REGULATION

ON

SUPERVISION OF THE ELECTRONIC FINANCIAL ACTIVITIES

OF FINANCIAL INSTITUTIONS

Regulation on Supervision of the Electronic Financial Activities

of Financial Institutions

CONTENTS

I.	General Provisions

§1.	Purpose

§2.	Definitions

§3.	Institutions Subject to this Regulation

II.	Securing Safety and Soundness of Electronic Financial Activities and I.T. Sector

§4.	Guidelines for Security Measures for Electronic financial Activities and Other Activities of Relevance

§5.	Evaluation on Operations of the I.T. Sector

III.	Protection of Customers in Electronic Financial Transactions

§6.	Confirmation of Transactions Details

§7.	Preservation and Provision of Transaction Records and Data

§8.	Disclosure of Terms and Conditions on Electronic financial Transactions

§9.	Correction of Errors

IV.	Supplementary Provisions

§10.	Incident Reports in the I.T. Sector

Addenda

Enacted on December 29, 2000. FSC 2000-117

CHAPTER I.

GENERAL PROVISIONS

§1. Purpose

The purpose of this Regulation is to prescribe details necessary for securing the safety and soundness of either electronic financial activities by financial institutions or information technology sector (hereinafter I.T. Sector) serving as the basis thereof, and to protect customers in electronic financial transactions.

§2. Definitions

For the purpose of this Regulation, the definition of terms shall be as follows:

1. "Electronic financial activity" means an activity whereby a financial institution delivers financial products and services through electronic means.

2. "I.T. Sector" means whole of activities, personnel, facilities and organizations of financial institutions which collect, process, store, search, send or receive information by utilizing information-processing devices such as computers.

3. "Electronic financial transaction" means a transaction that customers benefit for themselves from an electronic financial activity provided by financial institutions, excluding mere delivery of information. This is limited to apply in such a case where non-electronic means is not utilized at all in the process of transaction.

4. "Electronic means" is defined as an electronic device which customers utilize to initiate electronic financial transaction(s), such as a computer, CD/ATM, telephone, and any other electronic devices determined by the Governor of the FSC (hereinafter, the "Governor").

5. "Customer" means a consumer to whom rights and obligations are legitimately attributed in relation to electronic financial transaction(s).

6. "Error" refers to a case where a customer's instruction of a transaction is not properly executed due to events for which the financial institution of relevance is responsible.

§3. Institutions Subject to This Regulation

Institutions falling under one of the following subparagraphs are subject to this Regulation:

1. Financial Institutions under the Banking Act;

2. Credit business sector of the National Agricultural Cooperatives Federation under the National Agricultural Cooperatives Act;

3. Credit business sector of the National Fisheries Cooperatives Federation under the National Fisheries Cooperatives Act;

4. Korea Development Bank established under the Korea Development Bank Act;

5. Industrial Bank of Korea established under the Industrial Bank of Korea Act;

6. Export-Import Bank of Korea established under the Export-Import Bank of Korea Act;

7. Trust companies established under the Trust Business Act;

8. Mortgage-backed securitization companies under the Mortgage-Backed Securitization Company Act;

9. Mutual savings and finance companies under the Mutual Savings and Finance Company Act;

10. Merchant Banks established under the Merchant Bank Act;

11. Credit-specialized companies under the Credit-Specialized Business Act;

12. Insurers under the Insurance Business Act;

13. Securities companies under the Securities and Exchange Act;

14. Management companies under the Securities Investment Trust Act;

15. Asset management companies under the Securities Investment Company Act;

16. Futures-dealers under the Futures Trading Act;

17. Credit cooperatives and the National Federation thereof established under the Credit Cooperatives Act;

18. Other persons engaging in financial business and finance-related business determined by the Governor.

(2) Notwithstanding paragraph (1), all or parts of Chapter II may be precluded after considering the size of financial institutions, facilities and personnel in the I.T. Sector, and the scale of electronic financial transactions. The Governor determines the specifics of preclusion.

CHAPTER II.

SECURING SAFETY AND SOUNDNESS OF ELECTRONIC FINANCIAL ACTIVITIES AND I.T. SECTOR

§4. Guidelines for Security Measures of Electronic Financial Activities and Other Activities of Relevance

(1) A financial institution shall establish its own guidelines of securing measures for electronic financial activities and underlying I.T. Sector (hereinafter, "the electronic financial activities etc.) as to any of the following:

1. Confidentiality, integrity, security, and availability of electronic financial activities, etc.;

2. Internal control over electronic financial activities, etc.;

3. Major terms and conditions of affiliation and outsourcing (limited to such cases where they are directly related to the operation of electronic financial activities) in relation to the electronic financial activities, etc., and

4. Other matters for the safe performance of electronic financial activities, etc.

(2) The Governor may provide with minimum criteria and procedures to be observed by financial institutions in regard to each subparagraph of paragraph (1).

(3) A financial institution shall request a security review in such case where the security under paragraph (1) subparagraph 1 is deemed essential by the Governor.

(4) A financial institution shall take appropriate measures with regard to affiliation and outsourcing stipulated in paragraph (1) subparagraph 3, to maintain the integrity of financial information, to prevent information-leakage, establish contingency plans against the suspension of business due to insolvency of affiliated or outsourcing companies, and to reinforce internal control over the other party's business performances.

§5. Evaluation on Operations of the I.T. Sector

(1) The Governor shall supervise soundness of the I.T. Sector through examination and evaluation on operations of the I.T. Sector.

(2) The Governor may evaluate operations of the I.T. Sector through examining such financial institutions and report the results thereof in his supervisory and examining functions.

(3) The ratings of evaluation on operations of the I.T. Sector pursuant to paragraph (2) shall be classified into five levels, first level ("strong"), second level ("satisfactory"), third level ("less than satisfactory"), fourth level ("deficient"), and fifth level ("critically deficient").

(4) Details for evaluation on operations of the I.T. Sector pursuant to paragraph (2) shall be determined by the Governor.

CHAPTER III.

PROTECTION OF CUSTOMERS IN ELECTRONIC FINANCIAL TRANSACTIONS

§6. Confirmation of Transactions Details

(1) A financial institution shall permit consumers to easily confirm transactions details through relevant electronic means.

(2) Transactions pursuant to paragraph (1) shall set forth the following information:

1. Titles and/or number of transaction accounts (insurance policy number, in case of insurance contracts);

2. Types of transactions (type of insurance contracts, in case of insurance contracts) and the amount of transactions;

3. Date of transactions;

4. Type of electronic means (Controlling offices shall be included in terms of CD/ATM);

5. Amount of fees imposed by the financial institution for the transactions;

6. Address (including e-mail address, if any) and telephone number of the information desk at financial institutions, to which consumers may inquire transaction information or notify errors during a transaction; and

7. Any other means necessary for customers to confirm details of their transactions.

§7. Preservation and Provision of Transaction Records and Data

(1) A financial institution shall preserve records and data in reference to electronic financial transactions including data stipulated in Article 6 paragraph (2) in accordance with Article 33 of the Commercial Act and Article 8 of the Framework Act on Electronic Transaction.

(2) On written request by the customer, a financial institution shall provide or disclose transaction records and data preserved by the financial institution pursuant to paragraph (1), to the extent that it does not conflict with any other relevant statutes including the Act on Real Name Financial Transactions and Protection of Confidentiality.

(3) A financial institution shall response to written requests from customers for transaction records within two business days from the date of the request (in such case where the transaction records are stored separately in magnetic tapes (M/T) or other devices, the financial institution shall supply the requested records within seven business days). With the consent of the customer, the period may be extended to seven business days at maximum.

(4) Notwithstanding paragraph (3), a financial institution may extend the period if it is impossible to comply with the request within the given period of time due to natural calamity, power breakdown, fire, and communication failure for which the financial institution is not responsible, with other events of force majeure included.

§8. Disclosure of Terms and Conditions on Electronic financial Transactions

A financial institution shall disclose the terms and conditions of electronic financial transactions through relevant electronic means (terms and conditions shall be disclosed through a substitute medium which the financial institution specifies, in such case where it is not an appropriate medium for disclosure) in a clear and easily understandable manner before initiating the transaction(s). The same shall apply in cases where the terms and conditions are amended.

§9. Correction of Errors

(1) A financial institution shall establish procedures for correcting errors and notify customers of the procedures. The procedures include each of the following:

1. The requirements and procedures of correction application by customers;

2. The conditions and procedures of investigating and correcting errors, and of the notification pertaining thereto;

3. The compensation criteria for losses caused by the error; and

4. Any other matters necessary for correcting errors.

(2) The Governor may recommend the amendment of the compensation criteria to financial institutions in cases where compensation criteria pursuant to paragraph (1) subparagraph 3 are deemed to be insufficient for the protection of customers.

CHAPTER IV.

SUPPLEMENTARY PROVISIONS

§10. Incident Reports in the I.T. Sector

A financial institution shall report, without delay, to the Governor on serious incidents in the I.T. Sector including any of the following:

1. Suspension of electronic computation for more than thirty minutes due to breakdown in electronic computation devices or network circuits;

2. Financial incidents related to manipulation of electronic data or programs;

3. Breakdown of the main server due to hacking, computer viruses, and/or other relevant circumstances;

4. Intrusion of unauthorized customers into the internal network by breaking firewalls, etc.;

5. Unauthorized penetration into an electronic computation room or electronic computation network;

6. Damage in the security system of the I.T. Sector; or

7. Any other incidents recognized by the Governor as equivalent to subparagraphs (1) through (6).

Addendum

This regulation shall be effective on April 2, 2001.