meta_id 3077703

On April 20, 2026, South Korea's Financial Services Commission (FSC) and Financial Supervisory Service (FSS) implemented amendments to the Electronic Financial Supervision Regulation Enforcement Rules permitting financial companies and electronic financial businesses to use cloud-based software-as-a-service (SaaS) applications on internal networks without separate innovation finance service approval. The amendment creates an exception to network segregation requirements for SaaS applications, provided financial institutions comply with specified security standards. The exception applies to office management and business support services, including document creation, video conferencing, collaboration tools, and performance management systems. However, the exception does not apply where financial companies process unique identification information or personal credit information. Where pseudonymised data is involved, institutions must follow existing innovation finance service designation procedures before deploying SaaS. To complement the network segregation exception, the FSC and FSS mandate strict information protection control measures. Financial institutions must: utilise SaaS evaluated by incident response agencies (such as the Financial Security Institute); establish protection measures for access terminals; conduct semi-annual compliance evaluations; and report findings to internal information protection committees chaired by the Chief Information Security Officer. The FSC and FSS published security guidance documents to assist financial companies in understanding and implementing these security controls. The amendment forms part of the Financial Sector Network Segregation Regulation Improvement Roadmap, designed to transition from passive security management to proactive, autonomous, and systematic approaches. The FSC and FSS indicated plans to extend network segregation exceptions to generative artificial intelligence services and develop additional measures to prevent network segregation regulations from impeding artificial intelligence service development. The amendment followed a 20-day advance notice period (January 20 to February 9, 2026) and Regulatory Reform Committee review on April 7, 2026.