Yes FSC announced *Oct 15, 2026*.
*What happened:*$AGT $SIREN $TIA
Trigger: Security incidents at *16 companies*, including crypto exchanges. Then FSC did industry-wide review of *555 financial companies*.
- Found *cybersecurity deficiencies at 130 firms*, with *∼100,000 pieces of customer info exposed* - names, contact details, resident registration numbers (national IDs), emails.
*Who was named:*
Crypto: *Streami* (operator of Gopax exchange) and *Prabang / Pravang* (trading platform that disclosed Oct 2 hack leaking personal info)
- Also banks: *Shinhan, Kookmin, Busan, Hana*, plus savings banks Yegaram, Welcome, DB, OK, Hyundai Capital etc.
*New regime proposed (not yet effective):*
*Twice-yearly vulnerability assessments* for large financial institutions - up from once yearly (external websites already 2x, now internal systems too)
- *Unscheduled inspections* allowed when urgent threats emerge
- *Enhanced info-sharing* between govt and private sector
- *AI-powered monitoring* for SMEs who lack resources
- *Stronger executive accountability* - defining cybersecurity duties of senior execs, treating failures as governance failures
FSC said it's still investigating if attacks used *AI* and if same attacker group hit multiple firms.
And yes, crypto VASPs will face *same rigorous checks as banks* under this - which will raise compliance costs, especially for smaller Korean exchanges. No exact effective date yet - it's a reform plan out for implementation.
Separately, South Korea also moved to *block 27 overseas crypto websites* including KuCoin and MEXC in same week for operating without VASP registration.
*What happened:*$AGT $SIREN $TIA
Trigger: Security incidents at *16 companies*, including crypto exchanges. Then FSC did industry-wide review of *555 financial companies*.
- Found *cybersecurity deficiencies at 130 firms*, with *∼100,000 pieces of customer info exposed* - names, contact details, resident registration numbers (national IDs), emails.
*Who was named:*
Crypto: *Streami* (operator of Gopax exchange) and *Prabang / Pravang* (trading platform that disclosed Oct 2 hack leaking personal info)
- Also banks: *Shinhan, Kookmin, Busan, Hana*, plus savings banks Yegaram, Welcome, DB, OK, Hyundai Capital etc.
*New regime proposed (not yet effective):*
*Twice-yearly vulnerability assessments* for large financial institutions - up from once yearly (external websites already 2x, now internal systems too)
- *Unscheduled inspections* allowed when urgent threats emerge
- *Enhanced info-sharing* between govt and private sector
- *AI-powered monitoring* for SMEs who lack resources
- *Stronger executive accountability* - defining cybersecurity duties of senior execs, treating failures as governance failures
FSC said it's still investigating if attacks used *AI* and if same attacker group hit multiple firms.
And yes, crypto VASPs will face *same rigorous checks as banks* under this - which will raise compliance costs, especially for smaller Korean exchanges. No exact effective date yet - it's a reform plan out for implementation.
Separately, South Korea also moved to *block 27 overseas crypto websites* including KuCoin and MEXC in same week for operating without VASP registration.