South Korea's Financial Services Commission found cybersecurity deficiencies at 130 of 555 financial companies and proposed tighter security requirements on March 11, after an investigation into incidents at 16 firms including crypto exchanges. The review determined that roughly 100,000 pieces of customer information — names, contact details and identification numbers — were exposed across the affected companies.

The FSC said it would pursue improved threat monitoring, more frequent security assessments and stronger accountability for executives. The proposal marks one of the broadest post-incident overhauls of the country's financial security rules since the sector-wide review began.

The affected firms include Streami, operator of the Gopax crypto exchange, and crypto trading platform Prabang. Both previously disclosed breaches. Prabang reported that an Oct. 2 hack exposed personal information belonging to some of its customers.

What would the new rules change?

Under the proposed reforms, larger financial institutions would undergo vulnerability assessments at least twice per year. That doubles the baseline cadence for institutions the regulator classifies as systemically significant.

The FSC also plans to enhance information-sharing systems across the sector and is considering the use of artificial intelligence in security monitoring for smaller companies. The regulator wants to allow additional cybersecurity inspections outside regular assessment schedules when urgent threats emerge.

The FSC said investigators are still examining whether the incidents involved AI use or whether they link to the same attackers. No attribution to a specific group has been confirmed.

Why crypto exchanges are in scope

The inclusion of Gopax and Prabang places crypto trading platforms squarely within the FSC's supervisory perimeter for cybersecurity, alongside banks and other licensed financial institutions. For exchanges, the reform would mean routine vulnerability testing on a fixed schedule rather than ad hoc audits after incidents.

The 130 firms flagged in the review represent roughly 23% of the 555 financial companies the FSC examined. The exposure of identification numbers — a category of data tied to South Korea's resident registration system — raises the operational stakes, since compromised ID numbers enable account-takeover attempts and synthetic identity fraud across the financial system.

The executive accountability component signals a shift in responsibility upward. Under the proposal, senior management at affected institutions would bear direct responsibility for security posture, a structure that parallels accountability regimes the FSC has applied in other supervisory areas.

Context and next steps

The overhaul follows a separate South Korean move to block 27 crypto websites, including KuCoin and MEXC, signaling a broader enforcement push across the digital asset sector.

The FSC has not published a fixed legislative deadline for the reforms. The proposal now moves through the commission's rulemaking process, with implementation timelines expected to follow the completion of the ongoing investigation into the 16 incidents. Institutions covered by the twice-yearly assessment requirement will need to budget for expanded testing capacity once the rule takes effect.

By Tom Whitfield