Korea’s largest commercial banks are tightening artificial-intelligence vendor incident-reporting clauses after Financial Supervisory Service examiners flagged cases where IT tickets about subprocessors sat unresolved from Friday night until Monday morning, missing internal deadlines for notifying regulators when suspicious access patterns appeared.
What the audits found
According to officials briefed on the reviews, FSS teams sampled cloud-hosted chatbots, document parsers, and anti-money-laundering models at five nationwide banks this quarter. None of the samples turned into customer-facing breaches, but three institutions failed to escalate vendor alerts within the four-hour window their own board policies promised. Examiners said help-desk staff treated vendor emails as routine maintenance rather than potential reportable events.
The FSS did not name the banks publicly, following its practice of discussing findings first with boards. Yonhap and trade press reported the thematic results Monday, prompting compliance officers to rerun playbooks written for core banking outages—playbooks that assumed the failing system carried the bank’s own logo on the login screen.
Contract language banks are adding
Templates circulating in Seoul’s financial district now require AI vendors to phone a designated duty officer, not only open a web ticket, when credentials are exposed or model weights are downloaded unexpectedly. Banks also demand forensic images within 24 hours and a ban on deleting logs during investigations. Smaller fintech subcontractors protest that the terms favor incumbents with 24-hour security operations centers.
One chief information security officer at a top-three bank said his team is mapping “model adjacency”—which vendor APIs can see account numbers even if they do not store them. That map feeds into the FSS’s coming joint guidance with the Financial Services Commission on CEO liability when vendors fail.
Regulatory clock versus Korean work culture
Incident rules were written assuming weekday coverage, yet model monitoring runs continuously. Examiners acknowledged that forcing identical response times on rural lenders with single overnight IT staff may require tiered standards. Still, they said national banks with billion-dollar tech budgets have no excuse for weekend blind spots when phishing attacks spike.
The FSS plans follow-up exams before Lunar New Year, focusing on whether boards received post-incident reports even when no customer data left the vendor sandbox. Regulators want proof that directors discussed vendor risk quarterly, not only after headlines.
Market and customer impact
Bank stocks barely moved Tuesday; investors treat compliance costs as recurring. Retail customers may see slower rollouts of AI-assisted mortgage chat if legal reviews delay launches. Foreign banks operating Korean branches said they will align with local reporting windows to avoid dual standards during cross-border audits.
For the financial system, the audits are a reminder that outsourcing intelligence does not outsource the FSS knock on the door. When the next vendor glitch surfaces on a Saturday night, regulators expect the call to regulators before the Monday management meeting—not after it.
Industry associations asked the FSS to publish a sanitized FAQ showing how banks should classify “model hallucination” logs that accidentally echo customer account numbers in debug files. Examiners said they are drafting examples but will not bless any vendor product by name. Regional banks in Busan and Daegu told reporters they are pooling overnight SOC staff through shared services centers—a cooperative model the FSS said it would watch for single points of failure.
Insurance units owned by banking groups face parallel reviews on claims-scoring AI, suggesting the vendor-reporting crackdown will spread beyond deposits to motor and health policies by year-end. For now, the immediate homework is simpler: rewrite escalation trees so the person answering a vendor phone call at 2 a.m. knows which FSS hotline to wake, not which ticket queue to update.
A FSS spokesperson said Tuesday that formal enforcement letters could follow if banks miss a 30-day remediation window, though no penalties were announced yet. That deadline gives compliance teams a concrete clock while legal departments negotiate vendor indemnity clauses. Board audit committees were told to add AI vendor status as a standing agenda item, not an annual footnote.