Specific inquiry
We are a company that issues and manages electronic money. Most of the services we now intend to develop are located in the cloud.
What are the relevant requirements we must comply with, including the Regulation on Supervision of Electronic Financial Transactions?
Article 14-2 (Procedures for the Use of Cloud Computing Services, etc.) of the Regulation on Supervision of Electronic Financial Transactions, effective January 1, 2019, defines the following.
Paragraph 1) When a financial company or an electronic financial business operator intends to use cloud computing, it must carry out the following procedures
- Criticality assessment of information processing systems (by the financial company itself)
- Assessment of the CSP’s soundness, safety, and related factors
- Establishment of and compliance with operating standards for business outsourcing (by the financial company itself)
- The results of the three items above must be deliberated and resolved by the Information Security Committee (deliberation proposal and resolution)
- Related documents must be kept up to date and provided without delay when requested by the Governor of the Financial Supervisory Service
Paragraphs 3 and 4) Where the system processes unique identification information or personal credit information, or materially affects the safety and reliability of electronic financial transactions
The following documents must be reported to the Governor of the Financial Supervisory Service at least seven business days in advance.
- Documents concerning the financial company’s rules on outsourcing of information processing
- Criticality assessment of information processing systems (by the financial company itself)
- Matters concerning the business continuity plan and safety assurance measures related to the use of cloud computing services
- Deliberation and resolution by the Information Security Committee are required (deliberation proposal and resolution)
Paragraph 6) When any of the following changes occurs, the matter and the related documents must be attached and reported to the Governor of the Financial Supervisory Service within seven business days
- A material change to the service contract occurs because of a merger, split, contractual transfer of status, re-outsourcing, or a similar reason involving the CSP
- The CSP fails to perform material contractual obligations related to maintaining service quality, ensuring safety, and similar matters
- Other material changes occur
When assessing the soundness and safety of the CSP’s cloud service, confirm the basic protection measures and the additional protection measures for the financial sector
- When assessing the soundness and safety of a CSP’s cloud service, the basic protection measures (administrative, technical, and physical protection measures) and the additional protection measures for the financial sector must be assessed and confirmed
- However, if it is confirmed that the CSP has obtained and maintains a domestic or international security certification related to cloud services (Cloud Service Security Assurance Program, ISO/IEC 27001 certification), the assessment of the basic protection measures may be omitted.
More detailed guidance: the Financial Security Institute’s Guide to the Use of Cloud Services in the Financial Sector
http://wiki.wikisecurity.net/wp-content/uploads/sites/6/2025/12/금융분야클라우드컴퓨팅서비스이용가이드.pdf
* For business and related inquiries: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net