 |
Photo caption suggestion: Head Office of the Korea Financial Investment Association, Yeouido, Seoul. (Photo: Korea Financial Investment Association) |
[Alpha Biz= Paul Lee] Following the insurance sector, the financial investment industry in South Korea will implement a mandatory “Third-Party Risk Management” system. From February 18, 2026, securities firms will no longer be able to shift responsibility for personal data breaches or system errors onto outsourcing or IT service providers.
The Korea Financial Investment Association (KOFIA) announced that the “Model Code for Third-Party Risk Management” will be applied to all financial investment companies. This framework requires firms to comprehensively oversee external service providers, including system integrators (SIs) managing mobile trading systems (MTS), cloud infrastructure providers, and customer service operators.
Under the new rules, the board of directors and senior management will bear full accountability for enterprise-wide risk management. Key policies on third-party risk must be deliberated and approved by the board, and ultimate responsibility lies with both the board and executives.
The guidelines impose obligations at each stage of outsourcing contracts. Before signing, firms must evaluate and conduct on-site inspections of potential partners. Contracts must clearly define work scope, security requirements, and consumer protection measures. During execution, periodic monitoring is required, and any significant risk indicators must be immediately reported to management.
High-risk contracts will be designated as “priority management contracts,” requiring more frequent risk assessments and a business continuity plan (BCP) to mitigate potential disruptions.
The initiative aims to prevent scenarios where third-party failures or cyberattacks directly halt financial services. For example, in September, a major managed service provider servicing 30 asset management companies was hacked, exposing client and employee data. Under the new rules, both the third-party vendor and the overseeing investment company will be held accountable.
알파경제 Paul Lee 특파원(hoondork1977@alphabiz.co.kr)
