The CEO of a commercial bank that suffered a customer data breach in a hacking incident is expected to become the first to face sanctions under the accountability structure mandated by the Act on Corporate Governance of Financial Companies.
The former CEO of Lotte Card, whose hacking incident exposed the personal information of 2.97 million people, received a severe disciplinary action, but that case was not subject to sanctions under the accountability structure.
The anticipated level of disciplinary action against the bank chief is also expected to be a major factor in the selection of the next bank head at the end of this year.
According to financial authorities and other sources on the 20th, hacking incidents that occurred around late September last month are expanding into an issue regarding sanctions against bank presidents.
This follows Financial Supervisory Service Chairman Lee Chan-jin's stance expressed during a National Assembly audit on the 19th, stating, "This will likely be a case where responsibility issues concerning what is probably the first CEO related to a cyber security hacking incident for which internal control management duties apply are addressed." The FSS is currently conducting on-site inspections of Shinhan Bank, KB Kookmin Bank, and others where hacking incidents occurred.
Financial authorities have tentatively determined that there is a breach of the CEO's "internal control management duty" under the Governance Act. Financial companies clearly allocate internal control responsibilities among executives for key business areas in accordance with the responsibility structure system. In particular, the banking sector implemented the responsibility structure system first starting last year, with the bank president holding overall responsibility for internal controls.
There are precedents of CEOs being sanctioned due to hacking incidents. Financial authorities issued a disciplinary warning to former Lotte Card CEO Cho Jo-jin in July last month. Although this is a severe sanction that prohibits re-employment at financial companies for the next three years, the legal basis for the sanction was the Credit Information Act.
The leakage of information belonging to 2.97 million Lotte Card customers occurred last year, but for card companies, the responsibility structure system only came into effect in July this year. Consequently, Cho Jeon (CEO) was sanctioned under the new Internal Control Act rather than the Governance Act.
However, analysis suggests there are many points of contention regarding whether a bank president could receive the first sanction under the Governance Act. Given the broad scope of internal control management duties, financial authorities separately prepared and published operational guidelines for CEO sanctions in 2024 last year.
According to these guidelines, the seriousness of the illegal act must be recognized for a CEO to be sanctioned. There are eight detailed elements for determining seriousness: △failure to fulfill management duties; △instruction, acquiescence, or instigation/neglect; △widespread or organized/concentrated illegal acts; △long-term or repeated violations; △issues raised regarding the likelihood of illegal acts occurring; △occurrence of large-scale customer damage; △serious impairment of sound management; and △damage to trust and order in the financial market. At least one of these must apply.
A source in the financial industry stated, "It is difficult to say that large-scale customer damage has occurred, and even Shinhan Bank, which had a relatively large scale of leakage, did not experience events that occurred repeatedly over a long period," adding, "There is an excessive aspect to sanctioning a CEO for failing to prevent 'side door' attacks on non-main servers while blocking thousands of hacking attacks per day."
While Lotte Card saw the leakage of core transaction information such as card secret information and expiration dates, bank account passwords and transaction information were not leaked at banks.
However, there is a difference in perception between the financial industry and Financial Services Commission Chairman Lee Eui-won, who strongly criticized that "AI hacking threats are increasing, yet (financial companies') response methods are lacking even in basic aspects."
Analysis also suggests that the mere mention of the possibility of the first sanction against a bank president could become an unexpected variable in year-end next bank president appointments. As the terms of office for the presidents of the five major banks all expire at the end of this year, financial holding companies have already begun the process of selecting their next bank presidents.
Given that a bank president has been selected as a witness for a National Assembly audit for the first time in five years, the repercussions of the information leakage incident are not small. It is pointed out that outside directors of financial holding companies have no choice but to take this into consideration when selecting the next bank president.
in FINANCE
