The Financial Services Commission announced that a revision bill for the Special Act on the Prevention of Loss Caused by Telecommunication-based Financial Fraud and Refund for Loss passed the National Assembly at a plenary session held on January 15. The amended legislation provides a legal ground for relevant officials and authorities (in finance, telecom services, and investigation) to share and make use of suspicious data on the previously established AI-based Anti-phishing Sharing and Analysis Platform (ASAP).

Key Revision Details

First, the amended legislation establishes a new term “fraud-linked suspicious account” to allow the sharing of information for suspicious accounts not only for fraudsters but also for victims. Previously, financial companies were able to share information about the accounts used in frauds and those suspected to have incurred damage, but these were all account information related to fraudsters. Thus, previously, there was no legal ground for financial companies to share information about victims’ accounts.

Second, to make sure a stable operation of the AI-based Anti-phishing Sharing and Analysis Platform (ASAP), the FSC is authorized to designate a data sharing and analysis institution. Based on high levels of data analysis expertise and selection criteria, the FSC will designate a data sharing and analysis institution, which will then establish its own technological, physical, and managerial measures to make sure stability in the sharing of data. The FSC will also have the supervisory authority over this institution to revoke designation and take other steps if it fails to carry out duties properly.

Third, under the amended Act, the types of information provided through ASAP are more clearly established to increase predictability. In addition, when fraud-related data is being transmitted to the data sharing and analysis institution, there is no need to acquire consent from the data subject (fraudsters and victims) to facilitate a speedy response and prevent damages. Meanwhile, the fraud-related data provider, the fraud-related data user, and the data sharing and analysis institution are prohibited from making use of fraud-related data for purposes other than vishing prevention. The amended Act also establishes various protective measures for data subjects.

Further Plan

With the amended Act in place, collecting and sharing of fraud-related data from all financial companies, telecom service providers, and investigative authorities will be possible, which will be put to use for various preventive measures including the freeze of accounts suspected to be linked to vishing scams and drawing up preventive policies and advisory warnings intended for fraud-prone groups. In particular, nonbank financial institutions, which have been relatively less capable of identifying suspicious transaction activities originating from newly emerging scam types, will be able to more effectively respond to them and freeze the accounts linked to criminal activities.

The revised Act is scheduled to take effect six months after promulgation (expected to be in July 2026). The FSC plans to prepare revisions to subordinate statutes to ensure a seamless implementation of the legislation, while making active efforts to facilitate the sharing of data with telecom service providers and investigative authorities.

* Please refer to the attached PDF for details.