Specific Inquiry
Under the Regulation on Supervision of Electronic Financial Transactions, a financial company that uses the public cloud is required to file a cloud computing usage report.
A financial company does not, however, report its use to the Financial Supervisory Service in every case merely because it uses cloud computing. The obligation and the absence of an obligation are divided according to an importance assessment.
What, then, is the basis for there being no reporting obligation for a non-critical system? This was a question from the person in charge, at a meeting with a financial company filing a cloud usage report for the first time.
Understanding the history of amendments to the supervisory regulations on financial companies’ use of the cloud
Before 2016, financial companies were prohibited from using the public cloud under the Electronic Financial Transactions Act and its subordinate statutes. When those statutes were amended in 2016, financial companies were allowed to use the public cloud, but only for non-critical systems that do not process unique identification information or personal credit information.
It was also prescribed that a report on this be made to the Governor of the Financial Supervisory Service within 7 days. (Regulation on Supervision of Electronic Financial Transactions, Article 14-2 (Designation of Non-Critical Information Processing Systems), partial amendment of 2016.10.5.) When the Regulation on Supervision of Electronic Financial Transactions was amended in 2018 to promote the use of cloud computing, the public cloud could be used even for a system that processes unique identification information or personal credit information.
Prior reporting to the Governor of the Financial Supervisory Service was also prescribed for cases such as processing unique identification information or personal credit information. In the financial supervisory regulation amended in 2022, this requirement for critical systems was maintained and was changed only to ex post reporting within 3 months.
The 2016 Regulation on Supervision of Electronic Financial Transactions that permitted public cloud use only for non-critical systems
The Regulation on Supervision of Electronic Financial Transactions that permitted a financial company to use the public cloud only for non-critical systems while making a report to the Governor of the Financial Supervisory Service mandatory
Article 14-2 (Designation of a Non-Critical System Information Processing System) [Enforced on October 5, 2016] [Financial Services Commission Notice No. 2016-37, October 5, 2016, partial amendment] Article 14-2 (Designation of Non-Critical Information Processing Systems) ① A financial company or an electronic financial business entity may, according to information asset importance assessment criteria it has established on its own, designate as a non-critical information processing system an information processing system whose effect on the safety and reliability of electronic financial transactions is markedly low. Provided, that an information processing system that processes an individual's unique identification information, or personal credit information under the 「Act on the Use and Protection of Credit Information」, may not be designated as a non-critical information processing system. ② When designating a non-critical information processing system under paragraph (1), a financial company or an electronic financial business entity shall obtain deliberation and resolution by the information protection committee under Article 8-2. ③ A financial company or an electronic financial business entity shall, within 7 days from the date it designates a non-critical information processing system under paragraph (1), and in the form prescribed by the Governor of the Financial Supervisory Service, submit to the Financial Supervisory Service a report that includes the information asset importance assessment criteria, the designation result, the management plan, and related matters. - Remainder omitted -
The Regulation on Supervision of Electronic Financial Transactions amended in 2018 under the plan to expand cloud use in the financial sector
The Regulation on Supervision of Electronic Financial Transactions, amended in line with the policy of expanding public cloud use in the financial sector, made a report to the Governor of the Financial Supervisory Service at least 7 business days in advance mandatory for a critical system according to the importance assessment
Article 14-2 (Procedures for Using Cloud Computing Services, etc.) ③ Where a financial company or an electronic financial business entity assesses, pursuant to paragraph (1) 1, that any of the following subparagraphs applies, it shall, at least 7 business days before the date on which it actually intends to use the cloud computing service, report to the Governor of the Financial Supervisory Service, attaching the documents under each subparagraph of paragraph (4), in the form prescribed by the Governor of the Financial Supervisory Service. In this case, the report is deemed to have been made under Article 7, paragraphs (1) through (3), of the 「Regulation on Entrustment of Information Processing Business of Financial Companies」. <Amended on Dec. 21, 2018.> 1. Where unique identification information or personal credit information is processed 2. Where there is a material effect on the safety and reliability of electronic financial transactions - Remainder omitted -
The Regulation on Supervision of Electronic Financial Transactions amended in 2022 to ease cloud and network separation regulations in the financial sector
The Electronic Financial Transactions Act and the Regulation on Supervision of Electronic Financial Transactions were amended to ease cloud and network separation regulations in the financial sector, and the cloud usage report was also amended to ex post reporting within 3 months.
Article 14-2 (Procedures for Using Cloud Computing Services, etc.) ④ A financial company or an electronic financial business entity shall, **within 3 months from the date on which a ground falling under any of the following subparagraphs occurs**, report to the Governor of the Financial Supervisory Service, attaching the ground for occurrence, related materials, and a response plan. <Newly inserted on Dec. 21, 2018; amended on Nov. 23, 2022.> 1. Where a contract to use a cloud computing service is newly concluded <Newly inserted on Nov. 23, 2022.> 2. Where a material change occurs, such as a merger, division, transfer of contractual status, or re-entrustment of the cloud computing service provider <Amended on Nov. 23, 2022.> 3. Where the cloud computing service provider fails to perform an important contractual matter related to maintaining service quality, securing safety, or a similar matter <Amended on Nov. 23, 2022.> 4. Where a material change occurs concerning paragraph (1) 2 or paragraph (1) 3 <Amended on Nov. 23, 2022.> - Remainder omitted -
The Regulation on Supervision of Electronic Financial Transactions amended in 2018, and the Regulation on Entrustment of Information Processing Business of Financial Companies
Regulation on Supervision of Electronic Financial Transactions
Article 14-2 (Procedures for Using Cloud Computing Services, etc.) ⑨ Other matters concerning the use of a cloud computing service by a financial company or an electronic financial business entity shall follow the 「Regulation on Entrustment of Information Processing Business of Financial Companies」. <Newly inserted on Dec. 21, 2018.>
Regulation on Entrustment of Information Processing Business of Financial Companies
Article 7 (Reports) ④ A financial company shall, according to the classification in the following subparagraphs, include the semiannual status of information processing entrustment in the business report required under the Act that is the basis for establishment of that financial company and related statutes, and shall report it ex post to the Governor of the Financial Supervisory Service on a semiannual basis. <Amended on Jun. 28, 2018.> 1. Where the business of processing financial transaction information under Article 2 (4) is entrusted, in a case falling under any of the following items a. Where the content is the same as what that financial company, or another financial company engaged in the same financial business, has reported to the Governor of the Financial Supervisory Service, and the industry of the entrustee is the same b. Where part of content already reported is changed, and the change is minor 2. Where information processing business other than financial transaction information under Article 2 (4) is entrusted (provided that entrustment by an electronic financial business entity is excluded) [This paragraph newly inserted on Jul. 22, 2015.] <Amended on Jun. 28, 2018.> - Remainder omitted -
Guide to the Use of Cloud Computing Services in the Financial Sector (2022.11) – Financial Security Institute
An annex to the Guide to the Use of Cloud Computing Services in the Financial Sector (2022.11), published by the Financial Security Institute under the amended Regulation on Supervision of Electronic Financial Transactions, states the following.
(FAQ) 6. Must an electronic financial business entity also file an ex post report when it entrusts information processing business other than financial transaction information? (ASW) □ Under the current ｢Regulation on Supervision of Electronic Financial Transactions｣ and the ｢Regulation on Entrustment of Information Processing Business*｣, an electronic financial business entity has no separate reporting obligation when, for non-critical business, it processes information other than financial transaction information in the cloud. * Proviso to Article 7 (4) 2 of the Regulation on Entrustment of Information Processing Business ㅇ Even after the amendment of the ｢Regulation on Supervision of Electronic Financial Transactions｣, processing information other than financial transaction information in the cloud for non-critical business is not subject to a cloud usage report, as under the current rule. ※ (Example) A case in which an electronic financial business entity intends to process non-financial business related to an e-commerce shopping mall through a cloud system, and similar cases
What should not be confused about reporting for a non-critical system,
A non-critical system may fall outside the mandatory report that, like a critical system, must be filed within 3 months, but it is subject to the semiannual status report. Article 7 (Reports), paragraph 4, of the “Regulation on Entrustment of Information Processing Business of Financial Companies” specifies it as subject to semiannual reporting, as follows. These matters are also, as a matter of course, subject to the comprehensive audit that the Financial Supervisory Service conducts of financial companies each year.
Article 7 (Reports) ④ A financial company shall, according to the classification in the following subparagraphs, include the semiannual status of information processing entrustment in the business report required under the Act that is the basis for establishment of that financial company and related statutes, and shall report it ex post to the Governor of the Financial Supervisory Service on a semiannual basis. <Amended on Jun. 28, 2018.> 1. Where the business of processing financial transaction information under Article 2 (4) is entrusted, in a case falling under any of the following items a. Where the content is the same as what that financial company, or another financial company engaged in the same financial business, has reported to the Governor of the Financial Supervisory Service, and the industry of the entrustee is the same b. Where part of content already reported is changed, and the change is minor 2. Where information processing business other than financial transaction information under Article 2 (4) is entrusted (provided that entrustment by an electronic financial business entity is excluded) [This paragraph newly inserted on Jul. 22, 2015.] <Amended on Jun. 28, 2018.> - Remainder omitted -
* Inquiries about business and related matters: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net