Financial regulators push to require firms to identify and manage all IT assets

Financial regulators have identified the failure to identify and manage IT assets as one of the root causes of recent hacking incidents in the financial sector, and are pushing a plan to mandate that financial institutions comprehensively manage their IT assets through computerized systems. As the current Electronic Financial Transactions Act does not explicitly mandate the identification and management of IT assets, regulators have begun reviewing a legislative amendment.

According to industry sources on the 14th, financial regulators are considering introducing new regulations requiring financial institutions to identify and manage all hardware and software they hold and operate through computerized systems. The measure is expected to be implemented by explicitly stipulating management obligations in the Electronic Financial Supervision Regulations, a subordinate regulation linked to an amendment of the Electronic Financial Transactions Act.

Financial regulators cited the fact that banks failed to properly identify and manage IT assets used internally as a primary cause of the hacking incident. However, it was determined that while business support systems for hacked loan solicitors were included in the scope of managed IT assets, management of these systems was relatively inadequate compared to major assets such as internet banking. In particular, some systems lacked systematic management regarding the end-of-support (EOS) date of software, components, and security patch history.

Article 21 of the current Electronic Financial Transactions Act imposes an obligation on financial institutions to ensure the safety of electronic financial transactions. While the Electronic Financial Supervision Regulations, established based on this provision, include standards for protecting computer systems, there is no clause explicitly requiring the comprehensive identification and management of all IT assets through computerized systems. However, the specific method and timing of the legislative amendment have not yet been determined.