The proposed amendments to the Enforcement Decree of the Financial Investment Services and Capital Markets Act (the "FSCMA"), which contain significant changes to the requirements relating to information barriers (informally referred to as "Chinese walls") and outsourcing by financial investment companies, were passed at the Cabinet Meeting held on May 11, 2021.
The information barrier regulations in their current form were legislated in February 2009 at the time of the initial enactment of the FSCMA. Because these regulations expressly enumerate specific types of business activities that are required to be separated from one another and specify the methodologies for implementing such separation, they imposed excessive regulatory burden on financial investment companies and limited their ability to voluntarily strengthen their internal control measures or restructure their organizations to accommodate company-specific circumstances. To address such shortcomings, the Financial Services Commission (the "FSC") has been seeking to transform the existing information barrier regulations into a principle-based framework that would enable financial investment companies to design and operate their own information barrier system as part of their internal control standards in a manner that best serves their respective business objectives.
As a result of these efforts, on April 29, 2020 the National Assembly passed amendments to the FSCMA which codify the principle-based framework so that companies can implement internal control measures tailored to their circumstances and at the same time strengthen the regulators' supervision and enforcement authority. The amended FSCMA took effect from May 20, 2021. The follow-on amendments to the Enforcement Decree of the FSCMA passed at the Cabinet Meeting on May 11, 2021 put into place subordinate regulations necessary to enforce the revised regulations on information barriers under the amended FSCMA.
New Information Barriers Regulations
Specifically, the amended FSCMA has abolished regulations that (i) prohibit officers and employees of financial investment companies from holding concurrent positions across different lines of businesses (e.g., investment dealing/brokerage, trust, collective investment, investment banking and prime brokerage businesses) and (ii) require financial investment companies to maintain physical segregation for different lines of business. Instead, the amended FSCMA sets forth basic principles for the operation of information barriers within each financial investment company as well as with third parties including affiliates, and requires individual financial investment companies to establish internal control standards consistent with these principles.
The amended FSCMA also states that the Enforcement Decree will specify the types of information that must be protected by information barriers and the information barrier provisions that must be included in the internal control standards.
The amended Enforcement Decree of the FSCMA designates two categories of information that must be protected by information barriers: (i) material non-public information and (ii) information pertaining to the sale, purchase or management of clients' assets. The second category consists of information on clients' sale, purchase and ownership of the financial investment products as well as information on the composition and management of collective investment assets, discretionary investment assets and trust assets. Notwithstanding such designation, the amended Enforcement Decree provides an exemption under which information that falls under the second category would be exempted from the separation requirement, provided that (i) considering its nature, the information would not potentially undermine investor protection and fairness in markets, (ii) the information when shared across different business groups or with third parties would not likely create a conflict of interests and (iii) relevant financial investment companies have determined that the information is permitted to be shared pursuant to their internal control standards and have publicly disclosed such determination in accordance with the Enforcement Decree.
In addition, the amended FSCMA and the Enforcement Decree require the following points to be included in the financial investment companies' internal control standards: (i) the standards and procedures for operating information barriers; (ii) the requirements and procedures for over-the-wall exchange of information on an exceptional basis; (iii) operation of internal organization and designation of personnel responsible for overseeing and managing conflicts of interests, (iv) the types of transactions susceptible to conflicts of interests; and (v) accountability for the use of information subject to information barriers in breach of the internal control standards.
Under the amended FSCMA and the Enforcement Decree, financial investment companies are required to (i) regularly monitor the adequacy and effectiveness of their internal control standards,(ii) conduct officer and employee training on the laws and regulations relating to information barriers and internal control standards, (iii) designate an executive officer or an employee to independently oversee matters pertaining to information barriers (the registered compliance officer would be permitted to also serve such function), (iv) operate a surveillance system that monitors segregation of information, and (v) disclose relevant sections of the internal control standards pertaining to key elements of the information barriers.
Outsourcing by Financial Investment Companies
The outsourcing regulations under the FSCMA prior to the amendments on April 29, 2020 effectively prohibited financial investment companies from outsourcing to third parties any activities regarded as core functions to their licensed business activities while permitting the outsourcing of only non-core functions. The amended FSCMA in principle permits financial investment service providers to outsource even certain core functions to duly licensed and registered third parties.
However, the amended FSCMA specifically states that the internal control functions that involve decision-making authority as prescribed by the Enforcement Decree are not permitted to be outsourced to a third party. In this regard, the amended Enforcement Decree stipulates that the following functions are prohibited from being outsourced: (i) functions performed by the compliance officer, (ii) internal audit, (iii) risk management and (iv) credit risk analysis and assessment.
To summarize, under the amended FSCMA and Enforcement Decree, all functions other than the four types of functions specifically described in the Enforcement Decree (as summarized above) are in principle permitted to be outsourced, so long as a post-outsourcing report is filed with the regulator within two weeks from commencement of the outsourcing arrangement. However, outsourcing of essential functions directly related to the licensing and/or registration work should be subject to the filing of a pre-outsourcing report no later than seven days prior to commencement of the outsourcing arrangement, and these functions must be outsourced to a third party licensed and/or registered to perform such functions (including those licensed in foreign countries).
Key Takeaways
The amended FSCMA and Enforcement Decree are expected to provide financial investment companies with greater degree of flexibility to design and implement their organizational structure to best serve their business and regulatory compliance objectives. The FSC has publicly announced that it anticipates that the amendments will enhance innovation in the financial industry leading to improved efficiency in the capital markets. At the same time, the FSC stated that it will monitor and enforce breaches of the information sharing and outsourcing regulations more vigorously by actively utilizing the tools at its disposal such as imposition of criminal penalties and fines. This expression of intent indicates the additional emphasis and focus on the individual financial investment company's responsibilities to implement effective internal control systems.
The amended FSCMA and Enforcement Decree have been in effect from May 20, 2021. Accordingly, financial investment companies are advised to familiarize themselves and take steps to comply with their obligations thereunder, including implementing the required internal control standards on information barriers in compliance with the new principle-based framework and appointing personnel responsible for implementation of new information barriers. In this connection, the Korea Financial Investment Association has recently distributed best practice internal control standards that reflect the requirements set forth under the amended FSCMA and Enforcement Decree.
