Korea's FSC plans security inspection of about 580 financial firms, virtual asset businesses included

What happened

South Korea's Financial Services Commission (FSC) discussed a security plan for the whole financial sector at a meeting on 5 Nov 2026 with association heads, including the virtual asset sector. The plan is announced policy, with no rule text in the release.

The FSC said 37 firms reported 40 incidents between 30 Sep and 3 Nov, both in 2026, and three of those firms are virtual asset firms. It said about KRW 1 billion (약 10억원) of stolen funds has been reported so far, at some small virtual asset exchanges, electronic finance firms and peer-to-peer lenders, mainly from accounts where firms pool customer funds, such as hot wallets. It said it understands individual users have not yet lost funds.

What changed

The FSC plans an inspection of about 580 firms, including virtual asset businesses, although the Electronic Financial Transactions Act does not apply to that sector. It covers external access points and internal controls.

The FSC said financial companies check themselves first and must set out the content, method and reasons in detail. The annex says the Financial Supervisory Service (FSS) plans to give detailed items and methods separately. The FSS and the Financial Security Institute (FSI) plan on-site checks where a self-check is judged inadequate or a serious vulnerability is found. The release does not spell out how these duties apply to virtual asset businesses.

The FSC said a financial company that finds, during the inspection, an important vulnerability that could cause monetary loss or a personal data leak must immediately suspend the service and block outside access. Resuming is limited to cases where a fix is hard to make at once and an important service is directly involved, under conditions that include substitute controls and CEO approval. Fundamental fixes must follow.

The FSC said virtual asset exchanges and some other sectors outside the Act now report incidents to the Korea Internet & Security Agency (KISA) under the Network Act. It plans a guideline in Nov 2026 so that these sectors report immediately to the FSS and FSI as well. The annex gives virtual assets and insurance agencies as examples. The release does not state the guideline's legal force.

Who is affected

The plan reaches virtual asset businesses and exchanges in South Korea, among about 580 firms that include financial companies and electronic financial business operators.

What happens next

The FSC plans to finish inspecting systems on asset registers by 30 Nov, and unregistered systems and internal controls by 31 Dec, both in 2026.

The FSC is also pursuing a Digital Finance Safety Act, which would apply security rules at the level of the current Electronic Financial Transactions Act to virtual asset businesses, insurance agencies and similar sectors. It aims to prepare the bill in the first quarter of ’27. The English wording, including the Act's name, is Anvesan's translation.