South Korea to Scrap Bank ‘Network Separation’ Rule, Swap Walls for AI Security
South Korea plans to scrap “network separation”, a 13-year-old rule that forces banks and other financial firms to keep key computer systems cut off from the internet. The Financial Services Commission (FSC), the country’s top financial regulator, says the walls now slow down defence against AI-driven hacking, and it wants to replace them with an AI-based security system.
Key facts
- FSC Chairman Lee Eog-weon announced the plan on 5 November 2026. The aim is to stop AI-powered attacks with AI-powered defence.
- A task force will start work in November. It brings together the FSC, the Financial Supervisory Service, the Financial Security Institute, the Ministry of Science and ICT, the National Intelligence Service, private AI and security experts and industry executives. A detailed plan is due by the first quarter of 2027.
- Under a pilot, 13 more financial firms got temporary exemptions to use AI security tools. They include NongHyup Bank, the Industrial Bank of Korea, KB Kookmin Card and Samsung Life. Payment firms such as Kakao Pay and Toss Pay could apply for the first time.
- From 30 September to early November, 37 financial firms reported 40 security incidents. About 473,000 pieces of data were exposed and about 1 billion won was stolen.
What network separation is, and why it is going
Korea brought in network separation after a large-scale cyberattack in 2013. Systems that handle customer data and core banking must sit on networks with no direct link to the open internet. Staff often use two separate computers: one for internal work and one for email and the web.
For years this was seen as one of the strictest cyber rules in the world. But regulators now say it holds firms back. Modern security tools are often cloud-based software, or software-as-a-service, that spots threats by learning from huge amounts of outside data. Those tools are hard to use on a sealed-off network. Exemptions already exist for some payment and cloud services, but until this year they did not cover AI used for security.
The FSC first eased the rule for security AI in June, when an initial group including Shinhan Bank, Hana Bank, Woori Bank and KakaoBank joined the pilot. The second group was due in early October but came about a month late. KB Kookmin Bank was left out for the second time, after a breach in late September exposed data on 2,091 of its customers.
Why it matters
The move changes Korea’s approach to cyber safety. Instead of fixed walls, firms will be expected to prove they can manage the risk. The FSC says the rules will go in stages, and firms judged better able to handle cyber risk will be allowed to move first. Lawmakers are also working on changes to the Electronic Financial Transactions Act, the law that governs online banking and payments. These would bring fines for security breaches and give chief information security officers more power.
For fintechs and e-wallet operators, the change could make it easier to use the same cloud and AI tools as their peers abroad. Some experts are cautious, though. Hwang Suk-jin, a security professor at Dongguk University, argued in the Korea Times report that regulators should scale the rules to how important each system and its data are, rather than drop them altogether. He also said checking firms’ internal controls matters more than meeting a deadline.
The debate is not just a Korean one. Regulators across Asia are trying to balance strong defences with the need for new technology. Bank Negara Malaysia, for example, has recently warned that a cyber incident at even a small bank could spread across the system.
What to watch
- The task force’s plan, due by the first quarter of 2027, and which firms are allowed to drop network separation first.
- Whether the pilot period is extended. One lawmaker has said a one-year pilot is too short for long-term security spending.
- Progress on the Electronic Financial Transactions Act changes, including new fines for breaches.
Related on FinDeskAsia: Bank Negara warns even a small bank could put Malaysia’s financial system at cyber risk · Kakao Pay doubles Q3 profit as in-store payments jump 44%
Sources: The Korea Times (November 2026) · Asia Business Daily (November 2026) · The Herald Business (October 2026)
