The chief executive officer (CEO) of a commercial bank whose customer information was leaked in a hacking incident is expected to become the first target of sanctions under the accountability framework of the Financial Company Governance Act.
While there has been a case where Jeon (CEO) of Lotte Card, which saw 2.97 million people’s information leaked due to hacking, received severe sanctions, that was not a sanction based on the accountability framework. The level of sanctions against bank CEOs is expected to be a significant variable in the landscape for selecting the next CEO by the end of this year.
According to financial authorities on the 20th, the hacking incident in the financial sector that occurred around the end of September last month is spreading into an issue regarding sanctions against bank CEOs.
This follows Financial Supervisory Service Chairman Lee Chan-jin’s stance expressed at the National Assembly audit on the 19th: “This will likely be a case where responsibility for what may be the first CEO related to a cyber security hacking incident, which involves internal control management duties, is addressed.”
The FSS is currently conducting on-site inspections of Shinhan Bank, KB Kookmin Bank, and others where hacking incidents occurred.
Financial authorities have tentatively determined that there are violations of the CEO’s “internal control management duty” under the Governance Act. Financial companies clearly allocate internal control responsibilities by executive for key business areas according to the accountability framework.
In particular, the banking sector implemented the accountability framework first starting last year, with the bank CEO holding overall responsibility for internal controls.
There are precedents of CEOs receiving sanctions due to hacking incidents. Last July, financial authorities issued a reprimand warning to former Lotte Card CEO Jo Ja-jin.
Although this is a severe sanction that prohibits re-employment at financial companies for three years, the legal basis for the sanction was the Credit Information Act.
The leak of information from 2.97 million Lotte Card customers occurred last year, but in the case of card companies, the accountability framework was implemented in July of this year. Accordingly, Jo Jeon (CEO) was sanctioned under the Credit Information Act rather than the Governance Act.
However, analysis suggests there are many issues regarding whether a bank CEO can receive the first sanction under the Governance Act. Given the broad scope of internal control management duties, financial authorities separately prepared and published operational guidelines for CEO sanctions in 2024.
According to these operational guidelines, the severity of illegal acts must be recognized for CEO sanctions. There are eight detailed elements for determining severity: △failure to fulfill management duties △instruction, acquiescence, or promotion/neglect △broad or organized/concentrated illegal acts △long-term or repeated violations △issues raised regarding the possibility of illegal acts occurring △occurrence of large-scale customer damage △serious impairment of sound management △damage to trust and order in the financial market. At least one of these must apply.
A financial industry official said, “It is difficult to say that large-scale customer damage has occurred, and even Shinhan Bank, which had a relatively large leak scale, was not an incident that occurred repeatedly over a long period,” adding, “There is an excessive aspect to sanctioning the CEO for failing to prevent attacks on the ‘side door’ in addition to the main server, while blocking thousands of hacking attacks per day.”
While Lotte Card saw leaks of core transaction information such as card secret information and expiration dates, banks did not have account passwords or transaction information leaked.
However, there is a perception gap with the financial industry, given that FSC Chairman Lee Eui-yeon strongly criticized that “AI (artificial intelligence) hacking threats are increasing, but (financial companies’) response methods are lacking even in basic aspects.”
Analysis also suggests that the mere mention of the possibility of a first sanction against a bank CEO could become an unexpected variable in the selection of the next CEO by year-end.
As the terms of office for the CEOs of the five major banks all expire at the end of the year, financial holding companies have begun the process of selecting their next CEOs.
Given that a bank CEO has been selected as a witness for the National Assembly audit for the first time in five years, the impact of the information leak incident is not small. It is pointed out that outside directors of financial holding companies cannot help but consider this when selecting the next CEO.
in FINANCE
