The FSC announced a 20-day notice (June 10~July 1) of revision to the Regulation on Financial Institutions’ Outsourcing of Data Processing Business & IT Facilities. The revision intends to reduce financial institutions’ burden related with outsourcing of data processing business by shifting regulatory focus from the current ‘ex ante to ‘ex post’ regulations. Outsourcing their data processing, financial institutions are subject to obligations under relevant data protection laws and regulations to protect customers’ personal information. The revised draft will be reported to the Financial Regulatory Council to be held on June 18, reviewed by the Regulatory Reform Committee and finally approved by the FSC to be enforced.
BACKGROUND
Financial institutions outsource their data processing business for financial transaction information to cut cost and enhance efficiency. Korea established the Regulation on Financial Institutions’ Outsourcing of Data Processing Business & IT Facilities in June 2013 to allow the outsourcing of such data processing business. Since then, there have been requests from financial institutions including foreign financial firms for further improvement in the relevant regulation in accordance with global standards. The FSC gathered opinions and suggestions from financial firms to come up with the revision to the regulation.
KEY CONTENTS
1. Streamline regulatory system
The current regulation requires the outsourcing of data processing to be reported to the Financial Supervisory Service(FSS), while requiring the outsourcing of IT facilities to be approved by the Financial Services Commission(FSC).
With the revision, the requirement for approval in regard with IT facilities outsourcing will be abolished. Under the revised regulation, financial firms will be required to report the outsourcing of their data processing business to the FSS.
2. ‘Ex post’ reporting of data outsourcing
Under the current regulation, financial institutions are required to report to the FSS all the information irrelevant with personal information in advance to outsourcing data processing.
Financial institutions will be allowed to outsource their data processing business with the principle of ‘ex post’ reporting to the FSS. The outsourcing of individual customers’ financial transaction information will be exceptionally required to be reported to the FSS prior to outsourcing data processing
3. Abolish restrictions on offshore outsourcing to a third party
The offshore outsourcing of data processing by a financial institution is currently restricted to its head office, branches and affiliates. It is exceptionally allowed for the outsourced company to outsource to another subcontractor such as a professional IT service provider with permission by the Governor of the FSS. However, it has been pointed out that such restrictions are excessive compared to overseas regulations and requirements for such subcontractors are ambiguous. There have been claims as well such restrictions might adversely discriminate domestic financial firms against their foreign counterparts with no overseas branch to outsource their data processing business.
The provision that restricts offshore outsourcing to a financial firms’ head office, branch and affiliates will be eliminated to allow outsourcing to a third party including a professional IT company.
4. Abolish the obligatory use of standard contract form
Financial institutions are currently obliged to use a standard contract form in signing a contract to outsource their data processing business, which has been claimed to curtail autonomy of financial institutions.
The obligatory use of standard contract form will be abolished to allow financial institutions to reflect sector-specific conditions as long as the contract form includes basic requirements such as obligations to receive the regulator’s supervision and inspection or responsibility for customers’ loss.
EXPECTED BENEFITS
Financial institutions are expected to benefit from lowered cost and improved business efficiency by outsourcing data processing business, which will ultimately strengthen competitiveness of Korea’s financial industry.
Simplified process of outsourcing data processing business is expected to reduce initial cost of establishing IT facilities for internet-only banks in the future.
The FSC will continue to be committed in fostering business-friendly environment for domestic and foreign financial institutions by improving regulations and advancing financial system.
* Please refer to the attached PDF for details.
BACKGROUND
Financial institutions outsource their data processing business for financial transaction information to cut cost and enhance efficiency. Korea established the Regulation on Financial Institutions’ Outsourcing of Data Processing Business & IT Facilities in June 2013 to allow the outsourcing of such data processing business. Since then, there have been requests from financial institutions including foreign financial firms for further improvement in the relevant regulation in accordance with global standards. The FSC gathered opinions and suggestions from financial firms to come up with the revision to the regulation.
KEY CONTENTS
1. Streamline regulatory system
The current regulation requires the outsourcing of data processing to be reported to the Financial Supervisory Service(FSS), while requiring the outsourcing of IT facilities to be approved by the Financial Services Commission(FSC).
With the revision, the requirement for approval in regard with IT facilities outsourcing will be abolished. Under the revised regulation, financial firms will be required to report the outsourcing of their data processing business to the FSS.
2. ‘Ex post’ reporting of data outsourcing
Under the current regulation, financial institutions are required to report to the FSS all the information irrelevant with personal information in advance to outsourcing data processing.
Financial institutions will be allowed to outsource their data processing business with the principle of ‘ex post’ reporting to the FSS. The outsourcing of individual customers’ financial transaction information will be exceptionally required to be reported to the FSS prior to outsourcing data processing
3. Abolish restrictions on offshore outsourcing to a third party
The offshore outsourcing of data processing by a financial institution is currently restricted to its head office, branches and affiliates. It is exceptionally allowed for the outsourced company to outsource to another subcontractor such as a professional IT service provider with permission by the Governor of the FSS. However, it has been pointed out that such restrictions are excessive compared to overseas regulations and requirements for such subcontractors are ambiguous. There have been claims as well such restrictions might adversely discriminate domestic financial firms against their foreign counterparts with no overseas branch to outsource their data processing business.
The provision that restricts offshore outsourcing to a financial firms’ head office, branch and affiliates will be eliminated to allow outsourcing to a third party including a professional IT company.
4. Abolish the obligatory use of standard contract form
Financial institutions are currently obliged to use a standard contract form in signing a contract to outsource their data processing business, which has been claimed to curtail autonomy of financial institutions.
The obligatory use of standard contract form will be abolished to allow financial institutions to reflect sector-specific conditions as long as the contract form includes basic requirements such as obligations to receive the regulator’s supervision and inspection or responsibility for customers’ loss.
EXPECTED BENEFITS
Financial institutions are expected to benefit from lowered cost and improved business efficiency by outsourcing data processing business, which will ultimately strengthen competitiveness of Korea’s financial industry.
Simplified process of outsourcing data processing business is expected to reduce initial cost of establishing IT facilities for internet-only banks in the future.
The FSC will continue to be committed in fostering business-friendly environment for domestic and foreign financial institutions by improving regulations and advancing financial system.
* Please refer to the attached PDF for details.