FSS Issues Guidelines for Financial Companies’ Third-Party IT Risk Management

On July 30, 2026, the Financial Supervisory Service (the “FSS”), together with financial industry associations and central organizations including the Korea Federation of Banks (collectively, the “Industry Associations”), issued a new set of Guidelines for Financial Companies’ Third-Party IT Risk Management (the “Guidelines”). The Guidelines set out standards for financial companies to systematically manage IT risks arising from their outsourcing of information processing functions, including (i) clarifying the responsibilities of the company’s board of directors (“BOD”) and senior management, (ii) establishing risk assessment frameworks and methodologies, and (iii) identifying and responding to risks at each stage of the contracting process. The Guidelines are expected to take effect after November 2026, following the establishment of best-practice standards by the Industry Associations.

Amid the rapid digitalization of the financial sector, financial companies are increasingly making use of external IT services, such as cloud-based services and Software as a Service (“SaaS”), or outsourcing IT functions to third-party service providers. In such an environment, disruptions to cloud services or cybersecurity incidents, such as hacking or data breaches, at outsourced IT service providers could result in significant harm to financial companies and financial consumers.

In the past, there have been self-regulatory guidelines for financial companies to manage third-party risks associated with general outsourcing arrangements, such as sales and payment services. However, they did not sufficiently reflect the unique characteristics of IT functions, where cybersecurity and information protection are key considerations. Accordingly, the FSS, in cooperation with Industry Associations, established the Guidelines to enable financial companies to more effectively manage third-party IT risks arising from the outsourcing of information processing functions.

The key provisions of the Guidelines are as follows.

Clarify BOD’s Ultimate Responsibility and Senior Management’s Roles and Responsibilities for IT Risk Management Framework Operation

The Guidelines stipulate that a financial company’s BOD bears ultimate responsibility for third-party IT risk management, and designate key matters relating to risk management policies and oversight as matters subject to the BOD’s deliberation and resolution. Senior management, as the party responsible for establishing, implementing and maintaining the company’s third-party IT risk management framework, must designate and operate a central management department to establish and implement effective safeguards. Senior management is also responsible for overseeing the status of information processing functions outsourced by each business unit and for assessing the status of third-party IT risks and the adequacy of outsourcing agreements.

The safeguards comprising a financial company’s third-party IT risk management framework should include: (i) security measures against the forgery or alteration of access media, hacking, and the leakage or misuse of personal information, (ii) security measures to secure communication channels, such as dedicated lines between the financial company and the third party, (iii) contingency measures against service disruptions, including failure of information processing systems, (iv) backup measures to ensure business continuity, such as backing up critical data and securing backup facilities, and (v) an internal control system for maintaining security, including the minimization of security vulnerabilities. Furthermore, financial companies are required to establish and operate a three-tier control system consisting of a central management department, risk management department and internal audit department to ensure the systematic management of third-party IT risks.

Specify Obligation to Identify, Assess and Manage Third-Party IT Risks

To ensure the effective management of third-party IT risks, the Guidelines require financial companies to identify the financial soundness of the third parties that are counterparties to their outsourcing agreements, as well as key information relating to the outsourced services (e.g., the services provided, the types and volume of information processed, encryption and communication methods, incident response systems, IT facilities). Financial companies are also required to keep such information up to date through periodic reviews conducted at least semiannually. In particular, third parties that have a material impact on a financial company’s operations or financial consumers must be separately designated as “critical third parties” and made subject to enhanced risk management.

In addition, to enable effective IT risk assessments for each third party, the Guidelines provide specific assessment items and checklists covering areas such as IT security policies and organization, information security management, IT stability and continuity, personal (credit) information management systems, reputational risk and financial soundness. Financial companies are also required to take remedial measures to address any identified risks. However, where such risks cannot be controlled, mitigated or transferred, the financial company must either discontinue the agreement, or have the BOD decide whether to maintain it.

Systematize Risk Management Procedures at Each Stage of Contracting Process

The Guidelines systematically set out stage-by-stage management procedures so that financial companies can proactively identify and respond to third-party IT risks that may arise throughout the information processing outsourcing process, from the review and execution of the outsourcing agreement through its maintenance, management and termination.

Pre-contract: Financial companies must verify the third party’s service capabilities and information security management framework through measures such as on-site due diligence. They must also incorporate essential provisions into the outsourcing agreement, such as the allocation of roles between the outsourcing party and the service provider and the allocation of liability in the event of an incident.

During contract term: Financial companies must review the status of performance under the agreement on a regular basis (at least annually) and establish contingency measures for events such as system outages, a backup management system to maintain business continuity and an exit strategy in preparation for the termination of the agreement.

C.	Post-termination: Financial companies must take measures post-termination, including the return of information assets, revocation of access rights and complete destruction of information.

For critical third parties, additional measures apply, including periodic IT risk assessments (at least semiannually), emergency response and disaster recovery drills, periodic reviews of the adequacy of backup management (at least annually) and advance review and periodic checks of available alternatives. In addition, matters such as agreement performance monitoring, the establishment of exit strategies and follow-up measures post-termination must be reported to the BOD or other relevant bodies.

Allow Flexible Application Based on Importance and Risk of Outsourced Functions

The Guidelines set out minimum standards and principles for the systematic management of third-party IT risks in the form of soft rules. Accordingly, financial companies may apply the Guidelines flexibly, for example by strengthening or relaxing certain provisions to suit their specific circumstances, depending on the materiality and risk level of the information processing functions they have outsourced.

Through the Guidelines, the FSS expects to strengthen the accountability of financial companies’ BOD and senior management and to encourage their active attention and involvement by explicitly providing that the BOD bears ultimate responsibility for third-party IT risk management and by detailing the responsibilities of senior management. The FSS also expects each financial company to establish an enterprise-wide third-party IT risk management framework centered on their central management department.

The Industry Associations plan to implement the Guidelines from November 2026 onward through the establishment of best-practice standards based on the Guidelines. However, the actual implementation date may be adjusted to allow time for preparation, including the adoption of industry-specific best-practice standards, their incorporation into financial companies’ internal regulations and the reorganization of relevant personnel and organizational structures. The Industry Associations and the FSS plan to continue enhancing the framework by reviewing and assessing the implementation of the Guidelines and addressing any identified deficiencies. The FSS will also continue pursuing its Plan for Proactive Digital Risk Supervision.

As the use of cloud services and the outsourcing of IT functions have become widespread, the Guidelines establish standards for the governance, assessment methodologies and stage-by-stage contractual procedures that financial companies should have in place to manage IT risks arising from the outsourcing of information processing functions. Accordingly, financial companies should review the roles and responsibilities of their BOD and senior management, and the three-tier control system involving their central management department. They should also proactively review and update as necessary their existing information processing outsourcing agreements and internal risk assessment procedures to ensure that they align with the Guidelines, particularly the enhanced management of critical third parties and the stage-by-stage management procedures. In addition, financial companies should closely follow the Industry Associations’ progress in adopting best practice standards, as well as their actual implementation dates, so that preparations for implementation, such as incorporating the Guidelines into their internal regulations and reorganizing their organizational structure and personnel, proceed without disruption.

Meanwhile, financial companies may ask cloud service providers and other IT companies that provide services to them to comply with the Guidelines, for example by undergoing IT risk assessments or incorporating relevant provisions into their agreements. Accordingly, such service providers should also review the Guidelines in advance and prepare their responses.

[Korean Version]

Share

Professionals

Professionals