KB Kookmin Bank was excluded from the first round of financial regulators’ easing of network separation rules for security purposes, while internet-only lender Kakao Bank was selected, it has been confirmed. While authorities cited consideration of allocation across financial sectors, some predict that certain banks could fall behind in responding to high-performance artificial intelligence (AI) hacking threats such as Mithos.
According to the financial industry on Wednesday, the first-round selection of financial firms for network separation easing included Shinhan, Hana and Woori banks among major commercial banks. KB Kookmin Bank and NH Nonghyup Bank were left out. Among internet-only banks, Kakao Bank was included, while in the non-banking sector, KB Securities, NH Investment & Securities and Hanwha Life Insurance were selected. Some financial firms were reportedly excluded after including plans to primarily use generative AI in their applications for regulatory easing.
“I understand that Kakao Bank received a relatively favorable evaluation in terms of information technology (IT) investment and infrastructure,” a senior financial industry official said. “Among large financial groups, there was also consideration in cases where securities firms were selected.”
The firms selected in the first round will receive no-action letters from authorities after a report to the Financial Services Commission (FSC) on the 17th of this month. They will then begin full-scale high-performance AI-based vulnerability testing. Since the authorities recognized their security capabilities as sufficient to allow network separation, their chances of being selected for a full lifting of network separation rules in the future have also increased.
Once network separation rules are lifted, there are no restrictions on AI use, giving these firms an inevitable advantage in the AI transformation (AX) process. “Firms not subject to network separation rules will have the opportunity to freely use AI in everything from chatbots to loan screening, corporate finance and internal controls,” a financial industry official said.
Earlier, the FSC decided to begin easing network separation rules for 10 firms with outstanding AI and security capabilities, selected from among 49 financial companies with total assets of more than 10 trillion won and at least 1,000 permanent employees. This is because easing network separation rules for financial firms with weaker security capabilities could make them concentrated targets for attacks. After accumulating success cases among the first-round firms, the authorities plan to expand the program to 10 to 20 companies in August or September, and gradually apply it to the remaining financial firms in the fourth quarter. Firms that missed out in the first round can also seek another chance.
However, the market has reacted with surprise that KB Kookmin and NH Nonghyup banks, which possess top-tier AI and security capabilities in the country, were excluded from the first round. Some interpret this as being due not only to sector allocation but also to certain quantitative metrics falling short.
According to the Korea Internet & Security Agency (KISA), as of the end of 2024, KB Kookmin Bank’s IT workforce accounted for 5.15% of its total employees, lower than Shinhan (7.0%) and Woori (6.8%). Its IT staff numbered 1,884.9, more than Shinhan (1,303.0) and Woori (1,080.1), but this is because its total number of employees is larger than other banks. Its dedicated information security staff also numbered 97.1, more than Shinhan (91.1) and Woori (73.8). Another financial industry official said, “Even taking affiliate distribution into account, it is unusual for securities firms to be ranked above banks.”
Financial authorities introduced network separation rules in 2013 citing enhanced security, blocking financial firms’ business processing systems from exposure to external environments. While this fundamentally blocked hacking routes, it was criticized as making it impossible to build high-performance AI-based security systems. In response, authorities decided to urgently ease network separation rules for financial firms with a certain level of security capabilities when using AI for security purposes, so that AI can defend against AI hacking. An FSC official said, “This matter is still under review and nothing has been finalized,” adding, “Even after the selection process is complete, the list of firms subject to network separation easing will be handled confidentially.”