Financial Services Commission Chairman Lee Chan-jin said Sunday that executives could face personal liability reviews if a card issuer’s customer data leak is traced to an artificial-intelligence vendor, marking the first time Seoul’s top financial regulator has tied CEO accountability language directly to AI supply-chain failures in a National Assembly audit session.
Speaking to the National Policy Committee on Oct. 19, Lee answered a lawmaker’s question about a hypothetical breach in which a bank or card company outsourced fraud-scoring models to a third-party AI firm and later discovered unauthorized copies of cardholder records in a cloud bucket. “When customer harm is clear and governance was negligent, the commission will not treat the CEO as a bystander simply because the fault line sits inside a vendor,” Lee said, according to aides who circulated a transcript to reporters.
How CEO liability rules changed this year
Korea tightened executive accountability after several retail banking outages and a high-profile personal-data sale case. The revised framework lets the FSC request explanations from named directors and, in extreme cases, seek business suspensions or fines that attach to individuals when internal controls fail. Lee said AI contracts must now spell out data residency, retraining boundaries, and incident-notification windows measured in hours, not business days.
Card issuers and the three major credit bureaus have rushed to inventory which fraud models run on overseas GPUs and which still use on-premise servers in Gwacheon and Yongin data halls. Industry lobbyists said many firms still rely on vendor attestations rather than independent penetration tests focused on model endpoints.
What auditors asked for
Lawmakers from both parties pressed Lee on whether the FSC would publish a template clause banks must insert into AI procurement deals. He promised guidance by year-end but cautioned that one-size contracts could stall smaller fintech pilots. Opposition members wanted mandatory breach drills that include synthetic voice phishing scenarios; ruling-party members emphasized not chilling legitimate AI adoption in anti-fraud units.
Lee noted that the Financial Supervisory Service is already reviewing delayed incident reports at two regional banks where vendor tickets sat in IT queues over a weekend. Those cases did not involve card numbers, he said, but exposed reporting gaps the FSC wants closed before a headline-grabbing card leak occurs.
Consumer groups and the card industry
Citizens’ coalitions in Seoul said Lee’s remarks should be backed by faster customer notification rules when AI vendors, not core banking systems, are the leak source. Card marketers worry that liability fears could push issuers back toward rule-based engines that miss newer scam patterns, especially AI-cloned voice calls pretending to be fraud desks.
Major card brands responded cautiously Monday, issuing internal memos reminding divisions that outsourcing inference does not outsource legal duty to protect primary account numbers. None announced policy shifts publicly, but compliance officers scheduled extra board briefings for October.
Next steps from the commission
The FSC plans a joint task force with the Personal Information Protection Commission to map which AI subprocessors touch payment credentials. Lee said the group will report before winter shopping season, when phishing volumes typically spike. He repeated that criminal probes would remain with prosecutors, while the FSC focuses on licensing conditions and director fitness.
For households, the audit exchange changes little immediately—cards still work, and no new breach was disclosed. It signals that when the first AI-linked card leak becomes public, regulators intend to ask not only which server failed but which executive signed the vendor deal and whether the board ever tested it.
Assembly aides said follow-up questions will probe whether the FSC can sanction boards that treat AI procurement like office-supply contracts. Lee pledged to share anonymized case studies once the FSS completes its vendor-delay reviews, giving directors a template for weekend escalation drills. Credit union lobbyists asked for scaled rules so neighborhood lenders are not judged by the same four-hour clock as megabanks—a debate likely to resume when the bipartisan financial reform bill reaches committee markup later this month.