho-seong of Hana Bank also apologised over the personal data leak incident and promised to fully compensate if damage occurs.

He said the bank had implemented some steps such as fee waivers and would support customers' enrolment in financial safety insurance with customer consent.

Jeong Jin-wan of Woori Bank said no direct damage from information leaks had been confirmed, but the bank would not take the fact that it avoided damage this time as a basis for reassurance, and pledged to strengthen security capabilities.

Kang Tae-young of NH NongHyup Bank said the bank would further upgrade its existing integrated monitoring system to improve its security response capability.

Banks make money as branches shrink... criticism of neglecting financially vulnerable groups

The issue of financial accessibility due to banks reducing branches was also raised.

Kim Jae-seop said that as banks expanded interest income, offline branches were shrinking, causing inconvenience for financially vulnerable groups such as older people.

He cited Dobong district in Seoul, saying the pace of branch reductions was fast and the share of older residents was high, leaving many people struggling to use non-face-to-face financial services.

Kim said there were cases where customers had to wait a long time to handle bank 업무 because of fewer branches, raising doubts about the effectiveness of the inclusive finance banks emphasise.

The bank chiefs explained that branch reductions were concentrated in the past, but the scale of closures has been reduced recently.

Questioning of the five bank chiefs broadened beyond identifying the causes of hacking incidents to overall bank management, including loan rate calculations, security investment, victim compensation, credit management and financial accessibility.

As bank chiefs failed to sufficiently explain the grounds for key management decisions, lawmakers also pressed the financial authorities over their supervisory responsibility.

With the National Assembly demanding submission of 자료 related to rate calculations and security management by Oct. 22, ahead of the comprehensive audit, controversy over the state of internal controls at each bank and management responsibility is expected to continue for the time being.