Korea weighs size-tiered security rules that would ease network separation first for big banks

Size tiering follows the profit split. Korean banks earned 13.8 trillion won in the first half ^[5], about 18 times the 765.8 billion won that savings banks made ^[7][25]. Life insurers earned 3.9254 trillion won, non-life insurers 5.0884 trillion won and card companies 1.2934 trillion won ^[6]. Credit unions lost 188.9 billion won ^[8] and the Korean Federation of Community Credit Cooperatives lost 676.8 billion won ^[9]. Taken together, the savings-bank and co-operative tier lost about 99.9 billion won net ^[24]. The whole savings-bank sector's half-year profit comes to about 81% of 940 billion won, the low end of what one large US bank spends on security in a year ^[3][23].

A tiered rule could go three ways. Regulators could ease network separation for the big banks with no strings, tie the easing to budgets and staffing, or keep smaller firms behind separation and rely on a shared service. The prevailing industry view, as Seoul Economic Daily reports it, is that large banks go first, with separation eased further and investment sharply increased ^[2]. We think the easing happens and the investment lags. Korea's four largest banks keep information security staff at 0.69% of headcount, against 1.5% to 1.6% at Citi and Bank of America ^[13]. Count in-house staff only and the Korean figure is 0.3% to 0.4% ^[14].

The counter-case is the US record. JPMorgan Chase, Bank of America, Citi and Wells Fargo built their security capability by facing hackers without network separation, using zero-trust models that keep verifying users even on internal networks ^[20]. On that record, easing the rule may be what forces Korean banks to hire.

Budgets show the same lag. KB Kookmin Bank set aside about 86.075 billion won for information protection this year ^[10], and large US banks spend roughly 11 to 16 times that ^[3][21]. Lifting KB's figure to 100 billion won next year would be a rise of about 16%, and the US low end would still be 9.4 times larger ^[22]. Woori Bank is reviewing plans to raise its security-systems budget by more than 20% and its specialist staff by more than 10% ^[15]. Security took 9.6% of IT investment at 31 Korean finance and insurance companies in 2024, according to the Korea Internet & Security Agency ^[11]. A survey by IANS Research and Artico Search put the US and Canadian average at 12% ^[12]. Matching it means raising the Korean share by a quarter ^[26]. An official in the financial industry said the latest incident happened "because financial firms have been passive about investing in information security, trusting network separation alone" ^[19].

The AI case rests on a separate rule. Korean firms must go through a regulatory sandbox each time they introduce AI into their operations ^[4]. The report attributes the tiering push to growing calls within the industry ^[2] and does not say whether a tiered regime would replace that per-project sandbox.

For mid-sized firms, the idea being floated is that industry associations or central federations pool funds for shared monitoring and vulnerability assessment ^[16]. An official in the financial sector said smaller firms "should handle this on their own to begin with, but they lack the manpower and other resources, so joint support is needed" ^[17]. Two terms are unsettled: how much the service covers and who pays for it. The Financial Security Institute, a nonprofit, would find it hard to support non-member firms for free ^[18]. We'd expect tiering to widen the security gap between Korea's big banks and everyone else, because the pool would be funded by a tier that lost money in the half ^[24]. If security spending at savings banks and co-operatives rises as a share of IT investment anyway, that view is wrong.