As hacking incidents at financial institutions continue, the financial authorities are expected to examine whether CEOs (Chief Executive Officers) have violated their internal control management obligations. Attention is turning to whether this will become the "first sanction case" since the introduction of the accountability structure framework for financial firms.
According to the financial authorities and the financial investment industry on the 8th, the Financial Services Commission and the Financial Supervisory Service are keeping open the possibility of applying the amended Financial Institution Corporate Governance Act (Act on the Corporate Governance of Financial Companies) in their investigation into the handling of large-scale hacking and data leakage incidents that occurred from late September. A senior official at the financial authorities stated, "We will closely examine whether CEOs and CISOs (Chief Information Security Officers) have properly fulfilled their roles under the accountability structure framework stipulated by the Corporate Governance Act," adding, "Because specific legal provisions exist, this is a case where the accountability structure framework can be applied. We will make a judgment after comprehensively reviewing other laws and regulations."
Another official at the financial authorities said, "There are grounds to hold CEOs accountable under laws and regulations beyond the Corporate Governance Act," noting that "this broadly means that we intend to hold CEOs responsible when financial incidents occur."
The Financial Institution Corporate Governance Act, amended in January 2024, explicitly states that "CEOs and others, as the ultimate persons responsible for the execution and operation of internal controls, must effectively implement overall management measures." If a CEO or executive violates their internal control management obligations, the Financial Services Commission may impose sanctions such as △a request for dismissal, △suspension of duties for up to six months, △a formal warning, △an advisory warning, or △a caution.
37 financial investment firms with assets exceeding 5 trillion won have already been implementing the accountability structure framework based on the Financial Institution Corporate Governance Act since July 3 last year. Additionally, 1,007 small and medium-sized financial investment firms began adopting and implementing the framework from July 3 this year. The accountability structure framework is a document that pre-clarifies internal control responsibilities for each executive of a financial company to clearly identify liability when an incident occurs; it also specifies the CEO's overall management duty. Therefore, the grounds for authorities to hold CEOs accountable at financial investment firms where cybersecurity incidents have occurred—such as Daishin Securities, Mirae Asset Global Investment Management, Hanyang Securities, and Mirae Asset Securities—are clear.
It is expected that the financial authorities will closely scrutinize the operational status of the accountability structure framework as part of their comprehensive inspection of internal control operations for security management. The financial authorities announced on the 5th that they would conduct a full-scale investigation this year into the internal control system, which defines the roles and responsibilities of key executives, including CEOs.
Recently, heads of the financial authorities have repeatedly emphasized "CEO responsibility." Lee Chan-jin, Governor of the Financial Supervisory Service, stressed in an executive meeting on the 3rd, "In particular, for large financial institutions such as comprehensive financial investment businesses (CFIBs) and insurance companies, we will strictly hold management, including CEOs, accountable, consistent with our previously announced inspection and sanction policies for the banking sector." Lee Eui-woon, Chairman of the Financial Services Commission, stated during last month's National Assembly audit regarding CEOs' internal control obligations that "fundamental requirements that should have been upheld were not," adding that "clawbacks (recovery of performance-based compensation) will also be reflected in corporate governance improvement plans."
The industry is closely monitoring the possibility of sanctions against CEOs. Some opinions suggest it may be difficult for the financial authorities to prove specific violations of CEO obligations under the Corporate Governance Act. An industry official said, "When introducing the accountability structure framework, we invested significant consulting and IT development costs to systematize it," adding, "CEOs and executives have regularly checked internal control compliance in accordance with the framework, and if all records are preserved, it will not be easy to hold them accountable."
in STOCK
